Log Analysis with journalctl

Intermediate10 min

Search, filter, and analyze systemd journal logs to diagnose service failures, boot issues, and system errors.

Prerequisites

-Linux with systemd

Steps

View logs for a specific service

Show all logs from a specific systemd service.

$ journalctl -u nginx --no-pager -n 50

Follow logs in real time

Stream new log entries as they are written.

$ journalctl -u nginx -f

Filter logs by time range

View logs from a specific time period.

$ journalctl --since '1 hour ago' --until 'now' --priority=err

Priority levels: emerg, alert, crit, err, warning, notice, info, debug. Use --priority=err to see only errors and above.

View boot logs

Show logs from the current or a previous boot.

$ journalctl -b -1 --priority=warning

-b 0 is the current boot, -b -1 is the previous boot. Use --list-boots to see available boot IDs.

Check journal disk usage

See how much disk space the journal logs are consuming.

$ journalctl --disk-usage

Use 'sudo journalctl --vacuum-size=500M' to reduce journal size to 500MB.

Full Script

full-script.sh

#!/bin/bash
# Log Analysis with journalctl
set -euo pipefail

echo "=== Journal Disk Usage ==="
journalctl --disk-usage

echo ""
echo "=== Recent Errors (last hour) ==="
journalctl --since '1 hour ago' --priority=err --no-pager -n 20 2>/dev/null || echo "No errors"

echo ""
echo "=== Available Boots ==="
journalctl --list-boots | tail -5

echo ""
echo "=== Failed Services Logs ==="
for service in $(systemctl list-units --type=service --state=failed --no-legend | awk '{print $1}'); do
  echo "--- $service ---"
  journalctl -u "$service" --no-pager -n 10
  echo ""
done

echo ""
echo "=== Log Commands ==="
echo "Service:    journalctl -u <service> -f"
echo "Errors:     journalctl --priority=err --since '1h ago'"
echo "Boot:       journalctl -b -1"
echo "Kernel:     journalctl -k"
echo "Vacuum:     sudo journalctl --vacuum-size=500M"

FAQ

Discussion

Loading comments...

#!/bin/bash # Log Analysis with journalctl set -euo pipefail echo "=== Journal Disk Usage ===" journalctl --disk-usage echo "" echo "=== Recent Errors (last hour) ===" journalctl --since '1 hour ago' --priority=err --no-pager -n 20 2>/dev/null || echo "No errors" echo "" echo "=== Available Boots ===" journalctl --list-boots | tail -5 echo "" echo "=== Failed Services Logs ===" for service in $(systemctl list-units --type=service --state=failed --no-legend | awk '{print $1}'); do echo "--- $service ---" journalctl -u "$service" --no-pager -n 10 echo "" done echo "" echo "=== Log Commands ===" echo "Service: journalctl -u <service> -f" echo "Errors: journalctl --priority=err --since '1h ago'" echo "Boot: journalctl -b -1" echo "Kernel: journalctl -k" echo "Vacuum: sudo journalctl --vacuum-size=500M"