Journalctl

Check Logs from Previous Boot With Journalctl

Learn to analyze logs from specific boot entries. This helps you focus on the issues you encountered either at boot time or in a specific boot session.

Aug 26, 2025 · By Abhishek Prakash · 6 min read

Need to troubleshoot boot issues with Linux or check what happened during your last system startup? Linux keeps detailed records of every boot process, and knowing how to access them can save you hours of debugging time.

If your Linux system uses systemd, you can use the journalctl command to filter the logs to only show entries since the last boot (current boot):

journalctl -b

You can widen your search by including logs from previous boots:

journalctl -b -1    # Last boot
journalctl -b -2    # Two boots ago

💡

Mind the -. It is important. To show the logs from previous boot, you should use -b -1. If you used -b 1 or tried to shorten it to -b1, it will show the oldest available log entries. How? I discuss it later in this article.

Another thing to note is that it shows all the logs since the previous boot or from the boot of your choice. It does NOT show only the boot logs. Read the tutorial to know more.

List all available boot sessions

Journald logs are automatically categorized into boots. You can list all available boot sessions:

journalctl --list-boots

If your journal logs are not cleared periodically, you may have a huge number of entries:

abhishek@fedora:~$ journalctl --list-boots 
IDX BOOT ID                          FIRST ENTRY                 LAST ENTRY                 
-27 bd0f37aef0124f0d86241d0eb50d662c Sat 2025-08-02 11:00:04 IST Sat 2025-08-02 11:25:34 IST
-26 22253d042d4744189e54bc2b2b77a1e8 Sat 2025-08-02 16:56:02 IST Sat 2025-08-02 12:34:57 IST
-25 3a69d4a3214d468a87f4a970e0517ece Sat 2025-08-02 21:56:58 IST Sat 2025-08-02 21:02:38 IST
-24 57b0a704069e43abacff6d2d07ac139e Sun 2025-08-03 15:48:54 IST Mon 2025-08-04 19:59:17 IST
-23 6e1cc5f2f4dd4b078e5e9d411a1fabcf Tue 2025-08-05 14:00:24 IST Tue 2025-08-05 20:54:14 IST
-22 03f9a0122be946ecb7b6380df05a8f65 Wed 2025-08-06 02:24:25 IST Tue 2025-08-05 20:54:39 IST
-21 7ccc21453f274e03ad3f81f9d675acc2 Wed 2025-08-06 13:21:40 IST Thu 2025-08-07 07:44:58 IST
-20 424f9cc39e5849c2a135fccc3894502b Thu 2025-08-07 13:15:27 IST Thu 2025-08-07 21:00:16 IST
-19 8b27ff506a914c9abe0029e9f853dcea Fri 2025-08-08 02:30:29 IST Thu 2025-08-07 21:01:16 IST
-18 890c072132b34e15b5729e4a09bf5518 Sat 2025-08-09 12:46:58 IST Wed 2025-08-13 08:20:17 IST
-17 7738ee2a779a4d49920f17cc0578b3a9 Wed 2025-08-13 13:59:28 IST Thu 2025-08-14 22:51:46 IST
-16 b62483a27dc142e894decb2cfa3f72df Fri 2025-08-15 04:21:59 IST Thu 2025-08-14 22:52:15 IST
-15 62b8b0fc5deb4881973c1fe41a31aead Fri 2025-08-15 13:00:51 IST Fri 2025-08-15 21:56:37 IST
-14 e5ba68c84d964ddb8964f6baac530236 Sat 2025-08-16 03:26:50 IST Fri 2025-08-15 21:57:07 IST
-13 73fb7955afd74d7a91f9c0d70f9b96e0 Sat 2025-08-16 13:40:38 IST Sat 2025-08-16 08:12:16 IST
-12 c293bc7e40b64ce3be55a146a0a45486 Sat 2025-08-16 13:42:27 IST Sat 2025-08-16 22:49:31 IST
-11 3f598542369243bcb8e751c49f715839 Sun 2025-08-17 12:51:43 IST Mon 2025-08-18 07:51:35 IST
-10 5fac9ae8cbb44a5ca90f258a60c036ad Mon 2025-08-18 13:21:58 IST Tue 2025-08-19 04:04:00 IST
 -9 216b2e7b71194087892efcceaef4ac40 Tue 2025-08-19 14:58:31 IST Tue 2025-08-19 21:34:03 IST
 -8 0e111369d2c044b08386d45b26da2dc4 Wed 2025-08-20 13:05:32 IST Thu 2025-08-21 07:14:59 IST
 -7 2ec4b0206ae64f4ba0812a5c4baa4a5e Thu 2025-08-21 12:45:13 IST Thu 2025-08-21 22:19:02 IST
 -6 97454d3a65a04f518247b970b5451a6a Fri 2025-08-22 03:49:16 IST Fri 2025-08-22 08:26:36 IST
 -5 e456fff3f8244e96aa97f7208eebc9de Fri 2025-08-22 13:57:48 IST Fri 2025-08-22 23:17:52 IST
 -4 216eed49441b42a692a93f400e602b47 Sat 2025-08-23 13:57:19 IST Sun 2025-08-24 00:29:19 IST
 -3 82bce811b46d438aa66a27c46038d539 Sun 2025-08-24 13:47:44 IST Sun 2025-08-24 17:51:44 IST
 -2 8f6d6d1f00a14f8fb1688019f6771c13 Mon 2025-08-25 00:39:24 IST Sun 2025-08-24 21:25:20 IST
 -1 c967313d8c33423d8c44b0a3ec8b64fb Mon 2025-08-25 14:04:57 IST Tue 2025-08-26 08:40:32 IST
  0 4eed4f352f33469fa16f81949e2e796d Tue 2025-08-26 14:19:35 IST Tue 2025-08-26 12:14:26 IST

I shared the entries from my desktop Linux and hence it has so many entries. My servers don't reboot as frequently.

Now, you could get the logs from a specific boot entry by specifying its boot ID.

journalctl -b 216eed49441b42a692a93f400e602b47

But that's the long road and that's why it is easier to just use -1, -2 etc.

- matters while using journalctl -b

Now, remember I talked about the importance of using - while viewing the logs from specific boot?

journalctl -b -1 will represent the second last entry, the one with boot ID c967313d8c33423d8c44b0a3ec8b64fb.
But journalctl -b 1 or journalctl -b1 will give you the first entry in chronological order in the boot listing, which will be boot entry -27 with boot ID bd0f37aef0124f0d86241d0eb50d662c in our example here.

💡

Remember, negative numbers count backwards from the current boot (0), so -1 is the previous boot, -2 is two boots ago, etc.

Understanding the log output

Boot logs can be overwhelming at first glance. Now, there is no magic way to read them and find out the issue.

Still, let me share a few suggestions that will guide you through with a little better understanding of what these logs mean.

Here's a sample log:

Aug 26 09:45:22 hostname kernel: [    0.000000] Linux version 6.5.0-generic
Aug 26 09:45:22 hostname kernel: [    0.000000] Command line: BOOT_IMAGE=/vmlinuz
Aug 26 09:45:22 hostname systemd[1]: Starting network.service...
Aug 26 09:45:23 hostname NetworkManager[856]: <info> NetworkManager starting...

Here's the breakdown:

Timestamp: Aug 26 09:45:22
Hostname: Your system's name
Process: kernel, systemd[1], NetworkManager[856]
Log Level: <info>, <warn>, <error>
Message: The actual log content

At this point, it would be better if you started filtering logs for things of interest.

Filtering the logs from noise

Find the errors and warnings in current boot:

journalctl -b -p err    # Errors only
journalctl -b -p warning    # Warnings and above

Look for service startup in the previous boot:

journalctl -b -1 | grep "Starting\|Started"

See if it detected some hardware:

journalctl -b | grep -i "detected\|found"

You can also filter on specific services:

journalctl -b -u ssh
journalctl -b -u docker

💡

You can always use grep to filter on interesting terms such firmware, hardwrae, device, panic, error, warning etc. Journalctl has plenty of built-in filters but at time,s they are just way too many to remember.

Focus on kernel logs

Kernel initialization can be a simple grep:

journalctl -b | grep "kernel:"

Show all the kernel messages during the current boot:

journalctl -b -k

You can combine it with grep or use the built-in priority based filtering. The command below will show all the kernel related error logs in the present boot.

journalctl -b -k -p err

Use systemd-analyze to look for slow boot issues

systemd provides a handy utility that can be used to see your system's boot issues.

systemd-analyze

This will give you a summary of your system's boot time.

abhishek@fedora:~$ systemd-analyze 
Startup finished in 4.170s (firmware) + 2.262s (loader) + 1.115s (kernel) + 2.017s (initrd) + 10.501s (userspace) = 20.067s 
graphical.target reached after 10.474s in userspace.

You can investigate it further and see which services are taking longer than you would want them to.

systemd-analyze blame

You'll see huge output with services that take the longes at the top.

4.469s dnf-makecache.service
4.031s NetworkManager-wait-online.service
2.269s plymouth-quit-wait.service
2.138s sys-module-fuse.device
2.076s dev-tpm0.device
2.076s sys-devices-LNXSYSTM:00-LNXSYBUS:00-MSFT0101:00-tpm-tpm0.device
2.056s dev-ttyS4.device
2.056s sys-devices-pci0000:00-0000:00:1e.0-dw\x2dapb\x2duart.4-dw\x2dapb\x2duart.4:0-dw\x2dapb\x2duart.4:0.0-tty-ttyS4.device
2.048s sys-devices-LNXSYSTM:00-LNXSYBUS:00-MSFT0101:00-tpmrm-tpmrm0.device
2.048s dev-tpmrm0.device
2.046s sys-devices-platform-serial8250-serial8250:0-serial8250:0.2-tty-ttyS2.device
2.046s dev-ttyS2.device
2.046s sys-devices-platform-serial8250-serial8250:0-serial8250:0.1-tty-ttyS1.device
2.046s dev-ttyS1.device
2.043s dev-ttyS3.device
2.043s sys-devices-platform-serial8250-serial8250:0-serial8250:0.3-tty-ttyS3.device
2.043s sys-devices-platform-serial8250-serial8250:0-serial8250:0.0-tty-ttyS0.device
2.043s dev-ttyS0.device
2.012s sys-module-configfs.device
1.733s dev-disk-by\x2dpath-pci\x2d0000:55:00.0\x2dnvme\x2d1\x2dpart4.device
1.733s dev-disk-by\x2ddiskseq-1\x2dpart4.device
1.733s sys-devices-pci0000:00-0000:00:1c.0-0000:55:00.0-nvme-nvme0-nvme0n1-nvme0n1p4.device
1.733s dev-disk-by\x2did-nvme\x2dWD_PC_SN560_SDDPNQE\x2d1T00\x2d1102_24313Y807163_1\x2dpart4.device

Note that these services run in parallel, not sequential.

If you want, you can generate a waterfall chart of the services:

systemd-analyze plot > boot_analysis.svg

Journalctl boot logs are your first line of defense when troubleshooting system issues. With these tools and techniques, you'll be able to quickly identify and resolve boot-related problems, making your Linux experience smoother and more reliable!

About the author

Abhishek Prakash

Creator of Linux Handbook and It's FOSS. An ardent Linux user who has new-found love for self-hosting, homelabs and local AI.

View profile

Updated on Aug 26, 2025