/flags/systemd/journalctl-boot-b
journalctl -b: logs from the current or a previous boot (-b -1, --list-boots)
- tool
- systemd
- command
- journalctl
- flag
- -b, --boot[=ID][±offset]
- default
- unset: entries from all stored boots
- since
- systemd 186
journalctl -b limits the output to one boot. With no argument it shows the current boot; -b -1 shows the boot before it, -b -2 the one before that, and --list-boots prints the boots stored in the journal with their offsets and IDs. It is the fastest way to answer "what happened before the last reboot" or to hide old noise when you debug a service after starting the machine.
Syntax
journalctl -b # current boot
journalctl -b -1 # previous boot
journalctl -b -1 -e # previous boot, jump to its end (why did it go down?)
journalctl -b -u nginx # one unit, current boot only
journalctl -b -p err # errors and worse since boot
journalctl --list-boots # offsets, boot IDs, first and last entry times
journalctl -b 3f2a...e91c # a boot by its 32-character ID-b adds a match on the _BOOT_ID= field. It has been in journalctl since systemd 186; --list-boots since 209.
Offset values
| Argument | Boot shown |
|---|---|
| (none) or -0 / 0 | The current (latest) boot |
| -1, -2, ... | Counted back from the latest boot: the previous one, the one before |
| 1, 2, ... | Counted from the oldest boot in the journal: the first, the second |
| ID | The boot with that 32-character boot ID |
| ID-1, ID+1 | The boot before or after the boot with that ID |
| all | Cancels an earlier -b (all boots) |
The manual adds one exception: with --directory= (logs from another machine) the current boot may not be the last one in the files, and an empty offset then still means the last boot found.
Previous boots need persistent storage
If --list-boots shows a single line, earlier boots were not kept. Storage= in journald.conf decides that: volatile keeps logs only in memory under /run/log/journal, persistent writes them under /var/log/journal, and auto behaves like persistent only if /var/log/journal exists. The current upstream manual states that the compiled-in default is persistent, but distributions can build or configure it differently, so check your journald.conf.
sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald
journalctl --disk-usageCombining -b with other options
-ealone implies--boot=0and--lines=1000;-b -1 -eoverrides the boot and jumps to the end of the previous one in the pager;-b -1 -n 50 --no-pagerprints its last 50 lines.-b -u UNITis the usual way to see whether a service failed during this boot, together with systemctl --failed.-band--since/--untilintersect: only entries in both are shown (see journalctl --since).-k(kernel messages) implies--boot=0unless you pass another-b, sojournalctl -kis the kernel log of this boot andjournalctl -k -b -1that of the previous one.
FAQ
Why does journalctl -b -1 say there is no previous boot?
The journal was not stored on disk, so earlier boots were lost at reboot. With Storage=auto journald keeps logs persistently only if /var/log/journal exists; create it (or set Storage=persistent in journald.conf) and restart systemd-journald. Boots before that change cannot be recovered.
How do I see why the machine crashed or rebooted?
Look at the end of the previous boot: journalctl -b -1 -e jumps to its last entries, and journalctl -b -1 -p err lists only errors. A hard power loss may leave no final messages at all.
What is the difference between -b -1 and -b 1?
-1 counts back from the latest boot (the boot before the current one), while 1 counts forward from the beginning of the journal (the oldest boot stored).