by joekamprad

In the majority of cases, simply describing your issue will not provide enough information for someone to identify its cause and advise you on how to resolve it. It is important to include any system logs that may be relevant to your issue to ensure that neither your time nor the other person’s time is wasted. The following is a list of the most common system logs and where/how to obtain them. The logs are listed in order of importance.

Essential: we need to be able to reproduce the issue, so exact steps are needed.

Systemd Journal:

The systemd journal can only be accessed using the journalctl command. You can export your system’s journal from the last three boots using these command:

journalctl -b -0 > /tmp/journal

journalctl -b -1 > /tmp/journal.last

journalctl -b -2 > /tmp/journal.2last


Now you can open the 3 files under /tmp with any text editor.

If you want them posted into the forum you can just Pastebin them:

cat /tmp/journal | curl -F 'f:1=<-'
cat /tmp/journal.last | curl -F 'f:1=<-'
cat /tmp/journal.2last | curl -F 'f:1=<-'

Learn more about the Pastebin command further down.

Note that EndeavourOS has a simpler way to Pastebin. For example:

cat /tmp/journal | eos-sendlog

Program eos-sendlog will (by default) save the received URLs to ~/.config/eos-sendlog.txt for later inspection.


Your session log is located in your /home directory:



Xorg (X11):

You can find your Xorg logs here:




LightDM’s logs can be found here:



Other log providers and options:

journalctl --since "10 minutes ago"

To get the journal from a given timespan (works also with hours seconds, days)

For problems after new installation:

installer (calamares) log is saved inside home folder of the live user: /home/liveuser/endeavour-install.log you can send this to Pastebin like this from a terminal:

cat ~/endeavour-install.log | curl -F 'f:1=<-'

After the command sends the logfile it gives out a short URL looking like this one:

The install log is also stored on installed system:

cat /var/log/Calamares.log | curl -F 'f:1=<-'

A good way to get information about a particular program:

journalctl -f /usr/bin/"Executable" 

And nice to post a Pastebin the smart way:

"command" | curl -F 'f:1=<-'

System summary and boot log example:

lspci > log.txt && lsusb >> log.txt && journalctl -b -0 >> log.txt && cat log.txt | curl -F 'f:1=<-' 

Or use eos-sendlog:

lspci > log.txt && lsusb >> log.txt && journalctl -b -0 >> log.txt && cat log.txt | eos-sendlog

Program eos-log-tool is a GUI for various logs and system files.

Other systemd logs/analyze:

systemd-analyze blame

will show times of systemd stuff needed to proceed on bootup


install pastebinit with package manager or sudo pacman -S pastebinit

the command should be passed like this:

journalctl -b -0 > ~/journal.txt && pastebinit -i ~/journal.txt -b

where you can change journalctl -b -0 with any other command like dmesg from below, his will write to a txt file: ~/journal.txt under your home you can change this name (journal) to something related to the command you pass..

pastebinit will auto-upload this to the Pastebin service you can choose (list all available by pastebinit -l

then it gives the link to it as output, so that you can just copy t to paste inside a post.

System summary and boot-journal example:

lspci > log.txt && lsusb >> log.txt && journalctl -b -0 >> log.txt && pastebinit -i log.txt -b

This will give out a link (like this: you can post onto the forum, this will include all the output of:

lspci (list your pci devices) lsusb (same for USB) and dmesg (bootup messages) and make it available.

The dmesg command:

An alternative to the above command (or if your system is not using systemd) is the good old dmesg command. This is potentially less informative than journalctl above, but not if you have filtered it as I advised you to. So they are essentially equivalent.


Again, If you look in its man page or type invoke dmesg --help you’ll learn about the always useful -l flag, which filters dmesg potentially long output to print only certain message levels. And the -r flag which prints the message level. So, likewise many of us will thank you if you do the following instead of the above:

dmesg -rl warn,err,crit

Or at the very least:

dmesg -r

Trivia: The dmesg command is basically the same as journalctl with the -k flag added to it

Hardware Information Systems:


inxi -Fxxc0z --no-host

Or to autopastebin it and get an URL to post:

inxi -Fxxc0z --no-host | curl -F 'f:1=<-'

Final Note:

Very important! Do not paste only the printed contents of the command.

Always show also the command you used to get that output.

And better to use an external Pastebin if the output is very large because it is hard to get the overall question visible, inside your post, or for the discussion, if it is interrupted by large logs!

Connect with us:

How to include systemlogs in your post.

  • by