journalctl list until last unit start

Question

A common task one wishes to do, when debugging a service that fails to load, is to look at all log from the last time the service was started.

For example, given

Jul 25 08:18:20 raspberrypi ngrok[3105]: Incorrect Usage: flag provided but not defined: -log
Jul 25 08:20:04 raspberrypi systemd[1]: ngrok@ssh.service holdoff time over, scheduling restart.
Jul 25 08:20:04 raspberrypi systemd[1]: Stopping Share local port(s) with ngrok...
Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port(s) with ngrok...
Jul 25 08:20:04 raspberrypi systemd[1]: Started Share local port(s) with ngrok.
Jul 25 08:20:04 raspberrypi ngrok[5474]: t=2016-07-25T08:20:04+0000 lvl=warn msg="failed to get home directory, using $HOME instead" err="user: Current not implemented on linux/arm" $HOME=
Jul 25 08:20:04 raspberrypi ngrok[5474]: Failed to open log file '/dev/stdout': open /dev/stdout: no such device or address

I want to see all lines since Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port....

Something like journalctl --boot, but from the last time service was started.

Is that possible?

Likewise, something like --list-boots that lists all the times systemctl has started or stopped the service would allow me to mimic journalctl --last-start -u svc behavior I wanted.

Answer 1

Unfortunately this is not currently supported. See https://github.com/systemd/systemd/issues/1942

GitHub user towolf posted a script in that issue which gets pretty close:

#!/bin/bash
#

[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :

# Timestamp when unit transitioned from inactive to active
since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ')
# or one minute if unset
since=${since:-1 min ago}

# Get prefix string that this units logs with: most robust
# https://github.com/systemd/systemd/issues/2913#issuecomment-219702148
id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=')

# Get all raw output from unit since start, only from stdout&stderr
# Considering that backend only logs "bad" stack traces to stderr, this should
# always be relevant
service_trace=$(journalctl -o cat --since "$since" -t "$id")

Answer 2

The simplest way of getting the log from the last start of the service is not journalctl but systemctl status: eg

sudo systemctl status --no-pager -l -n 99999 svc

You can also give a starting time for journalctl, eg 1 hour back:

sudo journalctl --no-pager --since='-1h' -u svc

or from a specific time: --since='16:00'.