111

I'm looking for a way, to simply print the last X lines from a systemctl service in Debian. I would like to install this code into a script, which uses the printed and latest log entries. I've found this post but I wasn't able to modify it for my purposes.

Currently I'm using this code, which is just giving me a small snippet of the log files:

journalctl --unit=my.service --since "1 hour ago" -p err

To give an example of what the result should look like, simply type in the command above for any service and scroll until the end of the log. Then copy the last 300 lines starting from the bottom.

My idea is to use egrep ex. egrep -m 700 . but I had no luck since now.

Improve this question
0

5 Answers 5

Reset to default
191 
journalctl --unit=my.service -n 100 --no-pager
Improve this answer
2
  • "-n 100" means 100 lines ~for starters
    – Jacobski
    Jun 24, 2022 at 0:11
  • add -q to suppress any hints by journalctl
    – Tiana987642
    Jul 29, 2022 at 9:50
41

If you want to see the last n number of lines and see new messages as they are printed to the log, try this:

journalctl -u <service name> -n <number of lines> -f

Where -n indicates the number of lines you'd like to see from the tail of the log, and -f specifies that you'd like to follow the log as it changes.

Improve this answer
31

Just:

journalctl -u SERVICE_NAME -e

Parameter -e stands for:

-e --pagerend; Immediately jump to the end of the journal inside the implied pager tool. This implies -n 1000 to guarantee that the pager will not buffer logs of unbounded size. This may be overridden with an explicit -n with some other numeric value, while -nall will disable this cap.

Improve this answer
2
  • 2
    That's the one ! Other answers will go through the whole log to get to its end, which can be veeeeery long for large syslogs.
    – Léo Germond
    Oct 21, 2020 at 9:23
  • Note -e is an alias for --pager-end (for people like me that have trouble remembering abbreviations)
    – Jeroen Wiert Pluimers
    Jun 15, 2021 at 15:34
16

You could pipe the output to tail:

journalctl --unit=my.service | tail -n 300

The tail command prints the last lines (10 by default) received in stdin to stdout.

Edit: as noted in the comments, this is inefficient for very large logs.

Improve this answer
4
  • 2
    Totally forgot about tail - great idea, thank you very much!
    – user3191334
    Feb 6, 2018 at 8:37
  • 19
    Tail can be painfully slow for large logs. The built-in -n of journalctrl is what you want. e.g. journalctl -n 300
    – Drakes
    Jan 24, 2019 at 0:41
  • 11
    A singularly bad idea. Why would you pipe 30 terabytes of data into tail to show the last 10 records?
    – Rick O'Shea
    Apr 28, 2020 at 22:54
  • 2
    This is an especially bad answer. Don't do this!
    – gd1
    Apr 10, 2021 at 17:36
0

since tail command solution aleady provided.I tried by using sed commmand and its worked fine

Below command will display last 300 lines

journalctl --unit=my.service | sed -e :a -e '$q;N;301,$D;ba'
Improve this answer
1
  • That’s an interesting answer because: it shows what you can do with "sed", but it’s unhelpful for this question because: it’s extraordinarily less efficient than asking "journalctl" for the last ‘n’ lines directly. And it’s more verbose than using "tail". And the "sed" command is left unexplained—and without explanation, it is incomprehensible! But you’ve reminded me that I really should read up on "sed" some time!
    – andrewf
    yesterday

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .