Filtering the Logs

By importance: priority

Every log entry has a priority, from emerg (the system is unusable) down to debug. sudo journalctl -p LEVEL shows that level and everything more serious, so -p err is the fast way to “show me only the problems”:

sudo journalctl -p err -b --no-pager -n 10

In the terminal

student@vulntech:~$ sudo journalctl -p err -b --no-pager -n 10
[sudo] password for student:
-- No entries --

By time, and by text

--since and --until take times like "10 min ago" or "2024-01-01 09:00". -g PATTERN keeps only lines matching a pattern. Combine filters freely:

sudo journalctl --since "10 min ago" --no-pager -n 5
journalctl -b -g systemd --no-pager -n 5

In the terminal

student@vulntech:~$ sudo journalctl --since "10 min ago" --no-pager -n 5
[sudo] password for student:
Oct 18 08:23:19 vulntech sudo[581]:  student : TTY=ttyS0 ; PWD=/home/student ; USER=root ; COMMAND=/usr/bin/journalctl --since '10 min ago' --no-pager -n 5
Oct 18 08:23:20 vulntech sudo[581]: pam_unix(sudo:session): session opened for user root(uid=0) by student(uid=1000)
student@vulntech:~$ journalctl -b -g systemd --no-pager -n 5
Hint: You are currently not seeing messages from other users and the system.
      Users in groups 'adm', 'systemd-journal' can see all messages.
      Pass -q to turn off this notice.
No journal files were opened due to insufficient permissions.

Common mistake: -p err shows err and everything above it (more serious), not only err. To see warnings too, use -p warning.

Remember: sudo journalctl -p LEVEL filters by priority (that level and worse), --since/--until by time, -g PATTERN by text. They combine with -b and -u.