Viewing and Filtering Log Messages

To view and filter log messages in the journal, you can use the journalctl command.

To view all log messages, run:

journalctl

When run without any options, the journalctl command displays all log messages.

You can also run the journalctl --grep command to return only lines that match a specified string or regular expression. If the string specified is all in lowercase, the match is treated as case-insensitive. If you need a case-sensitive match on a lowercase string, you can override this behavior with the --case-sensitive option.

You can apply other filters to log messages to limit output by specifying various filtering options, including:

-S, --since: Show only lines in the log after a specified date, time, or duration. For example, you can run any of the following commands:
```
journalctl --since today
journalctl --since "1 hour ago"
journalctl --since "2025-01-15 18:10:20"
```
-U, --until: Show only lines in the log before a specified date, time, or duration. For example, you can run:
```
journalctl --until "10 minutes ago"
```
-f, --follow: Follow the journal as it's being updated and display new entries as they're added. Use the Ctrl-c keyboard sequence to exit the log.
-n, --lines: Show only the most recent n lines.
-b, --boot: Show only the lines from the specified boot. If set to 0, log lines from the most recent boot are shown. If set to -1, log lines from the previous boot are used. Note that you need persistent storage for journald enabled to retain logs from previous boots. See Adding Persistent Journal Storage.
-u, --unit: Filter by unit name. For example, you can run:

journalctl -u cockpit.socket
journalctl -u cockpit.service

-t, --identifier: Filter by syslog identifier. For example, you can run:
```
journalctl -t sudo
```
-p, --priority: Filter by syslog priority. For example you can run:
```
journalctl -p crit
```
-x, --catalog: Include extra explanation texts from the message catalog, if available. These explanations can make log output dense, but can also be helpful in finding resolutions for issues that might appear in the log.

You can combine any of the filtering options to narrow the returned log information to exactly what you need. For example, to see all systemd's log activity for the current date until and hour ago, and to include explanatory messages, run:

journalctl --since "today" -U "1 hour ago" -t systemd -x