How do i display systemd journal logs for a given date and/or time?

  • Man page for journalctl.

    There are the options --since and --until to do this:

           -S, --since=, -U, --until=
               Start showing entries on or newer than the specified date, or on or older than the
               specified date, respectively. Date specifications should be of the format "2012-10-30
               18:17:16". If the time part is omitted, "00:00:00" is assumed. If only the seconds
               component is omitted, ":00" is assumed. If the date component is omitted, the current day
               is assumed. Alternatively the strings "yesterday", "today", "tomorrow" are understood,
               which refer to 00:00:00 of the day before the current day, the current day, or the day
               after the current day, respectively.  "now" refers to the current time. Finally, relative
               times may be specified, prefixed with "-" or "+", referring to times before or after the
               current time, respectively.

    Display all logs from a day ago. If you have used git log with dates, the date structure is similar.

    $ journalctl -n 60 --since "1 day ago"

    Another example. All logs for current day, display up to 60 lines, after time 11.16

    $ journalctl -n 60 --since "11:16"
    -- Logs begin at Sun 2019-02-03 11:15:35 UTC, end at Sun 2019-02-03 12:40:39 UTC. --
    Feb 03 11:16:29 training1 dbus[2368]: [system] Activating via systemd: service name='org.fre
    Feb 03 11:16:29 training1 systemd[1]: Starting Hostname Service...
    Feb 03 11:16:29 training1 dbus[2368]: [system] Successfully activated service 'org.freedeskt
    Feb 03 11:16:29 training1 systemd[1]: Started Hostname Service.

    Note: At the beginning of the journal log, it gives the date range of that journal.


© Lightnetics 2019