5

A common task one wishes to do, when debugging a service that fails to load, is to look at all log from the last time the service was started.

For example, given

Jul 25 08:18:20 raspberrypi ngrok[3105]: Incorrect Usage: flag provided but not defined: -log
Jul 25 08:20:04 raspberrypi systemd[1]: ngrok@ssh.service holdoff time over, scheduling restart.
Jul 25 08:20:04 raspberrypi systemd[1]: Stopping Share local port(s) with ngrok...
Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port(s) with ngrok...
Jul 25 08:20:04 raspberrypi systemd[1]: Started Share local port(s) with ngrok.
Jul 25 08:20:04 raspberrypi ngrok[5474]: t=2016-07-25T08:20:04+0000 lvl=warn msg="failed to get home directory, using $HOME instead" err="user: Current not implemented on linux/arm" $HOME=
Jul 25 08:20:04 raspberrypi ngrok[5474]: Failed to open log file '/dev/stdout': open /dev/stdout: no such device or address

I want to see all lines since Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port....

Something like journalctl --boot, but from the last time service was started.

Is that possible?

Likewise, something like --list-boots that lists all the times systemctl has started or stopped the service would allow me to mimic journalctl --last-start -u svc behavior I wanted.

0

Unfortunately this is not currently supported. See https://github.com/systemd/systemd/issues/1942

GitHub user towolf posted a script in that issue which gets pretty close:

#!/bin/bash
#

[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :

# Timestamp when unit transitioned from inactive to active
since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ')
# or one minute if unset
since=${since:-1 min ago}

# Get prefix string that this units logs with: most robust
# https://github.com/systemd/systemd/issues/2913#issuecomment-219702148
id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=')

# Get all raw output from unit since start, only from stdout&stderr
# Considering that backend only logs "bad" stack traces to stderr, this should
# always be relevant
service_trace=$(journalctl -o cat --since "$since" -t "$id")
-1

The simplest way of getting the log from the last start of the service is not journalctl but systemctl status: eg

sudo systemctl status --no-pager -l -n 99999 svc

You can also give a starting time for journalctl, eg 1 hour back:

sudo journalctl --no-pager --since='-1h' -u svc

or from a specific time: --since='16:00'.

  • Yes, one can do the very same thing with boot, but it's not as convenient as -b – Elazar Leibovich Jul 25 '16 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.