Linux tool journalctl follow switch. How to limit number of new entries printed?

[BeanBun]

I am not really cultured in Linux. The use of journalctl is for a class assignment and I cannot figure out how to get -f (or --follow) to stop printing newly added entries after x number of entries. I have attempted using -n (or --lines=) and some other things but it still will not stop at the specified number.

 

Distribution: SIFT Workstation (VM)

OS: Ubuntu Linux Based

[Rusti Shackleford]

On 4/7/2021 at 3:30 PM, BeanBun said:

I am not really cultured in Linux. The use of journalctl is for a class assignment and I cannot figure out how to get -f (or --follow) to stop printing newly added entries after x number of entries. I have attempted using -n (or --lines=) and some other things but it still will not stop at the specified number.

 

Distribution: SIFT Workstation (VM)

OS: Ubuntu Linux Based

Happy to help if I can. Can you please copy and paste the exact command you're typing into the terminal. Or perhaps even better, the command and output from terminal as it might prove helpful.   

Based on what you wrote, I would try using --line= argument. The command would look something like this:

sudo journalctl -f --lines=5

Never used journalctl before, hope this helps. 

[BeanBun]

I have tried that before but that will not get it to stop at x amount. It is supposed to but it does not for some reason. Thank you

[tikker]

On 4/7/2021 at 9:30 PM, BeanBun said:

I cannot figure out how to get -f (or --follow) to stop printing newly added entries

You can't because this is exactly what -f is supposed to do: follow the journal as entries are added. The --lines argument is not to stop after N entries, it's to show the latest N entries: https://man7.org/linux/man-pages/man1/journalctl.1.html

Quote

       -f, --follow
           Show only the most recent journal entries, and continuously
           print new entries as they are appended to the journal.

       -n, --lines=
           Show the most recent journal events and limit the number of
           events shown. If --follow is used, this option is implied.
           The argument is a positive integer or "all" to disable line
           limiting. The default value is 10 if no argument is given.

 

Just ditch -f if you're only interested in the last N lines.