journalctl #

Options:

-e, --parger-end
    Immediately jump to the end of the journal inside the implied pager tool.

-f, --follow
    Show only the most recent journal entries, and continuously print new entries as they are appended to the journal.

-n, --lines=
    Show the most recent journal events and limit the number of events shown.

-x, --catalog
    Augment log lines with explanation texts from the message catalog.

-u, --unit=UNIT|PATTERN
    Show messages for the specified systemd unit UNIT.

--user-unit=
    Show messages for the specified user session unit.

-b, --boot[=[ID][offset]|all]
    Show messages from a specific boot. This will add a match for "_BOOT_ID=".
    The argument may be empty, in which case logs for the current boot will be shown.

--list-boots

-S, --since=, -U, --until=
    Start showing entries on or newer than the specified date, or on or older than the specified date, respectively.
    Date specifications should be of the format "2012-10-30 18:17:16".
    If the time part is omitted, "00:00:00" is assumed.
    If only the seconds component is omitted, ":00" is assumed.
    If the date component is omitted, the current day is assumed.
    For complete time and date specification, see systemd.time(7).

--system, --user
    Show messages from system or from user.

journalctl
journalctl -xe

# 指定system单元日志
journalctl -u nginx.service
# 指定user单元日志
journalctl --user-unit nginx.service

journalctl -b _PID=1234

# 从 2023-12-19 08:17:16 到 现在 的日志
journalctl -S "2023-12-19 08:17:16"

# 从 4小时30分钟前 到 2小时前 的日志
journalctl -S -4h30m -U -2h

# 从 昨天0点 到 今天0点 的日志
journalctl -S yesterday -U today

# 今天的日志
journalctl -S today

# Time units:
# msec, ms
# seconds, second, sec, s
# minutes, minute, min, m
# hours, hour, hr, h
# days, day, d

journalctl -k -b -1

journalctl --list-boots