Journalctl is a command line tool in Linux for querying and displaying logs from journald, systemd’s logging service.
In this note i will show how to use journalctl to tail systemd service logs (display last 100 lines or follow) and how to show logs for particular time rages: today’s logs, previous boot logs or systemd service logs for specific date and time.
Cool Tip: Systemd service file examples! Read More →
Tail Systemd Service Logs using Journalctl
Show all systemd journal logs:
$ journalctl
Display logs for the current boot only:
$ journalctl -b
Display logs for the previous boot:
$ journalctl -b=-1
Tail last 100 lines of systemd logs for particular service (equiv. tail -n 100):
$ journalctl -u docker.service -n 100 --no-pager
Follow systemd logs for service (equiv. tail -f):
$ journalctl -u docker.service -f
Show systemd logs for service since today, since yesterday, etc.:
$ journalctl -u docker.service -S today $ journalctl -u docker.service -S yesterday $ journalctl -u docker.service -S "1 hour ago" $ journalctl -u docker.service -S "2 days ago"
Show logs between two dates:
$ journalctl -u docker.service -S "2020-01-16 18:00:00" -U "2020-01-17 23:00:00"
Grep journalctl service logs:
$ journalctl -u docker.service | grep -i error