Journal Control

journalctl

May be used to query the contents of the systemd journal as written by systemd-journald.service.

Use

journalctl -xeb show latest messages with explanation since last boot
journalctl -t <service> show messages of a particular <service> only
journalctl -p <priority> show messages with particular <priority> and above only

Time

journalctl -b show messages from current boot
journalctl -S "1969-04-20 16:13:12" show messages since (not older than) <date>
journalctl -U "1969-04-20 16:13:12" show messages until (not newer than) <date>

Relative Time

journalctl -S today show today's messages, from midnight until now
journalctl -S yesterday show yesterday's messages, up until midnight
journalctl -S -1m show most recent messages not older than 1 minute
journalctl -S -1h show most recent messages not older than 1 hour
journalctl -S -1d show most recent messages not older than 1 day
journalctl -S -1w show most recent messages not older than 1 week

Useful Flags

-e jump to the end
-f follow latest messages
-b show messages since last boot only
-x show explanations

--list-boots show boot list
--disk-usage show journal disk use
--vaccuum-size=100M set log retention to size
--vaccuum-time=1weeks set log retention to time