Use the journalctl command to view the journal logs. By default, the listed entries include a time stamp, the host name, the application that performed the operation, and the actual message.

# journalctl
-- Logs begin at ..., end at ...
[date_time] [host name] systemd-journal[65]: ...
...

 

The output of the command is formatted as follows:

– Entries are displayed one page at a time.

– Time stamps are converted to your local time zone.

– Priority of entries is visibly marked. Entries with error priority and higher are red. Entries with notice and warning priority are in bold font.

– The beginning of the boot process is indicated with a special entry.

 

When running the journalctl command without any options or arguments, all log data is displayed, including rotated logs. Oldest entries are listed first. A number of options are available for the journalctl command. Examples of some of the options are given below.

 

Examples of journalctl Command

 

1. Display newest log entries first

 

1. Use the -r option to display the newest log entries first.

# journalctl -r
-- Logs begin at Mon 2017-05-22 10:34:28 IST, end at Tue 2017-11-14 11:31:37 IST. --
Nov 14 11:31:37 geeklab systemd[1]: Stopping user-5006.slice.
Nov 14 11:31:37 geeklab systemd[1]: Removed slice user-5006.slice.
Nov 14 11:31:37 geeklab systemd-logind[71377]: Removed session 59130. 

 

2. Display specific number of recent log entries

Use the –n[number] option to display a specific number of the most recent log entries. The following example displays the three most recent log entries.

 # journalctl -n 3
-- Logs begin at Mon 2017-05-22 10:34:28 IST, end at Tue 2017-11-14 11:40:08 IST. --
Nov 14 11:40:08 geeklab su[92886]: (to oracle) root on none
Nov 14 11:40:08 geeklab su[92886]: pam_unix(su-l:session): session opened for user oracle by (uid=0)
Nov 14 11:40:08 geeklab su[92886]: pam_unix(su-l:session): session closed for user oracle

 

3. Display log entries of specific priority

Use the –p [priority] option to display only log entries of a specific [priority]. Valid priorities are debug, info, notice, warning, err, crit, alert, and emerg. The following example displays only crit log entries. Entries with err priority and higher are in red.

# journalctl -p crit
-- Logs begin at Mon 2017-05-22 10:34:28 IST, end at Tue 2017-11-14 11:40:08 IST. --
May 22 10:35:55 geeklab logger[73478]: Starting agent
May 23 06:30:06 geeklab sudo[58493]:  hptools : parse error in /etc/sudoers near line 125 ; TTY=pts/0 ; PWD=/home/hptools ;
May 23 06:30:06 geeklab sudo[58498]:  hptools : parse error in /etc/sudoers near line 125 ; TTY=pts/0 ; PWD=/home/hptools ; 

 

4. Display log entries only for specific systemd unit

Use the –u [systemd_unit] option to display only log entries for the specified systemd unit. The following example displays only log entries associated with the crond unit.

# journalctl -u ntpd
-- Logs begin at Mon 2017-05-22 10:34:28 IST, end at Tue 2017-11-14 12:01:40 IST. --
May 22 10:38:23 geeklab systemd[1]: Starting Network Time Service...
May 22 10:38:23 geeklab ntpd[124798]: ntpd 4.2.6p5@1.2349-o Tue May  3 14:43:00 UTC 2016 (1)
May 22 10:38:23 geeklab systemd[1]: Started Network Time Service. 

 

5. Formatting the output

Use the –o [output_form] option to format the output. Valid output formats are short, short-iso, short-precise, short-monotonic, verbose, export, json, jsonpretty, json-see, and cat. Refer to the journalctl man page for a description of the output formats. The following example displays log entries using the verbose format.

# journalctl -o verbose
-- Logs begin at Mon 2017-05-22 10:34:28 IST, end at Tue 2017-11-14 12:05:12 IST. --
Mon 2017-05-22 10:34:28.596388 IST [s=2eb4bc19c06148158649a58c85bf5ffd;i=1;b=20687e1fa4ce4c78a372ea44f064aa3c;m=26fb2c;t=55015ce4328a4;x=da00a88e8477
    PRIORITY=6
    _TRANSPORT=driver
    MESSAGE=Runtime journal is using 8.0M (max allowed 4.0G, trying to leave 4.0G free of 125.8G available → current limit 4.0G).
    MESSAGE_ID=ec387f577b844b8fa948f33cad9a75e6
    _PID=742
    _UID=0
    _GID=0
    _COMM=systemd-journal
    _EXE=/usr/lib/systemd/systemd-journald
    _CMDLINE=/usr/lib/systemd/systemd-journald
    _CAP_EFFECTIVE=5402800cf
    _SYSTEMD_CGROUP=/system.slice/systemd-journald.service
    _SYSTEMD_UNIT=systemd-journald.service
    _SYSTEMD_SLICE=system.slice
... 

 

6. Combining options

You can also combine various options used in the examples above as per your requirement. For example, to show the latest 3 log entries of priority critical, use the below command.

 # journalctl -n 3 -p crit
-- Logs begin at Mon 2017-05-22 10:34:28 IST, end at Tue 2017-11-14 12:10:12 IST. --
Sep 07 04:35:29 geeklab sshd[21232]: fatal: Read from socket failed: Connection reset by peer [preauth]
Oct 26 19:39:33 geeklab sshd[34860]: fatal: Read from socket failed: Connection reset by peer [preauth]
Oct 26 19:39:34 geeklab sshd[34862]: fatal: Read from socket failed: Connection reset by peer [preauth]

 

Was this answer helpful? 0 Users Found This Useful (3 Votes)