86

I'm looking for a way, to simply print the last X lines from a systemctl service in Debian. I would like to install this code into a script, which uses the printed and latest log entries. I've found this post but I wasn't able to modify it for my purposes.

Currently I'm using this code, which is just giving me a small snippet of the log files:

journalctl --unit=my.service --since "1 hour ago" -p err

To give an example of what the result should look like, simply type in the command above for any service and scroll until the end of the log. Then copy the last 300 lines starting from the bottom.

My idea is to use egrep ex. egrep -m 700 . but I had no luck since now.

0

5 Answers 5

153
journalctl --unit=my.service -n 100 --no-pager
0
32

If you want to see the last n number of lines and see new messages as they are printed to the log, try this:

journalctl -u <service name> -n <number of lines> -f

Where -n indicates the number of lines you'd like to see from the tail of the log, and -f specifies that you'd like to follow the log as it changes.

19

Just:

journalctl -u SERVICE_NAME -e

Parameter -e stands for:

-e --pagerend; Immediately jump to the end of the journal inside the implied pager tool. This implies -n 1000 to guarantee that the pager will not buffer logs of unbounded size. This may be overridden with an explicit -n with some other numeric value, while -nall will disable this cap.

2
  • 1
    That's the one ! Other answers will go through the whole log to get to its end, which can be veeeeery long for large syslogs. Oct 21, 2020 at 9:23
  • Note -e is an alias for --pager-end (for people like me that have trouble remembering abbreviations) Jun 15, 2021 at 15:34
14

You could pipe the output to tail:

journalctl --unit=my.service | tail -n 300

The tail command prints the last lines (10 by default) received in stdin to stdout.

Edit: as noted in the comments, this is inefficient for very large logs.

4
  • 2
    Totally forgot about tail - great idea, thank you very much! Feb 6, 2018 at 8:37
  • 19
    Tail can be painfully slow for large logs. The built-in -n of journalctrl is what you want. e.g. journalctl -n 300
    – Drakes
    Jan 24, 2019 at 0:41
  • 11
    A singularly bad idea. Why would you pipe 30 terabytes of data into tail to show the last 10 records? Apr 28, 2020 at 22:54
  • 2
    This is an especially bad answer. Don't do this!
    – gd1
    Apr 10, 2021 at 17:36
1

since tail command solution aleady provided.I tried by using sed commmand and its worked fine

Below command will display last 300 lines

journalctl --unit=my.service | sed -e :a -e '$q;N;301,$D;ba' 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.