Journalctl: Tail Service Logs – Systemd Journal

Journalctl is a command line tool in Linux for querying and displaying logs from journald, systemd’s logging service.

In this note i will show how to use journalctl to tail systemd service logs (display last 100 lines or follow) and how to show logs for particular time rages: today’s logs, previous boot logs or systemd service logs for specific date and time.

Cool Tip: Systemd service file examples! Read More →

Tail Systemd Service Logs using Journalctl

Show all systemd journal logs:

$ journalctl

Display logs for the current boot only:

$ journalctl -b

Display logs for the previous boot:

$ journalctl -b=-1

Tail last 100 lines of systemd logs for particular service (equiv. tail -n 100):

$ journalctl -u docker.service -n 100 --no-pager

Follow systemd logs for service (equiv. tail -f):

$ journalctl -u docker.service -f

Show systemd logs for service since today, since yesterday, etc.:

$ journalctl -u docker.service -S today
$ journalctl -u docker.service -S yesterday
$ journalctl -u docker.service -S "1 hour ago"
$ journalctl -u docker.service -S "2 days ago"

Show logs between two dates:

$ journalctl -u docker.service -S "2020-01-16 18:00:00" -U "2020-01-17 23:00:00"

Grep journalctl service logs:

$ journalctl -u docker.service | grep -i error