Table of Contents

journalctl

Show Logs

# All log entries for postfix
journalctl _UID=`id -u postfix` --no-pager
# Or
journalctl _SYSTEMD_UNIT=postfix@-.service
journalctl _SYSTEMD_UNIT=ssh.service
journalctl -u ssh.service
journalctl -u ssh.service -u postfix@-.service
# Yesterday's log entries
journalctl _UID=`id -u postfix` -S yesterday -U today
# OR
journalctl -u postfix@-.service -S yesterday -U today

This does NOT work!

journalctl _SYSTEMD_UNIT=postfix.service

By Duration/Time

# Today's log entries
journalctl _UID=`id -u postfix` -S today
# Since 5 minutes ago
journalctl -u postfix@-.service --since "5 minutes ago"
# Other e.g.
journalctl -u postfix@-.service --since "1 hour ago"
journalctl -u postfix@-.service --since "2 days ago"
journalctl -u postfix@-.service --since "2023-11-12 23:15:00" --until "2023-11-12 23:20:00"
# Tail log entries
journalctl _UID=`id -u postfix` -f
# Tail only last 50 lines
journalctl -u postfix@-.service -n 50 --since "1 hour ago"
# In Reverse
journalctl -r -u postfix@-.service -n 50 --since "1 hour ago"
# Filter by priority
journalctl -r -u postfix@-.service -n 50 --since "1 hour ago" -p "emerg".."warning"

Levels are: ● 0 or “emerg”, ● 1 or “alert”, ● 2 or “crit”, ● 3 or “err”, ● 4 or “warning”, ● 5 or “notice”, ● 6 or “info”, ● 7 or “debug”

Clear History

# Mail log
journalctl -u postfix.service --flush --rotate --vacuum-time=1s
# All logs?
journalctl --flush --rotate --vacuum-time=1s