dark

journalctl – Retrieve the systemd journal, CentOS 7-only

The journalctl command is a tool used to retrieve and display logs from the systemd journal. It is a CentOS 7-only tool used to view and analyze logs from the system. The systemd journal is a centralized location for storing log data generated by the system and its services.

Overview

The journalctl command can be used to view logs in real-time or retrospectively. By default, the logs are displayed in reverse chronological order, with the most recent logs displayed first. The logs can be filtered based on various criteria, such as time range, priority level, and specific services.

Syntax

journalctl [OPTIONS...] [MATCHES...]

Examples

  • To view all system logs:
journalctl
  • To view all logs generated by the httpd service:
journalctl -u httpd
  • To view all logs generated in the last 24 hours:
journalctl --since "24 hours ago"
  • To follow logs in real-time:
journalctl -f
  • To view logs from a specific boot:
journalctl -b <boot_number>

Specific use cases

  • Troubleshooting system issues: journalctl can be used to view logs generated by the system and its services, which can help in identifying and resolving system issues.
  • Monitoring system performance: journalctl can be used to monitor system performance by viewing logs related to CPU, memory, and disk usage.
  • Debugging application issues: journalctl can be used to view logs generated by specific services or applications, which can help in identifying and resolving application issues.

Options

The following options are available for the journalctl command:

Option Description
-a, --all Show all fields, including long and unprintable fields.
-b [ID], --boot=[ID] Show logs from the specified boot ID.
-e, --pager-end Go to the end of the journal when starting the pager.
-f, --follow Follow the journal in real-time.
-k, --dmesg Show only kernel messages.
-n [NUM], --lines=[NUM] Show the specified number of journal entries.
-o [FORMAT], --output=[FORMAT] Show output in the specified format.
-p [LEVEL], --priority=[LEVEL] Show only messages with the specified priority level.
-r, --reverse Show the journal in reverse chronological order.
--since=[TIME] Show logs since the specified time.
--until=[TIME] Show logs until the specified time.
-u [UNIT], --unit=[UNIT] Show logs for the specified unit.

Troubleshooting tips

  • If the journalctl command does not display any logs, ensure that the systemd-journald service is running.
  • If the journalctl command displays logs in an unexpected format, ensure that the output format is specified correctly using the -o option.
  • If logs are missing or incomplete, ensure that the systemd-journald service is configured to store logs persistently. By default, logs are stored in volatile memory and are lost on reboot.

Notes

  • The journalctl command requires root privileges to view logs generated by other users.
  • The journalctl command can be used to view logs from remote systems by specifying the --machine option followed by the hostname or IP address of the remote system.
  • The journalctl command can be used to view logs from specific processes by specifying the --user option followed by the username of the user running the process.

Related commands