Nov 8, 2018

journalctl — Query the systemd journal

 journalctl may be used to query the contents of the systemd
       journal as written by systemd-journald.service.

       If called without parameters, it will show the full contents of the
       journal, starting with the oldest entry collected.

Example:

journalctl -xn

 -x, --catalog
           Augment log lines with explanation texts from the message
           catalog. This will add explanatory help texts to log messages in
           the output where this is available. These short help texts will
           explain the context of an error or log event, possible solutions,
           as well as pointers to support forums, developer documentation,
           and any other relevant manuals. Note that help texts are not
           available for all messages, but only for selected ones.

 -n, --lines=
           Show the most recent journal events and limit the number of
           events shown. If --follow is used, this option is implied. The
           argument is a positive integer or "all" to disable line limiting.
           The default value is 10 if no argument is given.

-f, --follow
           Show only the most recent journal entries, and continuously print
           new entries as they are appended to the journal.

journalctl has autocompletion (just hit the tab key) showing you the options to use. I.e.

# journalctl  < TAB >

AUDIT_LOGINUID=             __MONOTONIC_TIMESTAMP=
_AUDIT_SESSION=              _PID=
_BOOT_ID=                    PRIORITY=
_CMDLINE=                    __REALTIME_TIMESTAMP=
CODE_FILE=                   _SELINUX_CONTEXT=
CODE_FUNC=                   _SOURCE_REALTIME_TIMESTAMP=
CODE_LINE=                   SYSLOG_FACILITY=
_COMM=                       SYSLOG_IDENTIFIER=
COREDUMP_EXE=                SYSLOG_PID=
__CURSOR=                    _SYSTEMD_CGROUP=
ERRNO=                       _SYSTEMD_OWNER_UID=
_EXE=                        _SYSTEMD_SESSION=
_GID=                        _SYSTEMD_UNIT=
_HOSTNAME=                   _TRANSPORT=
_KERNEL_DEVICE=              _UDEV_DEVLINK=
_KERNEL_SUBSYSTEM=           _UDEV_DEVNODE=
_MACHINE_ID=                 _UDEV_SYSNAME=
MESSAGE=                     _UID=
MESSAGE_ID=

# journalctl
Quite some filtering options available here. Most of this options are self-explanatory.

If you just want to see the entries made by a particular command, issue journalctl _COMM= and the TAB key.

# journalctl _COMM=
abrtd            dnsmasq          mtp-probe        sh               tgtd
anacron          gnome-keyring-d  network          smartd           udisksd
avahi-daemon     hddtemp          polkit-agent-he  smbd             umount
bash             journal2gelf     polkitd          sshd             userhelper
blueman-mechani  kdumpctl         pulseaudio       sssd_be          yum
chronyd          krb5_child       qemu-system-x86  su              
colord           libvirtd         sealert          sudo            
crond            logger           sendmail         systemd        
dbus-daemon      mcelog           setroubleshootd  systemd-journal