Always willing to learn, so many thanks for the tips @alven !
Just to make sure I understand… --boot=0
is just the current boot right… If I wanted previous, I’d need to --boot= -1
… or could I do something like --boot=0..-10
for the current and previous 10 boots?
man journalctl
is my friend, if I wanted all boots, it looks like I can just specify --boot= all
… other than that it appears to have no range option, but can target a specific boot… i.e. --boot= -1
-b [[ID][±offset]|all], --boot[=[ID][±offset]|all]
Show messages from a specific boot. This will add a match for "_BOOT_ID=".
The argument may be empty, in which case logs for the current boot will be shown.
If the boot ID is omitted, a positive offset will look up the boots starting from the beginning of the journal, and an equal-or-less-than zero
offset will look up boots starting from the end of the journal. Thus, 1 means the first boot found in the journal in chronological order, 2 the
second and so on; while -0 is the last boot, -1 the boot before last, and so on. An empty offset is equivalent to specifying -0, except when the
current boot is not the last boot (e.g. because --directory was specified to look at logs from a different machine).
If the 32-character ID is specified, it may optionally be followed by offset which identifies the boot relative to the one given by boot ID.
Negative values mean earlier boots and positive values mean later boots. If offset is not specified, a value of zero is assumed, and the logs for
the boot given by ID are shown.
The special argument all can be used to negate the effect of an earlier use of -b.
I can’t imagine a time I’d want to use the boot id… but that’s pretty cool the offset works with it… so if I had a baseline boot I was focused on with a boot id of 33a33dcf74e249e3b3105aa38c89e12a
, I could do a…
-
--boot = 33a33dcf74e249e3b3105aa38c89e12a
for it’s details
-
--boot = 33a33dcf74e249e3b3105aa38c89e12a -1
for the boot previous to it for compare
-
--boot = 33a33dcf74e249e3b3105aa38c89e12a +1
for the boot after it for compare
Hmm… I think I just thought of a use for boot id… so just like I only had the out of the blue reboot once… instead of having to remember an ever changing offset … I just note the boot id and always be able to reference it…
$ journalctl -k --priority err --boot 5c9af688fbef4d82af93ec5dc7b786cf
-- Journal begins at Tue 2021-07-13 15:47:15 CDT, ends at Thu 2021-12-09 19:01:39 CST. --
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: CPU 8: Machine Check: 0 Bank 5: bea0000001000108
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: TSC 0 ADDR ffffffc0ecab9c MISC d0130fff00000000 SYND 4d000000 IPID 500b000000000
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: PROCESSOR 2:a20f10 TIME 1636419924 SOCKET 0 APIC 5 microcode a201009
That’s cool, I can always reference that one boot by id.
Well look at that… using $ journalctl -k --priority err --boot all | grep -i mce:
I can see that my 1st mce error was actually back on August 11 (Nov 8 was my second)…
$ journalctl -k --priority err --boot all | grep -i mce:
Aug 11 01:19:12 AM4-x5600-Linux kernel: mce: [Hardware Error]: CPU 2: Machine Check: 0 Bank 5: bea0000000000108
Aug 11 01:19:12 AM4-x5600-Linux kernel: mce: [Hardware Error]: TSC 0 ADDR ffffffc0f0873e MISC d012000100000000 SYND 4d000000 IPID 500b000000000
Aug 11 01:19:12 AM4-x5600-Linux kernel: mce: [Hardware Error]: PROCESSOR 2:a20f10 TIME 1628662751 SOCKET 0 APIC 4 microcode a201009
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: CPU 8: Machine Check: 0 Bank 5: bea0000001000108
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: TSC 0 ADDR ffffffc0ecab9c MISC d0130fff00000000 SYND 4d000000 IPID 500b000000000
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: PROCESSOR 2:a20f10 TIME 1636419924 SOCKET 0 APIC 5 microcode a201009
Yah… I was just under 1 month in on GNU/Linux back then… so I’m not surprised that went straight over my head… probably didn’t know how to look beyond the 1,000 entry limit of KSystemLog
yet.
Don’t get me wrong… lots still goes over my head, maybe just a bit less now
extra brownie points
I really liked seeing the -- Journal begins at...
line that journalctl
outputs before the grep… and couldn’t figure out how to do an “OR” to keep it in as well, but found (via DDG university) that egrep
can do it easily…
$ journalctl -k --priority emerg --boot all | egrep -i 'mce:|-- Journal'
-- Journal begins at Tue 2021-07-13 15:47:15 CDT, ends at Thu 2021-12-09 19:56:03 CST. --
Aug 11 01:19:12 AM4-x5600-Linux kernel: mce: [Hardware Error]: CPU 2: Machine Check: 0 Bank 5: bea0000000000108
Aug 11 01:19:12 AM4-x5600-Linux kernel: mce: [Hardware Error]: TSC 0 ADDR ffffffc0f0873e MISC d012000100000000 SYND 4d000000 IPID 500b000000000
Aug 11 01:19:12 AM4-x5600-Linux kernel: mce: [Hardware Error]: PROCESSOR 2:a20f10 TIME 1628662751 SOCKET 0 APIC 4 microcode a201009
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: CPU 8: Machine Check: 0 Bank 5: bea0000001000108
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: TSC 0 ADDR ffffffc0ecab9c MISC d0130fff00000000 SYND 4d000000 IPID 500b000000000
Nov 08 19:05:25 AM4-5600X-Linux kernel: mce: [Hardware Error]: PROCESSOR 2:a20f10 TIME 1636419924 SOCKET 0 APIC 5 microcode a201009
I also duplicated this command swapping the priority with “emerg” (0), “alert” (1), and “crit” (2) to see how high these errors were actually flagged… and they survived all the way to “emerg”, so pretty important.
And I also learned from a Distotube video that when I’m in a man page I can type “/” to enter a search term; which helps me find what I am looking for.