Logging & Journald

Stop chasing ghosts in journald by isolating specific boot logs

🧩 The Challenge

Dealing with a server that panicked three reboots ago is a nightmare because journald just dumps everything into one giant, unsearchable mess by default. I’ve wasted half a day scrolling through thousands of lines of unrelated noise looking for that one kernel oops from yesterday.

💡 The Fix

You can tell journald to only show you logs from a specific boot session rather than the entire history of the machine. It makes debugging intermittent hardware failures so much less painful.

journalctl -b -1

⚙️ Why It Works

The -b flag tells the journal to filter by boot ID, and passing a negative integer like -1 grabs the logs from the previous session, -2 the one before that, and so on.

🚀 Pro-Tip: Use journalctl –list-boots to see a timestamped menu of every boot session stored on disk so you don’t have to guess the offset.

Linux Tips & Tricks | © ngelinux.com | 8/17/2026