cheat:journalctl
# To actively follow log (like tail -f):
journalctl -f
# To display all errors since last boot:
journalctl -b -p err
# To filter by time period:
journalctl --since=2012-10-15 --until="2011-10-16 23:59:59"
# To show list of systemd units logged in journal:
journalctl -F _SYSTEMD_UNIT
# To filter by specific unit:
journalctl -u dbus
# To filter by executable name:
journalctl /usr/bin/dbus-daemon
# To filter by PID:
journalctl _PID=123
# To filter by Command, e.g., sshd:
journalctl _COMM=sshd
# To filter by Command and time period:
journalctl _COMM=crond --since '10:00' --until '11:00'
# To list all available boots:
journalctl --list-boots
# To filter by specific User ID e.g., user id 1000:
journalctl _UID=1000
# To filter by specific SYSLOG_INDENTIFIER:
journalctl -t systemd-resolved
tldr:journalctl
# journalctl
# Query the systemd journal.
# More information: <https://manned.org/journalctl>.
# Show all messages with priority level 3 (errors) from this [b]oot:
journalctl -b --priority=3
# Show all messages from last [b]oot:
journalctl -b -1
# Delete journal logs which are older than 2 days:
journalctl --vacuum-time=2d
# [f]ollow new messages (like `tail -f` for traditional syslog):
journalctl -f
# Show all messages by a specific [u]nit:
journalctl -u unit
# Filter messages within a time range (either timestamp or placeholders like "yesterday"):
journalctl --since now|today|yesterday|tomorrow --until YYYY-MM-DD HH:MM:SS
# Show all messages by a specific process:
journalctl _PID=pid
# Show all messages by a specific executable:
journalctl path/to/executable
$
cheat.sh