System Logs: journalctl

journalctl reads the systemd journal — the central log of everything happening on the system.

Syntaxjournalctl [-u service] [-f] [--since time]

On systemd-based distributions, logs are collected in one place, the journal, which you read with journalctl.

Useful invocations

  • journalctl -e — jump to the newest entries.
  • journalctl -f — follow the log live, like tail -f.
  • journalctl -u nginx — only messages from the nginx service.
  • journalctl --since "1 hour ago" — filter by time.
  • journalctl -p err — only error-level messages.

Older systems and many applications also write plain-text logs under /var/log, which you read with less or tail.

Example

Example · bash
# Follow all new log messages live
journalctl -f

# Just one service, newest first
sudo journalctl -u ssh -e

# Errors from the last hour
journalctl -p err --since "1 hour ago"

# Plain-text logs still live here too
tail -f /var/log/syslog

When to use it

  • A sysadmin uses 'journalctl -u nginx --since "1 hour ago"' to investigate nginx errors that started after a config change.
  • A developer uses 'journalctl -f' to follow the system journal in real time while testing a new systemd service.
  • A security analyst uses 'journalctl --since "2026-07-15" --until "2026-07-16" -u sshd' to audit SSH activity during a suspected breach window.

More examples

Follow live system logs

Uses -f to stream new journal entries as they arrive, and -u to filter to a single service unit.

Example · bash
# Follow journal in real time (like tail -f for systemd)
journalctl -f

# Follow logs for a specific service
journalctl -fu nginx

Filter by time range

Uses --since and --until for time-bounded queries, and -b to limit output to the current boot session.

Example · bash
# Logs since 1 hour ago
journalctl --since "1 hour ago"

# Logs in a specific window
journalctl --since "2026-07-16 08:00" --until "2026-07-16 09:00"

# Logs from current boot only
journalctl -b

Filter by priority and service

Uses -p to filter by log priority level and -n to limit the number of lines, combining filters for targeted queries.

Example · bash
# Show only errors and above for nginx
journalctl -u nginx -p err

# Show kernel messages (like dmesg)
journalctl -k

# Show last 50 lines from sshd
journalctl -u sshd -n 50

Related

linux systemctllinux less

Discussion

  • Be the first to comment on this lesson.