How to see full log from systemctl status service?

Question

I check service status with systemctl status service-name.

By default, I see few rows only, so I add -n50 to see more.

Sometimes, I want to see full log, from start. It could have 1000s of rows.
Now, I check it with -n10000 but that doesn't look like neat solution.

Is there an option to check full systemd service log similar to less command?

Answer 1

Just use the journalctl command, as in:

journalctl -u service-name.service

Or, to see only log messages for the current boot:

journalctl -u service-name.service -b

For things named <something>.service, you can actually just use <something>, as in:

journalctl -u service-name

But for other sorts of units (sockets, targets, timers, etc), you need to be explicit.

In the above commands, the -u flag is short for --unit, and specifies the name of the unit in which you're interested. -b is short for --boot, and restricts the output to only the current boot so that you don't see lots of older messages. See the journalctl man page for more information.

Answer 2

systemctl can include the complete output of its status listing, without truncation., by adding the -l flag:

systemctl -l status service-name

-l: don't truncate entries with ellipses (...)

--no-pager can be added to avoid invoking a pager when the output is an interactive terminal.

Answer 3

Use journalctl to View Your System's Logs

          ︙

View journalctl without Paging

To send your logs to standard output and avoid paging them, use the --no-pager option:

journalctl --no-pager

It’s not recommended that you do this without first filtering down the number of logs shown.

journalctl -u service-name.service

          ︙

Show Logs within a Time Range

Use the --since option to show logs after a specified date and time:

journalctl --since "2018-08-30 14:10:10"

Use the --until option to show logs up to a specified date and time:

journalctl --until "2018-09-02 12:05:50"

Combine these to show logs between the two times:

journalctl --since "2018-08-30 14:10:10" --until "2018-09-02 12:05:50"

The above was largely copied from Use journalctl to View Your System's Logs at Linode Docs.  There is more information available there.

Answer 4

Most of the time, it is convenient and easy to use the following bash command:

journalctl -xefu service-name.service

or

journalctl -xefu service-name

It works as if the process is executed via shell and the output is changing dynamically (similar to tail -f).

Answer 5

Using journalctl, write logs to a text file, and read it bottom up:

journalctl -u service-name.service > file_name.txt &&\
tail file_name.txt

Answer 6

Since @Julien's answer no longer appears to work on my system (Debian 11), I've finally given in and hijacked systemctl on my system:

systemctl() { 
    if [[ "${1-}" == "log" ]]; then  
        /usr/bin/journalctl -u "${@:2}"; 
    else /usr/bin/systemctl "$@";
    fi 
}

Add this one-liner to your .bashrc and your systemctl will gain a new log "verb" that provides the missing functionality. No more wasting time retyping tedious commands.

As an added bonus, this method will also give you access to all the options of journalctl (provided that they're specified after the unit name):

systemctl log named.service --since=today

---

Edit: To address John's comment about the lack of bash-completion support and provide a more complete answer, we might as well hijack systemctl's bash completion function too:

source "/usr/share/bash-completion/completions/systemctl"
source "/usr/share/bash-completion/completions/journalctl"

_systemd_log_hijack() {
if [[ "${COMP_WORDS[1]}" == "log" ]]; then
if [[ "${COMP_CWORD}" == "2" ]]; then
COMPREPLY=( $(systemctl list-units 2>&1 | awk -c ' { print $1 }' | grep -F "${COMP_WORDS[2]}") )
elif [[ "${COMP_CWORD}" -gt "2" ]]; then
(( COMP_CWORD++ )) || true
COMP_WORDS=("journalctl" "-u" "${COMP_WORDS[2]}" "${COMP_WORDS[@]:2}")
COMP_LINE="${COMP_WORDS[*]}"
_journalctl
fi

else
_systemctl
fi
if [[ "${COMP_CWORD}" == "1" && "log" == "${COMP_WORDS[1]}"* ]]; then
    COMPREPLY=("log" "${COMPREPLY[@]}")
fi  
}
complete -F _systemd_log_hijack systemctl

This isn't a polished solution but it should provide usable bash completion for the non-standard log command verb.

Keep in mind that this is merely a hack to fix poorly-designed UX. The right way would be to somehow convince the SystemD project to accept a fix upsteam.

Answer 7

Starting with version 257, journalctl can show the log entries for only the latest (or any other) service invocation, using -I or --invocation=OFFSET.

Show log entries from latest invocation: (equivalent to --invocation=0)

journalctl -u service-name -I

First (oldest) invocation:

journalctl -u service-name --invocation=1

Second latest invocation:

journalctl -u service-name --invocation=-1