If you manage Linux servers, whether it’s a production web host, a database node, or a container host, you’ve probably had that moment of dread: you SSH in and a service is down, or worse, the whole box seems to have restarted on its own. Before you dive into log files, there’s one command that should be your first stop:
journalctl --list-bootsWhat the Command Does
`journalctl –list-boots` asks systemd’s journal daemon (`journald`) to list every boot session it has a record of. Instead of dumping the entire journal history as one giant unbroken stream, this command segments it by boot cycle, making it trivial to jump straight to the logs from a specific startup event.
Run it, and you’ll see output like this:
[root@208 ~]# journalctl --list-boots
IDX BOOT ID FIRST ENTRY LAST ENTRY
0 2822d810a2e849389b158c4adfe8d2b6 Sun 2026-06-28 04:04:36 EDT Wed 2026-08-19 13:29:22 EDT
[root@208 ~]# Breaking Down the Columns
IDX (Boot Index) – A relative offset where `0` is always the current, active boot. `-1` is the previous boot, `-2` the one before that, and so on. Negative numbers count backward in time from “now.”
Boot ID – A unique 32-character hexadecimal identifier that systemd generates fresh for every single boot. Think of it as a fingerprint for that specific run of the machine — no two boots will ever share one.
First Entry / Last Entry – The timestamps of the earliest and latest log lines recorded during that boot session, giving you an at-a-glance window of when the machine was up.
Other Commands
who -b – shows the last boot time in a simple one-liner.
last reboot – shows a history of reboot events, pulled from a different log source (`/var/log/wtmp`).
Back to journalctl