Tweet
In this guide, I will be covering how to view systemd logs on Linux using different command line utilities.
Note: The commands mentioned in this guide are performed on Ubuntu. They will work without errors on all Linux distributions that come with the systemd init system.
Methods to View systemctl Logs
There are two approaches to viewing systemd logs on Linux:
The systemctl gives the most recent service-specific logs, while journalctl gives in-depth system-wide logs of all services and the specific service.
I will explore both utilities to view systemd logs. But first, let’s understand the key difference between systemctl and journalctl commands.
What is systemctl
Systemctl is a command line utility that manages systemd services, such as enabling or disabling the service and viewing the status. The systemctl status command also prints a few log lines of the service at the bottom of the output, and this log is after the recent boot. However, these log lines of the service are from after the current boot only.
What is journalctl
The journalctl is a command line utility used to print the logs collected by systemd. Compared to systemctl, it provides detailed output with filtering options. This utility is designed to:
- Read logs (Oldest log comes first)
- Monitor logs
- Filter logs based on time, service, or user
The systemd collects logs from kernel, services, and daemons and stores them in a centralized place.
How to View Log of a Service using systemctl
The general syntax to find the log of a service using the systemctl utility is mentioned below.
systemctl status [service-name]
For example, to view the log information of the smbd.service use the command given below.
systemctl status smbd.service
To get output without pagination, add the –no-pager option in the command.
systemctl status smbd.service --no-pager
How to View Log of a Service using journalctl
To view the log of a specific service of systemd, use journalctl with the -u command and service or unit name.
journalctl -u [service-name]
In the above command, the -u flag, short for –unit is used to filter the journalctl output by a unit name.
For example, to print the log of the smbd daemon, I will replace the [unit-name] with smbd.service.
journalctl -u smbd.service
In the output, it can be seen that the oldest entry comes first and then logs after each boot is listed.
To get the latest entry first use -e short for –pager-end.
journalctl -u smbd.service -e
If you want to omit the pagination from the output, simply append the –no-pager in the above-mentioned commands.
To continuously print the log entries in real-time use -f short for –follow.
journalctl -u smbd.service -f
The filtering can further be expanded by using the -b flag short for –boot, which prints the logs based on the current boot.
journalctl -u [unit-name] -b
Let’s print logs of the smbd.service from the recent boot.
journalctl -u smbd.service -b
The above output resembles the output we get using the systemctl status command.
To get a detailed log overview, use the -x short for –catalog option.
journalctl -u smbd.service -x
This will append a short description of the log.
Now, to print logs based on time using journalctl there are two options, -S short for –since and -U short for –until.
journalctl -u [unit-name] -S "[year-month-day] [hours:minutes:seconds]"
For example, to view the logs of unit smbd from 2024:01:30 12:05:00.
journalctl -u smbd.service -S "2024:01:30 12:05:00"
Conclusion
To view the systemd logs of a service, there are two main utilities, journalctl and systemctl. The journalctl is specifically designed for viewing the logs of systemd. However, the systemctl also has an option of printing the log of the service. To print the log of a service use, journalctl -u [unit-name] and systemctl [unit-name].
More...