journalctl - Query the systemd journal

Posted on Edited on In , Views:

journalctl may be used to query the contents of the systemd journal as written by systemd-journald.service.

If called without parameters, it will show the full contents of the journal, starting with the oldest entry collected.

The following are some of the common used options:

  • –no-full, –full, -l Ellipsize fields when they do not fit in available columns. The default is to show full fields, allowing them to wrap or be truncated by the pager, if one is used.
  • -f, –follow Show only the most recent journal entries, and continuously print new entries as they are appended to the journal.
  • -u, –unit=UNIT or PATTERN Show messages for the specified systemd unit UNIT (such as a service unit), or for any of the units matched by PATTERN. This parameter can be specified multiple times.
  • -S, –since=, -U, –until= Start showing entries on or newer than the specified date, or on or older than the specified date, respectively.

The following commands are to save the journal to a file or query it on the fly with the -f option.

$ systemctl -a | grep ntpd.service
  ntpd.service  loaded    active   running   Network Time Service
$ journalctl -u ntpd > ntpd.journal.out
$ tail ntpd.journal.out

$ journalctl -u ntpd* --since "10 minutes ago"

$ journalctl -lfu ntpd*