systemd includes journalctl for logging managed services/processes.
The various arguments can be mixed and matched as needed; all combinations are not listed.
To view all logs, run journalctl without any arguments:
journalctl
To add extended information and use the pager to go to the end of the log supply the -x and -e options:
journalctl -xe
To view logs starting from the last boot -b can be used:
journalctl -x -b
An offset can be provided to view logs from an earlier boot. To view logs from 5 boots ago:
journalctl -x -b -5
To list all boots available:
journalctl --list-boots
Filters can be used to extract logs for services/time ranges.
The --since and --until arguments can specify time ranges. To get all logs for the last 1 hour:
journalctl --since "1 hour ago"
To get all logs in an exact time/date range:
journalctl --since "2015-06-26 23:15:00" --until "2015-06-26 23:20:00"
The date/time format must follow the systemd.time specification.
To filter the logs for a specific service, use the -u argument:
journalctl -xe -u servicename.service
More than one service name can be provided with additional -u arguments:
journalctl -xe -u servicename1.service -u servicename2.service
The -p argument allows filtering logs by priorities. To only get error logs:
journalctl -p err
The format "FROM".."TO" can also be used; to filter logs for emergency to critical events:
journalctl -p "emerg".."crit"
To filter logs for a specific user ID set the _UID variable. As an example to get logs for user ID 1000:
journalctl _UID=1000
To filter logs for a specific group ID set the _GID variable. As an example to get logs for user ID 1000:
journalctl _UID=1000
To filter logs for a specific process ID set the _PID variable. As an example to get logs for PID 100:
journalctl _PID=100
To filter logs for a specific executable supply the path as an argument:
journalctl /bin/bash
To filter for kernel logs:
journalctl -k
To tail logs use the -f argument:
journalctl -f
This can be combined with the -u filter for a service:
journalctl -f -u servicename.service
To reverse order log messages use the -r argument:
journalctl -r
Use the -n argument to limit the number of logs shown:
journalctl -u servicename1.service -u servicename2.service -n 5
To output logs in a different format use the -o argument:
journalctl -o verbose
The following formats are available:
jsonwill - One long line in JSON formatjson-pretty - Human readable JSON formatverbose - Verbose logging formatcat - Short format without date/timeshort - Default output format; logs displayed in syslog styleshort-monotonic - Short output format with precision time stampsTo find current disk space used by logs:
journalctl --disk-usage
To free up space, old logs can be "vacuumed". The logs can either be vacuumed to fit within a certain size:
sudo journalctl --vacuum-size=1G
Or a certain age:
sudo journalctl --vacuum-time=1years