01 / JUST GIVE ME THE ANSWER

The quick answer

journalctl -b -1 shows journal entries from the previous boot, provided those entries were retained.

journalctl -b -1
02 / EXPLAIN IT PROPERLY

What's going on?

journalctl -b -1 shows journal entries from the previous boot, provided those entries were retained.

Understanding the underlying mechanism makes troubleshooting much easier than memorising a command in isolation.

03 / UNDER THE BONNET

Dig a little deeper

List available boots with journalctl --list-boots. Persistent journals usually live in /var/log/journal; volatile journals may disappear on reboot.

04 / TRY IT YOURSELF

Hands-on commands

Try these in a suitable test environment. Read each command before running it, especially if you have elevated privileges.

journalctl --list-boots
sudo journalctl -b -1 -p warning
sudo journalctl -u ssh -b -1
05 / THE RABBIT HOLE

One more thing...

Yesterday's errors are today's clues.

Explore another mystery ↗
← Back to the knowledge base