If you want to display only journal messages from the systemd process, which command is correct?

The command to use for displaying only journal messages from the systemd process is based on the process identifier (PID) associated with systemd. The systemd process typically has a PID of 1 in a standard system configuration, as it is the first process started by the Linux kernel during system boot.

When utilizing the command journalctl _PID=1, you are specifically filtering the log entries to show only those associated with the PID of 1, which corresponds to the systemd process. This effectively narrows down the log output to include only relevant messages directly from systemd, such as service start and stop messages, journal management, and other related system events.

This command is particularly useful for troubleshooting or monitoring system services and their status, allowing administrators to focus on the logs produced by the system’s init system without sifting through numerous messages generated by other services and processes.

In contrast, using the UID filter or different PIDs does not target the systemd process correctly. While UID refers to user identifiers and can include processes owned by different users, it does not specifically correlate to systemd as it runs with the UID 0 (root) by default. Filtering based on the PID of 1000 would potentially target a common user session process