18.7 journalctl: Filtering, Following, and Exporting Logs
Alright, let’s talk about journalctl. If systemd is the hyperactive, over-caffeinated stage manager of your system, then journalctl is the stagehand who’s been keeping a meticulous, slightly obsessive diary of everything that’s ever happened. It’s the single command to rule all your system logs, and it’s both brilliant and, at times, infuriatingly clever. The first thing you’ll probably type is journalctl by itself. Don’t. It will vomit the entire contents of the system journal onto your screen, starting from the dawn of time (or at least the last log rotation). You’ll be paging through boot messages from three weeks ago before you know what hit you. It’s the log equivalent of drinking from a firehose.