Logging & Journald

Filter your logs by kernel boot ID to find the truth

🧩 The Challenge

Trying to hunt down why a server randomly crashed last week is a nightmare when the journal is flooded with entries from the current session. You end up scrolling through thousands of lines trying to figure out where the previous boot ended and the crash began.

💡 The Fix

You can use the boot ID filter to isolate logs to a single specific run of the system, which keeps you from chasing ghosts from yesterday’s sessions. It saves you from having to guess timestamps and squint at gaps in the log flow.

journalctl -b $(journalctl --list-boots | tail -n 2 | head -n 1 | awk '{print $1}')

⚙️ Why It Works

Passing the boot ID to the -b flag tells the system to treat that specific kernel lifecycle as your entire world. By grabbing the second-to-last entry from the list, you are essentially telling the tool to show you the session that crashed before the reboot.

🚀 Pro-Tip: Run journalctl –list-boots first to see the offset numbers if you need to go back further than just the last crash.

Linux Tips & Tricks | © ngelinux.com | 7/15/2026