I was triaging an issue on my Fedora 41 (the RHEL 9 upstream), and had to watch for entries in “journalctl”. Tailing the output wasn’t helpful – the default tail output was starting well before the “current time”. By the time I clicked the appropriate buttons in the GUI, the output was unusable.
I ended up using the “–since=XXX” with the “date” command like this:# journalctl --since="$(date +"%Y-%m-%d %H:%M:%S")" --no-tail --follow
Breakdown:
$(date +"%Y-%m-%d %H:%M:%S"): The current date/time (can also be ‘yesterday’ or other parsable date strings). Handy to run in one window, then kick off the failing command in another.--since="XXX": With the date command, limit to only new events.--no-tail: Show all stored output lines, even in follow mode. (This will follow the live log entries)--follow: Follow the live log entries.
The “journalctl” command has been available in many Linux distributions for years but it’s novelty has left many greybeards such as myself occasionally challenged using it.