Evaluate systemd logs using journalctl
Finding the Time
If necessary, you can filter logs to show events at exact times. This is very helpful for computers that are not restarted often. Use the options --since
and --until
to narrow down the time window to the minute or second as required. You can also combine these options.
You can see an example of using one of the options on its own in the first line of Listing 5. The second line contains an example of using both. If you are specifying the time, it must be in the format YYYY-MM-DD HH:MM:SS
. You can also use more general options such as --since yesterday
, as shown in Listing 5.
Listing 5
Filtering Logs by Time
Filter by component
There are other filters you can use to search for specific events. This means you can detect messages relating to individual components. For example, if you are experiencing problems with your web server, use journalctl -u apache2.service
to display only related events (Figure 3).
If you have an idea of where the error may be occurring within the web server, refine the filter further, as in the example query (Listing 6, line 1) of a suspect PHP module. To investigate specific processes, you can also filter by process, user or group ID.
Listing 6
Filtering by Component
First, look for the corresponding process ID. You can do this using the commands pidof
or ps
(Listing 6, lines 2 and 3). Next, query the corresponding process using the option _PID=
(line 4). In Debian, you can find the user for the web server using the command id -u www-data
(line 5), for instance to display all events since midnight (line 6). To display all possible filters, use man systemd.journal-fields
.
You can also search for notifications from misbehaving applications. To do this, simply enter the relevant path. For applications installed via your package manager, these should be located in /usr/bin, for instance journalctl /usr/bin/amarok
. For other apps, use which <name>
to determine the exact path.
Including Kernel Messages
If your want to check for kernel messages, you can do so for the current session with journalctl -k
. For information on previous sessions, use journalctl -k -b -n
.
The option -p determines the priority of displayed messages. For instance, journalctl -p err
shows error messages whereas journalctl -p crit
displays critical messages. The log levels are the usual syslog log levels as documented in syslog(3) which you can find online, for instance on Wikipedia [4]. Both numeric and text values are accepted.
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.