What are some useful journalctl commands?

What are some useful journalctl commands I should know?

Journalctl is a command-line tool to query and display messages from the journal, managed by systemd. Here are some useful commands:

1. journalctl - View the entire journal.
2. journalctl -b - Show logs from the current boot.
3. journalctl -u <service> - View logs for a specific service.
4. journalctl --since "2023-01-01" - Show logs since a specific date.
5. journalctl -f - Follow the log output in real-time.

How can I filter logs by a specific time range?

You can filter logs by a specific time range using the --since and --until options. For example: journalctl --since "2023-01-01" --until "2023-01-31" will show logs from January 1 to January 31, 2023.

Is there a way to view logs for a specific user?

Yes, you can filter logs by user using the _UID field. For example: journalctl _UID=1000 will show logs for the user with UID 1000.

Can I export the logs to a file?

Absolutely! You can export logs to a file using the redirection operator. For example: journalctl > logs.txt will save the entire journal to a file named logs.txt.