Logging & Journald

Get actual log timestamps instead of guessing when things happened

🧩 The Challenge

Dealing with journalctl output that just shows relative timestamps like 5 minutes ago makes my head spin when I am trying to correlate events across multiple servers. You end up wasting so much time manually calculating the wall-clock time while the production environment is actively burning.

💡 The Fix

Flip the switch to see standard absolute timestamps so you can actually match events to your other logs or external monitoring alerts. It makes digging through historical data a whole lot less painful.

journalctl --utc -o short-iso

⚙️ Why It Works

Adding the UTC flag and the short-iso output format forces the system to dump logs in a readable, standard time format instead of that vague relative jargon. This way, the data lines up perfectly with what you see in your SQL logs or cloud-provider metrics.

🚀 Pro-Tip: Use –since “10:00:00” if you want to skip the noise and dive right into the specific window where the incident started.

Linux Tips & Tricks | © ngelinux.com | 9/7/2026