If your Ubuntu Linux machine completely freezes or crashes, your first instinct is to hold down the physical power button to restart it. When it boots back up, everything seems fine. But why did it crash? Was it the graphics driver? Did it run out of RAM?
By default, if you open the terminal and type dmesg or check the syslog, Ubuntu only shows you the logs for the current session (since you just turned it on). The logs from the previous, crashed session seem entirely lost. However, Linux utilizes a powerful logging daemon called `journald` that archives every single boot session. You can safely extract the precise log from the exact moment your computer died yesterday.
How to Safely Extract Ubuntu Previous Boot Logs
You must use the `journalctl` command to travel backward in time to the previous boot session.
- Open your Terminal application (Ctrl + Alt + T).
- First, you must ask the journal daemon for a list of all archived boot sessions. Type this command and press Enter:
journalctl --list-boots - The terminal will output a numbered list. 0 is your current, active boot. -1 is the previous boot (the one that crashed). -2 is the boot before that, and so on.
- To extract the entire log from the previous, crashed session, type the following command:
journalctl -b -1 - Press Enter.
You are now viewing the exact system log from the moment you turned the computer on yesterday until the exact millisecond it crashed. Use the Page Down key to scroll to the very bottom of the log (right before the crash). Look for catastrophic errors marked in red, or repeated warnings about “OOM-killer” (Out of Memory) or “GPU Hang.” This text will tell you exactly what hardware or software failure brought down your Ubuntu system.