journalctl Command
Beginner Systemd & Services man(1)Query and display systemd journal logs
👁 10 views
📅 Updated: Mar 15, 2026
SYNTAX
journalctl [OPTION]...
What Does journalctl Do?
journalctl queries and displays logs from the systemd journal. The journal captures all system logs including kernel messages, service output, and syslog messages in a structured, indexed format.
journalctl provides powerful filtering by service, time range, priority, and more. It replaces reading raw log files in /var/log/ for most troubleshooting tasks.
journalctl is the primary log viewer for systemd-based systems. It supports real-time following, JSON output, and persistent storage of logs.
journalctl provides powerful filtering by service, time range, priority, and more. It replaces reading raw log files in /var/log/ for most troubleshooting tasks.
journalctl is the primary log viewer for systemd-based systems. It supports real-time following, JSON output, and persistent storage of logs.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -u | Show logs for specific service | journalctl -u nginx |
| -f | Follow (like tail -f) | journalctl -f |
| -n N | Show last N lines | journalctl -n 50 |
| --since | Show logs since time | journalctl --since "1 hour ago" |
| --until | Show logs until time | journalctl --until "2024-01-15 12:00" |
| -p | Filter by priority | journalctl -p err |
| -k | Show kernel messages | journalctl -k |
| -b | Show logs from current boot | journalctl -b |
| -o json | Output in JSON format | journalctl -u nginx -o json-pretty |
Practical Examples
#1 Service logs
Shows last 50 log lines for nginx.
$ journalctl -u nginx --no-pager -n 50#2 Follow logs
Follows log output in real time (like tail -f).
$ journalctl -u myapp -f#3 Errors only
Shows only error-level messages from current boot.
$ journalctl -p err -b#4 Time range
Shows logs from a specific time window.
$ journalctl --since "2024-01-15 02:00" --until "2024-01-15 04:00"#5 Last hour
Shows all logs from the last hour.
$ journalctl --since "1 hour ago"#6 Kernel messages
Shows kernel warnings and above.
$ journalctl -k -p warning#7 Disk usage
Shows how much disk space the journal uses.
$ journalctl --disk-usage
Output:
Archived and active journals take up 2.3G.
#8 Boot list
Lists all recorded system boots.
$ journalctl --list-bootsTips & Best Practices
--since is very flexible: "1 hour ago", "yesterday", "2024-01-15 03:00", "today". Very useful for "what happened at 3am?" questions.
Priority levels: -p emerg, alert, crit, err, warning, notice, info, debug. -p err shows errors, critical, alert, and emergency.
Journal may not persist: By default, journal may not survive reboots. Create /var/log/journal/ to enable persistent storage.
Frequently Asked Questions
How do I view service logs?
journalctl -u service_name. Add -f to follow in real time. Add -n 100 for last 100 lines.
How do I see what happened at a specific time?
journalctl --since "2024-01-15 02:00" --until "2024-01-15 04:00" shows logs in that window.
How do I see only errors?
journalctl -p err shows error-level and above. Add -b for current boot only.
Related Commands
More Systemd & Services Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →