I have a inetd-style service deployed as a systemd socket unit and its accompanying service unit, say, my-service.socket with Accept=true and [email protected].

Each time a new connection is received, systemd spawns a service instance with a template name similar to this: [email protected]:9418-

I can look at all logs already generated by my-service with this command: journalctl -u 'my-service@*'. I would like to follow any newly-generated log in real time, but journalctl -fu 'my-service@*' doesn't work, as journalctls man-page explains:

If a pattern is specified, a list of unit names found in the journal is compared with the specified pattern and all that match are used.

Therefore, journalctl will only follow instances that are already running, but not any instances started after.

Is there a way to follow all logging output from all instances of [email protected], even those starting after I start following the logs?

2 Answers 2


You could try:

watch journalctl -eu 'my-service@*'
  • If you need different updates as "every 2s" you can use the -n option of watch.
  • The e option will always make the last entries visible for this usage, see man journalctl:

    -e, --pager-end
    Immediately jump to the end of the journal inside the implied pager tool.
    This implies -n1000 to guarantee that the pager will not buffer logs of unbounded size.
    This may be overridden with an explicit -n with some other numeric value, while -nall will disable this cap.
    Note that this option is only supported for the less(1) pager.

Another possibility should be possible to select the slice of the units if they use a separate common-slice for all of them.

-u, --unit=UNIT|PATTERN
A match is also added for "_SYSTEMD_SLICE=UNIT", such that if the provided UNIT is a systemd.slice(5) unit, all logs of children of the slice will be shown.


I had same challenge but right after reading your question, I figured out the answer:

# journalctl -f -u my-service@\*.service

Thanks for your question, I got answer also for myself =)

  • systemctl -f --force When enabling unit files, override existing symlinks When shutting down, execute action immediately
    – Shōgun8
    Aug 7, 2023 at 21:27
  • 1
    I would speculate that it was meant to be "journalctl" instead of "systemctl". However, this makes the answer the same command as the one in the question, except the question uses single quotes and the answer uses backslash escaping the asterisk. It would have the same problems as well. Aug 8, 2023 at 3:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .