journalctl command to see kernel messages

Sometimes, there are just too many messages in journalctl output and it becomes a mystery game to search for the messages you are looking for. But luckily you do not need to use grep to find the right message. Here is example of what I had to do when I was looking for kernel messages.

journalctl _TRANSPORT=kernel
# To see all the fields, you can use the verbose mode
journalctl _TRANSPORT=kernel -o verbose

# And the filter on priority if needed to get the messages you need
journalctl _TRANSPORT=kernel PRIORITY=4

# and follow
journalctl _TRANSPORT=kernel PRIORITY=4 -f -l

speed up journalctl

Sometime back I noticed that whenever I run my favourite command, viz.

journalctl -xn -f -l

it was taking more time than usual. So, I thought to dig more into it and finally found that the following command:

sudo journalctl --disk-usage

showed that journalctl was using some huge space in tune of about 4GB. So, the solution was simple, vaccum the journal entries and the command to do so is :

sudo journalctl --vacuum-size 90M

Checking journalctl size after that confirms the size is reduced and after that indeed the above journal command takes no time 🙂