diff --git a/cheat/cheatsheets/journalctl b/cheat/cheatsheets/journalctl index 6c00e7f..793dd18 100644 --- a/cheat/cheatsheets/journalctl +++ b/cheat/cheatsheets/journalctl @@ -19,3 +19,14 @@ journalctl /usr/bin/dbus-daemon # Filter by PID journalctl _PID=123 +# Filter by Command, e.g., sshd +journalctl _COMM=sshd + +# Filter by Command and time period +journalctl _COMM=crond --since '10:00' --until '11:00' + +# List all available boots +journalctl --list-boots + +# Filter by specific User ID e.g., user id 1000 +journalctl _UID=1000 \ No newline at end of file