Journalctl gives us nice consolidated logs. However, on a number of occasions, we need to extract parts of the logs. There are multiple ways of doing it. To filter by process, you can use PID numbers as shown below.
To obtain PID number when you have the process name [or part of the process name], use the following:
The manual page only refers to it in examples. A commonly used slicing option is to see logs of current boot only. This can be done as follows.
Another option is to look at logs of a particular unit only. This can be done in the following way.
The unit name could be some daemon name like '
The beginning time stamp works fine; but the ending time stamp does not work. I talked about it at #systemd IRC channel. It is fixed and will be released soon.
journalctl _PID=<pid number>To obtain PID number when you have the process name [or part of the process name], use the following:
ps aux | grep -i <process name>The manual page only refers to it in examples. A commonly used slicing option is to see logs of current boot only. This can be done as follows.
journalctl -bAnother option is to look at logs of a particular unit only. This can be done in the following way.
journalctl -u <unit name>The unit name could be some daemon name like '
mysqld'. Unfortunately, this does not work with 'kernel' as a unit. It can be combined with the -b option though. However, I find myself dealing with messages from various units. So, I scan through all messages and find the messages I need. To filter them out, I can use time stamps in the messages using the following format.journalctl --since='2013-03-06 22:58:34' --until='2013-03-06 23:00:34'The beginning time stamp works fine; but the ending time stamp does not work. I talked about it at #systemd IRC channel. It is fixed and will be released soon.
