the_information_nexus/tech_docs/linux/journalctl.md

journalctl Troubleshooting Guide

This guide provides a structured approach to troubleshooting common issues in Linux using the journalctl command.

General Troubleshooting

1. Review Recent Logs
   • View recent log entries: journalctl -e
   • Show logs since the last boot: journalctl -b

Service-Specific Issues

1. Identify Service Issues
   • Display logs for a specific service: journalctl -u service-name.service
     • Replace service-name with the actual service name, e.g., journalctl -u sshd

System Crashes or Boots

1. Investigate Boot Issues
   • Display logs from the current boot: journalctl -b
   • Show logs from the previous boot: journalctl -b -1
   • List boot sessions to identify specific instances: journalctl --list-boots

Error Messages

1. Filter by Error Priority
   • Show only error messages: journalctl -p err
   • For more severe issues, consider using higher priority levels like crit, alert, or emerg

Additional Tips

• Follow Live Logs: Monitor logs in real-time: journalctl -f
• Time-Based Filtering: Investigate issues within a specific timeframe:
  • Since a specific time: journalctl --since "YYYY-MM-DD HH:MM:SS"
  • Between two timestamps: journalctl --since "start-time" --until "end-time"
• Output Formatting: Adjust output format for better readability or specific needs:
  • JSON format: journalctl -o json-pretty
  • Verbose format: journalctl -o verbose
• Export Logs: Save logs for further analysis or reporting:
  • journalctl > logs.txt or journalctl -u service-name > service_logs.txt