SoFunction
Updated on 2025-03-10

Summary of the use of journalctl command

journalctlCommand is a command line tool in Linux system for querying and managing system logs. It is based onsystemdThe log daemonsystemd-journaldFunctions.

1. Introduction

journalctlCommands can help users find, filter and analyze system logs. These log information includes kernel messages, system service logs, user login and logout information, etc. passjournalctl, users can quickly locate system problems and troubleshoot them.

2. Command Options

The following isjournalctlSome common options for commands:

  • -f: Real-time tracking of log output, used to view the system's log information in real time.
  • -nor--lines=: Displays the specified number of log lines. For example,journalctl -n 10The most recent 10 logs will be displayed.
  • -u unit: Displays only the logs of the specified unit. For example,journalctl -u sshdAll log information of the sshd service will be displayed.
  • -k: Display kernel messages for debugging kernel-related issues.
  • -b: Displays the log of the boot process, used to troubleshoot system startup problems.
  • -p priority: Display only logs with specified priority. For example,journalctl -p errLog information for all error levels will be displayed.
  • --since timeand--until time: Displays log information within the specified time range. The time format can be "YYYY-MM-DD HH:MM:SS".

3. Example description

View all system log information:

journalctl

View system log information in real time:

journalctl -f

View the log information of the sshd service:

journalctl -u sshd

Show the last 10 log information:

journalctl -n 10

Display log information within a specified time range (for example, from 2024-06-01 00:00:00 to 2024-06-08 23:59:59):

journalctl --since "2024-06-01 00:00:00" --until "2024-06-08 23:59:59"

Simplified representation, view the log 1 hour ago to the current:

journalctl --since "1 hour ago"

Show kernel message:

journalctl -k

Check the docker log

journalctl -u  -f

journalctl -u -fis a commonly used command on Linux systems, used for viewing and trackinglogs. Specifically, the meaning of each part of this command is as follows:

  • journalctl:This issystemdlog viewing tool for accessingsystemdlogs.systemdIt is the initialization system and service manager in many modern Linux distributions.
  • -u : This option specifies which service log you want to view. Here, it is, i.e. the log of the Docker service.
  • -f: This option makesjournalctlEnter "follow" mode, i.e. it displays new log entries in real time, rather than just the current log. This means that if you generate new log entries after you run this command, these new entries will also be displayed on the terminal immediately.

So, when you runjournalctl -u -fWhen you see the real-time log output of the Docker service. This is very useful for debugging Docker-related issues or observing Docker behavior.

This is the end of this article about the summary of the use of journalctl commands. For more related contents of journalctl commands, please search for my previous articles or continue browsing the related articles below. I hope everyone will support me in the future!