Going to the End of the File in journalctl

1. Introduction

Linux systems often use systemd to initialize and manage import system processes in the background. Further, we can run our applications as systemd processes, too. To check the logs of these systemd processes, we use a tool called journalctl.

When we open up the log of a process using this tool, we see the log file with the first few lines in the current view. However, when we refer to logs, most often the relevant information is the most recent and is at the bottom. To see the latest logs, by default, we have to move all the way down using the arrow key.

In this tutorial, let’s look at how to open journalctl with the end of the file shown first.

2. Basic Setup

The journalctl tool comes bundled with systemd, and no additional installation is needed. So, we can proceed directly to running it. First, let’s see how it works by default:

$ sudo journalctl -u haccfoo.service

The above command opens up a paged reader, with the first few log lines for the service we specified with the -u option, haccfoo.service:

Jun 29 21:39:45 localhost haccfoo[1636392]: 2024/06/29 21:39:45 http: panic servi>
Jun 29 21:39:45 localhost haccfoo[1636392]: goroutine 290001 [running]:
Jun 29 21:39:45 localhost haccfoo[1636392]: net/http.(*conn).serve.func1()
Jun 29 21:39:45 localhost haccfoo[1636392]:         /usr/local/go/src/net/http/se>
Jun 29 21:39:45 localhost haccfoo[1636392]: panic({0x7848c0?, 0xc000194660?})
Jun 29 21:39:45 localhost haccfoo[1636392]:         /usr/local/go/src/runtime/pan>
Jun 29 21:39:45 localhost haccfoo[1636392]: main.getItemsData({0xc0001c5000, 0x5,>
Jun 29 21:39:45 localhost haccfoo[1636392]:         /home/kd/hacc.foo/main.go:60 >
Jun 29 21:39:45 localhost haccfoo[1636392]: main.getItemsList({0xc00040a1cd?, 0x7>
Jun 29 21:39:45 localhost haccfoo[1636392]:         /home/kd/hacc.foo/main.go:126>
Jun 29 21:39:45 localhost haccfoo[1636392]: main.handler({0x87b208?, 0xc0001c8460>
Jun 29 21:39:45 localhost haccfoo[1636392]:         /home/kd/hacc.foo/main.go:147>
Jun 29 21:39:45 localhost haccfoo[1636392]: net/http.HandlerFunc.ServeHTTP(0x443e>
Jun 29 21:39:45 localhost haccfoo[1636392]:         /usr/local/go/src/net/http/se>
lines 1-14

From the above output, we see that the logs are from June 29th, and lines 1-14 are shown. This output is simply the lines in the log file at the time we ran the command. To follow the logs, we can append the -f flag:

$ sudo journalctl -u haccfoo.service -f

The above command will show new log lines as they appear.

3. Going to the End of the File

If we know beforehand that we’d like to see the log file from the end, we can simply run the journalctl command with an additional parameter -e to open the log file at the end:

$ sudo journalctl -u haccfoo.service -e

The additional parameter -e is short for –pager-end and it instructs the command to open the log file with the pager scrolled to the end. Let’s look at the output we see in this case:

Sep 17 12:41:53 localhost haccfoo[1636392]: main.getItemsList({0xc00040a22d?, 0x7>
Sep 17 12:41:53 localhost haccfoo[1636392]:         /home/kd/hacc.foo/main.go:126>
Sep 17 12:41:53 localhost haccfoo[1636392]: main.handler({0x87b208?, 0xc0001c8460>
Sep 17 12:41:53 localhost haccfoo[1636392]:         /home/kd/hacc.foo/main.go:147>
Sep 17 12:41:53 localhost haccfoo[1636392]: net/http.HandlerFunc.ServeHTTP(0x443e>
Sep 17 12:41:53 localhost haccfoo[1636392]:         /usr/local/go/src/net/http/se>
Sep 17 12:41:53 localhost haccfoo[1636392]: net/http.(*ServeMux).ServeHTTP(0xb06d>
Sep 17 12:41:53 localhost haccfoo[1636392]:         /usr/local/go/src/net/http/se>
Sep 17 12:41:53 localhost haccfoo[1636392]: net/http.serverHandler.ServeHTTP({0xc>
Sep 17 12:41:53 localhost haccfoo[1636392]:         /usr/local/go/src/net/http/se>
Sep 17 12:41:53 localhost haccfoo[1636392]: net/http.(*conn).serve(0xc0000166c0, >
Sep 17 12:41:53 localhost haccfoo[1636392]:         /usr/local/go/src/net/http/se>
Sep 17 12:41:53 localhost haccfoo[1636392]: created by net/http.(*Server).Serve i>
Sep 17 12:41:53 localhost haccfoo[1636392]:         /usr/local/go/src/net/http/se>
lines 312-325/325 (END)

We see the most recent logs (September 17th) in the above output. The last line also mentions that it’s the end of the file. The journalctl command, by default, shows only 1,000 lines. If we need to see more than 1,000 lines, we can specify a number using the -n parameter:

$ sudo journalctl -u haccfoo.service -n 10000 -e

The above example will show us the last 10,000 lines from the end.

4. Conclusion

In this article, we looked at how to view logs from the end while using journalctl. Instead of opening it up with the default options and scrolling all the way down, we can simply append the -e flag to the command to have it open at the end of the file.