journalctl was added into the systemd release of CentOS 7 and has been part of Fedora since 17. It is a logging system for querying and printing messages form the journal. It can be used in with or replacing older logging services like rsyslogd. Journalct also uses highlighting for high priority messages in red and bold for lines with notice and warning priorites. All data is shown when searching, including rotated logs.
Boot messages
Show boot messages:
journalctl -b
Show the last boot message:
journalctl -b -1
List boots of the system:
journalctl --list-boots
Type searches
Show error messages:
journalctl -p err
Show critical messages:
journalctl -p crit
Show messages by a specific user:
journalct -u httpd
Show messages relating to a specific disk:
journalctl /dev/sda
Time based searches
Show messages since yesterday:
journalctl --since yesterday
Show messages until a certain date & time:
journalctl --until "2017-5-03 11:59:59"
Show messages between two times:
journalctl --since 04:400 --until 10:59
Show last 20 messages:
journalctl -n 20
Live output
Tail the logs:
journalctl -f
Get live output from a specific service:
journalctl -u mysql.service -f
Filtering output
Show journalctl metadata:
journalctl -o verbose
Creating persistant storage for journalctl
If you would like create persistant storage for journalctl do the following:
mkdir -p /var/log/journal
then restart journald:
systemctl restart systemd-journald