journalctl -k quietly means 'this boot only'
Suppose you're hunting a kernel message — a disk throwing errors, an OOM kill — and you reach for the obvious incantation:
journalctl -k --since "30 days ago"You get a handful of lines from this morning, and conclude the problem is recent, or that it has never happened before. Both conclusions can be wrong. -k quietly restricts the output to the current boot.
The manual says so, in one easily-missed line:
-k,--dmesg— Show only kernel messages. This implies-band adds the match_TRANSPORT=kernel.
-b with no argument means "the current boot". So -k is really -k -b, and the --since you added doesn't widen anything — it narrows an already-current-boot view down to "since 30 days ago, within this boot". Everything from a previous boot is invisible. The trap is that --since looks like it should set the scope; it doesn't, because -b's implicit default wins.
The symptom is quietly misleading. You grep for a kernel error "across all history" and get nothing, and take the silence as evidence. In fact there were dozens of matches — all in boots before this one.
To search kernel messages across every boot, drop -k and match the transport yourself:
journalctl _TRANSPORT=kernel --since "2026-05-01"Same kernel-only filter, no implicit -b. Or, if you want one specific earlier boot, name it:
journalctl -k --boot=-1(journalctl --list-boots shows the offsets.)
The shape here is worth filing away, because journalctl has a few of these: a convenience flag that silently turns on another flag. -k implies -b. The cure is to stop leaning on the convenience and say what you actually mean — here, _TRANSPORT=kernel — so nothing gets switched on behind your back.