53

I'm looking for a way, to simply print the last X lines from a systemctl service in Debian. I would like to install this code into a script, which uses the printed and latest log entries. I've found this post but I wasn't able to modify it for my purposes.

Currently I'm using this code, which is just giving me a small snippet of the log files:

journalctl --unit=my.service --since "1 hour ago" -p err

To give an example of what the result should look like, simply type in the command above for any service and scroll until the end of the log. Then copy the last 300 lines starting from the bottom.

My idea is to use egrep ex. egrep -m 700 . but I had no luck since now.

0
111
journalctl --unit=my.service -n 100 --no-pager
0
15

Just pipe the output to tail:

journalctl --unit=my.service | tail -n 300

The tail command prints the last lines (10 by default) received in stdin to stdout.

4
  • 2
    Totally forgot about tail - great idea, thank you very much! – user3191334 Feb 6 '18 at 8:37
  • 16
    Tail can be painfully slow for large logs. The built-in -n of journalctrl is what you want. e.g. journalctl -n 300 – Drakes Jan 24 '19 at 0:41
  • 9
    A singularly bad idea. Why would you pipe 30 terabytes of data into tail to show the last 10 records? – Rick O'Shea Apr 28 '20 at 22:54
  • This is an especially bad answer. Don't do this! – gd1 Apr 10 at 17:36
13

If you want to see the last n number of lines and see new messages as they are printed to the log, try this:

journalctl -u <service name> -n <number of lines> -f

Where -n indicates the number of lines you'd like to see from the tail of the log, and -f specifies that you'd like to follow the log as it changes.

10

Just:

journalctl -u SERVICE_NAME -e

Parameter -e stands for:

-e --pagerend; Immediately jump to the end of the journal inside the implied pager tool. This implies -n 1000 to guarantee that the pager will not buffer logs of unbounded size. This may be overridden with an explicit -n with some other numeric value, while -nall will disable this cap.

1
  • That's the one ! Other answers will go through the whole log to get to its end, which can be veeeeery long for large syslogs. – Léo Germond Oct 21 '20 at 9:23
1

since tail command solution aleady provided.I tried by using sed commmand and its worked fine

Below command will display last 300 lines

journalctl --unit=my.service | sed -e :a -e '$q;N;301,$D;ba' 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.