Linux: Display system logs on systems using “systemd”

On a Linux system that uses systemd for managing services and logs, you can use the journalctl command to display system logs. Systemd’s journal provides a centralized and efficient way to access and analyze log data. Here are some common journalctl commands for viewing system logs:

  1. View the entire journal: To display the entire system log, use the journalctl command without any options:journalctl This will display log entries starting with the most recent.
  2. View logs since a specific time: You can view logs since a specific time by using the -S (since) option:journalctl -S "YYYY-MM-DD HH:MM:SS" Replace “YYYY-MM-DD HH:MM:SS” with the desired timestamp.
  3. View logs for a specific unit (service): To view logs for a specific systemd unit (e.g., a service), use the -u option followed by the unit name:journalctl -u your-service-name
  4. View logs with a specified priority (log level): You can filter logs by priority (log level) using the -p option. For example, to view only messages with priority “error” or higher:bashCopy codejournalctl -p err You can use different log levels, such as “emerg,” “alert,” “crit,” “err,” “warning,” “notice,” “info,” and “debug.”
  5. Display logs as a continuous stream: To view logs in real-time as they are written to the journal, use the -f option:journalctl -f Press Ctrl+C to exit the continuous view.
  6. Display logs from the previous boot: To view logs from the previous boot, you can use the -b option with an offset. For example, to view logs from the last boot:journalctl -b -1 The -1 indicates the previous boot, and you can use -2 for the boot before that, and so on.
  7. Filter logs by a specific process or program: To filter logs by a specific process or program, you can use the -t (tag) option. For example:journalctl -t your-process-name
  8. View logs in a pager (e.g., less): By default, journalctl may display logs using a pager (usually “less”) for easier navigation. You can scroll through logs using arrow keys, and press q to exit.

These are some of the common journalctl commands to display Linux system logs using systemd. The journal provides a powerful and flexible way to access and search for log information on a systemd-managed system.

Leave a comment