Logging & Journald

Know What Your Server Did Last Boot

🧩 The Challenge

You know the drill. That server just rebooted on you after some nasty error, or maybe a power blip. You log in, `journalctl -f` shows clean logs, and you’re left guessing what actually happened *before* the system came back up. It’s like trying to solve a crime scene after someone’s already tidied up.

💡 The Fix

Good news, journald remembers. You can easily list out every recorded boot and then jump straight to the logs from any of them. It’s incredibly handy for figuring out what crashed your box or what went sideways with that last update.

# Show all recorded boot sessions with their index, ID, and timestamps:
journalctl --list-boots

# Then, view logs from a specific boot index (e.g., -1 for the previous boot, -2 for the one before that):
journalctl -b -1

# Or, if you prefer the full boot ID you got from --list-boots:
journalctl -b <boot_id_string>

⚙️ Why It Works

The systemd journal, by default if configured for persistence, tags all log entries with the current boot’s unique ID. This lets you seamlessly filter logs across reboots, instead of just the active session. It’s a huge step up from checking `/var/log/messages` after a crash.

🚀 Pro-Tip: Use `journalctl -b -1 -p err` to quickly see just the errors from the previous boot.

Linux Tips & Tricks | © ngelinux.com | 10/21/2026