Over a week a service piles up hundreds of records. Time and the boot number leave the part you need.
-b, familiar from the diagnosis lesson, keeps the records of the machine's current boot, -b -1 those of the previous one. The training machine has booted once, and -b -1 prints No journal boot entry found from the specified boot offset (-1).
--since and --until set time limits: --since "2026-10-18 17:43:37", --since today, --since -5min. -n 20, as before, keeps the last 20 records. -o short-iso prints the full time, with the date and time zone — such a selection is easier to compare with someone else's.
A selection is saved to a file with redirection: sudo journalctl -u lab-demo.service --no-pager > ~/demo.log. sudo applies to journalctl, while your shell opens the file, so the file belongs to you.
The service has two runs: at 17:43:36 and at 17:43:38. What will this command show?
$ sudo journalctl -u lab-demo.service --since "2026-10-18 17:43:37"-
--sincemeans "starting from": records from the mark onwards. The first run came before it. -
--sincecuts off everything before the mark: the run at 17:43:36 falls short of it.
--since keeps records from the given moment onwards, so the selection holds just the 17:43:38 run. --until limits a selection from above.
Key points
-
-bis the current boot,--sinceand--untilset time limits,-nkeeps the last records. -
-o short-isoprints the time with the date and time zone. -
With
sudo journalctl … > fileyour shell creates the file, and it belongs to you.