Linux journalctl 옵션

Basic Usage

• journalctl → Show all logs.
• journalctl -f → Follow the log output in real time (like tail -f).
• journalctl -n 50 → Show the last 50 log entries.
• journalctl -r → Show logs in reverse order (newest first).
• journalctl --no-pager → Display logs without paging.

Filtering by Time

• journalctl --since "1 hour ago" → Show logs from the last hour.
• journalctl --since "2025-02-07 12:00:00" → Show logs since a specific date/time.
• journalctl --until "2025-02-07 18:00:00" → Show logs up to a specific date/time.
• journalctl --since "yesterday" --until "today" → Show logs from yesterday.

Filtering by Unit or Process

• journalctl -u nginx → Show logs for the nginx service.
• journalctl -u nginx -n 50 → Show the last 50 logs for nginx.
• journalctl -u nginx --since "1 hour ago" → Show logs for nginx from the last hour.
• journalctl _PID=1234 → Show logs for a specific process ID.
• journalctl _UID=1000 → Show logs for a specific user ID.

Filtering by Priority

• journalctl -p 3 -b → Show only error messages (0=emerg, 1=alert, 2=crit, 3=err).
• journalctl -p warning → Show logs of priority warning and above (warning, err, crit, etc.).

Filtering by Boot

• journalctl -b → Show logs from the current boot.
• journalctl -b -1 → Show logs from the previous boot.
• journalctl --list-boots → List available boot sessions.

Exporting Logs

• journalctl -o json → Output logs in JSON format.
• journalctl -o verbose → Show detailed log information.
• journalctl -o cat → Show logs without metadata.
• journalctl > logs.txt → Save logs to a file.