10

A common task one wishes to do, when debugging a service that fails to load, is to look at all log from the last time the service was started.

For example, given

Jul 25 08:18:20 raspberrypi ngrok[3105]: Incorrect Usage: flag provided but not defined: -log Jul 25 08:20:04 raspberrypi systemd[1]: [email protected] holdoff time over, scheduling restart. Jul 25 08:20:04 raspberrypi systemd[1]: Stopping Share local port(s) with ngrok... Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port(s) with ngrok... Jul 25 08:20:04 raspberrypi systemd[1]: Started Share local port(s) with ngrok. Jul 25 08:20:04 raspberrypi ngrok[5474]: t=2016-07-25T08:20:04+0000 lvl=warn msg="failed to get home directory, using $HOME instead" err="user: Current not implemented on linux/arm" $HOME= Jul 25 08:20:04 raspberrypi ngrok[5474]: Failed to open log file '/dev/stdout': open /dev/stdout: no such device or address

I want to see all lines since Jul 25 08:20:04 raspberrypi systemd[1]: Starting Share local port....

Something like journalctl --boot, but from the last time service was started.

Is that possible?

Likewise, something like --list-boots that lists all the times systemctl has started or stopped the service would allow me to mimic journalctl --last-start -u svc behavior I wanted.

Improve this question

3 Answers 3

Reset to default
2

Following this answer, since systemd 232 you can use systemd's INVOCATION_ID, which is an ID for the specific run of a service. This is what I use :

function last_log() { if [ $# == 1 ] then echo -e "\nSyntax: $0 SERVICE_NAME" exit 1 fi ID=$(systemctl show -p InvocationID --value $1) journalctl INVOCATION_ID=$ID + _SYSTEMD_INVOCATION_ID=$ID }

Note that providing an invalid service name would lead to inconsistent behaviour, and you loose the benefit of command-line completion.

Improve this answer
1

Unfortunately this is not currently supported. See https://github.com/systemd/systemd/issues/1942

GitHub user towolf posted a script in that issue which gets pretty close:

#!/bin/bash # [ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || : # Timestamp when unit transitioned from inactive to active since=$(systemctl show -p InactiveExitTimestamp "$1" | cut -f 2 -d '=' | cut -f 2-3 -d' ') # or one minute if unset since=${since:-1 min ago} # Get prefix string that this units logs with: most robust # https://github.com/systemd/systemd/issues/2913#issuecomment-219702148 id=$(systemctl show -p SyslogIdentifier "$1" | cut -f 2 -d '=') # Get all raw output from unit since start, only from stdout&stderr # Considering that backend only logs "bad" stack traces to stderr, this should # always be relevant service_trace=$(journalctl -o cat --since "$since" -t "$id")
Improve this answer
1
  • I'm afraid you were wrong - see my answer using systemd 232 (published in November 2016). Commented Nov 13, 2023 at 12:38
-1

The simplest way of getting the log from the last start of the service is not journalctl but systemctl status: eg

sudo systemctl status --no-pager -l -n 99999 svc

You can also give a starting time for journalctl, eg 1 hour back:

sudo journalctl --no-pager --since='-1h' -u svc

or from a specific time: --since='16:00'.

Improve this answer
1
  • Yes, one can do the very same thing with boot, but it's not as convenient as -b Commented Jul 25, 2016 at 18:42

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.