Mdthbs

What are those bumps on top of the Antonov-225?

Do beef farmed pastures net remove carbon emissions?

A torrent of foreign terms

Why command hierarchy, if the chain of command is standing next to each other?

Do Reform Jews believe in a theistic God?

Why aren't rockets built with truss structures inside their fuel & oxidizer tanks to increase structural strength?

Why did IBM make public the PC BIOS source code?

If you know the location of an invisible creature, can you attack it?

Installing Windows to flash BIOS, then reinstalling Ubuntu

Who invented Monoid?

Are differences between uniformly distributed numbers uniformly distributed?

Scam? Phone call from "Department of Social Security" asking me to call back

How can I communicate my issues with a potential date's pushy behavior?

Simplification of numbers

Why aren't rainbows blurred-out into nothing after they are produced?

If "more guns less crime", how do gun advocates explain that the EU has less crime than the US?

(A room / an office) where an artist works

What is the status of this patent?

How can I find an old paper when the usual methods fail?

Graphs for which a calculus student can reasonably compute the arclength

What is a good class if we remove subclasses?

Corroded Metal vs Magical Armor, should it melt it?

Is there any way to stop a user from creating executables and running them?

In which case does the Security misconfiguration vulnerability apply to?

journalctl list until last unit start

Why x0vncserver is not starting at boot?How to use systemd aliases with journalctl?systemd: finish the execution of custom shell script before starting nginxSELinux woes developing systemd extensionWhy journalctl does not display log message if I use filtering by unit?Does “recovering journal” prove an unclean shutdown/unmount?nvme fstrim causing crash on linux, disabling with systemctl doesn't helpUse journalctl to show logs of specific unit which has a parameter?journalctl 12 hour format?List boots with unix timestamps via journalctl

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

5

2

A common task one wishes to do, when debugging a service that fails to load, is to look at all log from the last time the service was started.

For example, given

Jul 25 08:18:20 raspberrypi ngrok[3105]: Incorrect Usage: flag provided but not defined: -log

Jul 25 08:20:04 raspberrypi systemd[1]: ngrok@ssh.service holdoff time over, scheduling restart.

Jul 25 08:20:04 raspberrypi systemd[1]: Stopping Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Started Share local port(s) with ngrok.

Jul 25 08:20:04 raspberrypi ngrok[5474]: t=2016-07-25T08:20:04+0000 lvl=warn msg="failed to get home directory, using $HOME instead" err="user: Current not implemented on linux/arm" $HOME=

Jul 25 08:20:04 raspberrypi ngrok[5474]: Failed to open log file '/dev/stdout': open /dev/stdout: no such device or address

I want to see all lines since Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port....

Something like journalctl --boot, but from the last time service was started.

Is that possible?

Likewise, something like --list-boots that lists all the times systemctl has started or stopped the service would allow me to mimic journalctl --last-start -u svc behavior I wanted.

systemd journalctl

share|improve this question

edited Jul 25 '16 at 9:59

Rahul

9,81411 gold badge3232 silver badges4747 bronze badges

asked Jul 25 '16 at 9:56

Elazar LeibovichElazar Leibovich

1,33644 gold badges1717 silver badges2121 bronze badges

bumped to the homepage by Community♦ 15 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

5

2

A common task one wishes to do, when debugging a service that fails to load, is to look at all log from the last time the service was started.

For example, given

Jul 25 08:18:20 raspberrypi ngrok[3105]: Incorrect Usage: flag provided but not defined: -log

Jul 25 08:20:04 raspberrypi systemd[1]: ngrok@ssh.service holdoff time over, scheduling restart.

Jul 25 08:20:04 raspberrypi systemd[1]: Stopping Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Started Share local port(s) with ngrok.

Jul 25 08:20:04 raspberrypi ngrok[5474]: t=2016-07-25T08:20:04+0000 lvl=warn msg="failed to get home directory, using $HOME instead" err="user: Current not implemented on linux/arm" $HOME=

Jul 25 08:20:04 raspberrypi ngrok[5474]: Failed to open log file '/dev/stdout': open /dev/stdout: no such device or address

I want to see all lines since Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port....

Something like journalctl --boot, but from the last time service was started.

Is that possible?

Likewise, something like --list-boots that lists all the times systemctl has started or stopped the service would allow me to mimic journalctl --last-start -u svc behavior I wanted.

systemd journalctl

share|improve this question

edited Jul 25 '16 at 9:59

Rahul

9,81411 gold badge3232 silver badges4747 bronze badges

asked Jul 25 '16 at 9:56

Elazar LeibovichElazar Leibovich

1,33644 gold badges1717 silver badges2121 bronze badges

bumped to the homepage by Community♦ 15 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

A common task one wishes to do, when debugging a service that fails to load, is to look at all log from the last time the service was started.

For example, given

Jul 25 08:18:20 raspberrypi ngrok[3105]: Incorrect Usage: flag provided but not defined: -log

Jul 25 08:20:04 raspberrypi systemd[1]: ngrok@ssh.service holdoff time over, scheduling restart.

Jul 25 08:20:04 raspberrypi systemd[1]: Stopping Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Started Share local port(s) with ngrok.

Jul 25 08:20:04 raspberrypi ngrok[5474]: t=2016-07-25T08:20:04+0000 lvl=warn msg="failed to get home directory, using $HOME instead" err="user: Current not implemented on linux/arm" $HOME=

Jul 25 08:20:04 raspberrypi ngrok[5474]: Failed to open log file '/dev/stdout': open /dev/stdout: no such device or address

I want to see all lines since Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port....

Something like journalctl --boot, but from the last time service was started.

Is that possible?

Likewise, something like --list-boots that lists all the times systemctl has started or stopped the service would allow me to mimic journalctl --last-start -u svc behavior I wanted.

systemd journalctl

share|improve this question

edited Jul 25 '16 at 9:59

Rahul

9,81411 gold badge3232 silver badges4747 bronze badges

asked Jul 25 '16 at 9:56

Elazar LeibovichElazar Leibovich

1,33644 gold badges1717 silver badges2121 bronze badges

Jul 25 08:18:20 raspberrypi ngrok[3105]: Incorrect Usage: flag provided but not defined: -log

Jul 25 08:20:04 raspberrypi systemd[1]: ngrok@ssh.service holdoff time over, scheduling restart.

Jul 25 08:20:04 raspberrypi systemd[1]: Stopping Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port(s) with ngrok...

Jul 25 08:20:04 raspberrypi systemd[1]: Started Share local port(s) with ngrok.

Jul 25 08:20:04 raspberrypi ngrok[5474]: t=2016-07-25T08:20:04+0000 lvl=warn msg="failed to get home directory, using $HOME instead" err="user: Current not implemented on linux/arm" $HOME=

Jul 25 08:20:04 raspberrypi ngrok[5474]: Failed to open log file '/dev/stdout': open /dev/stdout: no such device or address

share|improve this question

edited Jul 25 '16 at 9:59

Rahul

9,81411 gold badge3232 silver badges4747 bronze badges

asked Jul 25 '16 at 9:56

Elazar LeibovichElazar Leibovich

1,33644 gold badges1717 silver badges2121 bronze badges

share|improve this question

edited Jul 25 '16 at 9:59

Rahul

9,81411 gold badge3232 silver badges4747 bronze badges

asked Jul 25 '16 at 9:56

Elazar LeibovichElazar Leibovich

1,33644 gold badges1717 silver badges2121 bronze badges

edited Jul 25 '16 at 9:59

Rahul

9,81411 gold badge3232 silver badges4747 bronze badges

edited Jul 25 '16 at 9:59

Rahul

9,81411 gold badge3232 silver badges4747 bronze badges

asked Jul 25 '16 at 9:56

Elazar LeibovichElazar Leibovich

1,33644 gold badges1717 silver badges2121 bronze badges

asked Jul 25 '16 at 9:56

Elazar LeibovichElazar Leibovich

1,33644 gold badges1717 silver badges2121 bronze badges

2 Answers
2

active

oldest

votes

0

Unfortunately this is not currently supported. See https://github.com/systemd/systemd/issues/1942

GitHub user towolf posted a script in that issue which gets pretty close:

#!/bin/bash

#



[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :



# Timestamp when unit transitioned from inactive to active

since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ')

# or one minute if unset

since=${since:-1 min ago}



# Get prefix string that this units logs with: most robust

# https://github.com/systemd/systemd/issues/2913#issuecomment-219702148

id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=')



# Get all raw output from unit since start, only from stdout&stderr

# Considering that backend only logs "bad" stack traces to stderr, this should

# always be relevant

service_trace=$(journalctl -o cat --since "$since" -t "$id")

share|improve this answer

answered Jul 12 at 16:39

KevinoidKevinoid

13144 bronze badges

add a comment | 

-1

The simplest way of getting the log from the last start of the service is not journalctl but systemctl status: eg

sudo systemctl status --no-pager -l -n 99999 svc

You can also give a starting time for journalctl, eg 1 hour back:

sudo journalctl --no-pager --since='-1h' -u svc

or from a specific time: --since='16:00'.

share|improve this answer

answered Jul 25 '16 at 14:48

meuhmeuh

33.9k11 gold badge2525 silver badges5959 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, one can do the very same thing with boot, but it's not as convenient as -b
  
  – Elazar Leibovich
  Jul 25 '16 at 18:42
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f298107%2fjournalctl-list-until-last-unit-start%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

0

Unfortunately this is not currently supported. See https://github.com/systemd/systemd/issues/1942

GitHub user towolf posted a script in that issue which gets pretty close:

#!/bin/bash

#



[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :



# Timestamp when unit transitioned from inactive to active

since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ')

# or one minute if unset

since=${since:-1 min ago}



# Get prefix string that this units logs with: most robust

# https://github.com/systemd/systemd/issues/2913#issuecomment-219702148

id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=')



# Get all raw output from unit since start, only from stdout&stderr

# Considering that backend only logs "bad" stack traces to stderr, this should

# always be relevant

service_trace=$(journalctl -o cat --since "$since" -t "$id")

share|improve this answer

answered Jul 12 at 16:39

KevinoidKevinoid

13144 bronze badges

add a comment | 

0

Unfortunately this is not currently supported. See https://github.com/systemd/systemd/issues/1942

GitHub user towolf posted a script in that issue which gets pretty close:

#!/bin/bash

#



[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :



# Timestamp when unit transitioned from inactive to active

since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ')

# or one minute if unset

since=${since:-1 min ago}



# Get prefix string that this units logs with: most robust

# https://github.com/systemd/systemd/issues/2913#issuecomment-219702148

id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=')



# Get all raw output from unit since start, only from stdout&stderr

# Considering that backend only logs "bad" stack traces to stderr, this should

# always be relevant

service_trace=$(journalctl -o cat --since "$since" -t "$id")

share|improve this answer

answered Jul 12 at 16:39

KevinoidKevinoid

13144 bronze badges

add a comment | 

Unfortunately this is not currently supported. See https://github.com/systemd/systemd/issues/1942

GitHub user towolf posted a script in that issue which gets pretty close:

#!/bin/bash

#



[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :



# Timestamp when unit transitioned from inactive to active

since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ')

# or one minute if unset

since=${since:-1 min ago}



# Get prefix string that this units logs with: most robust

# https://github.com/systemd/systemd/issues/2913#issuecomment-219702148

id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=')



# Get all raw output from unit since start, only from stdout&stderr

# Considering that backend only logs "bad" stack traces to stderr, this should

# always be relevant

service_trace=$(journalctl -o cat --since "$since" -t "$id")

share|improve this answer

answered Jul 12 at 16:39

KevinoidKevinoid

13144 bronze badges

#!/bin/bash

#



[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :



# Timestamp when unit transitioned from inactive to active

since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ')

# or one minute if unset

since=${since:-1 min ago}



# Get prefix string that this units logs with: most robust

# https://github.com/systemd/systemd/issues/2913#issuecomment-219702148

id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=')



# Get all raw output from unit since start, only from stdout&stderr

# Considering that backend only logs "bad" stack traces to stderr, this should

# always be relevant

service_trace=$(journalctl -o cat --since "$since" -t "$id")

share|improve this answer

answered Jul 12 at 16:39

KevinoidKevinoid

13144 bronze badges

answered Jul 12 at 16:39

KevinoidKevinoid

13144 bronze badges

answered Jul 12 at 16:39

KevinoidKevinoid

13144 bronze badges

-1

The simplest way of getting the log from the last start of the service is not journalctl but systemctl status: eg

sudo systemctl status --no-pager -l -n 99999 svc

You can also give a starting time for journalctl, eg 1 hour back:

sudo journalctl --no-pager --since='-1h' -u svc

or from a specific time: --since='16:00'.

share|improve this answer

answered Jul 25 '16 at 14:48

meuhmeuh

33.9k11 gold badge2525 silver badges5959 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, one can do the very same thing with boot, but it's not as convenient as -b
  
  – Elazar Leibovich
  Jul 25 '16 at 18:42
  

  
  
  
  

add a comment | 

-1

The simplest way of getting the log from the last start of the service is not journalctl but systemctl status: eg

sudo systemctl status --no-pager -l -n 99999 svc

You can also give a starting time for journalctl, eg 1 hour back:

sudo journalctl --no-pager --since='-1h' -u svc

or from a specific time: --since='16:00'.

share|improve this answer

answered Jul 25 '16 at 14:48

meuhmeuh

33.9k11 gold badge2525 silver badges5959 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, one can do the very same thing with boot, but it's not as convenient as -b
  
  – Elazar Leibovich
  Jul 25 '16 at 18:42
  

  
  
  
  

add a comment | 

The simplest way of getting the log from the last start of the service is not journalctl but systemctl status: eg

sudo systemctl status --no-pager -l -n 99999 svc

You can also give a starting time for journalctl, eg 1 hour back:

sudo journalctl --no-pager --since='-1h' -u svc

or from a specific time: --since='16:00'.

share|improve this answer

answered Jul 25 '16 at 14:48

meuhmeuh

33.9k11 gold badge2525 silver badges5959 bronze badges

sudo systemctl status --no-pager -l -n 99999 svc

sudo journalctl --no-pager --since='-1h' -u svc

share|improve this answer

answered Jul 25 '16 at 14:48

meuhmeuh

33.9k11 gold badge2525 silver badges5959 bronze badges

answered Jul 25 '16 at 14:48

meuhmeuh

33.9k11 gold badge2525 silver badges5959 bronze badges

answered Jul 25 '16 at 14:48

meuhmeuh

33.9k11 gold badge2525 silver badges5959 bronze badges