journalctl

Additional Notes

journalctl reads logs collected by systemd-journald. It is used to troubleshoot services, boot problems, kernel messages, authentication issues, and system events.

It pairs naturally with systemctl: use systemctl status service for a quick view, then journalctl -u service for deeper logs.

Syntax

journalctl [options]
journalctl -u UNIT [options]

Parameters

• options: Flags that change how journalctl behaves.
• unit-or-file: Service name, log file, or log source to inspect.
• time-range: Optional time filter for narrowing log output.

Common Options

• -u UNIT: Show logs for a systemd unit.
• -f: Follow new log entries live.
• -n N: Show the last N lines.
• -b: Show logs from the current boot.
• -b -1: Show logs from the previous boot.
• --since TIME: Show logs since a time.
• --until TIME: Show logs until a time.
• -p PRIORITY: Filter by priority such as err, warning, or info.
• -k: Show kernel messages.
• --no-pager: Print directly without opening a pager.
• -o short-iso: Use readable ISO-style timestamps.

Examples

journalctl -xe

Show recent logs with extra explanation where available.

journalctl -u ssh

Show logs for the SSH service.

journalctl -u nginx -f

Follow nginx logs live.

journalctl -b

Show logs from the current boot.

journalctl -b -1

Show logs from the previous boot.

journalctl --since "today"

Show logs from today.

journalctl --since "2026-06-08 10:00" --until "2026-06-08 11:00"

Show logs from a specific time range.

journalctl -p err -b

Show errors from the current boot.

journalctl -k

Show kernel log messages.

Practical Notes

• Use -u service when troubleshooting one service.
• Use -f when reproducing a problem live.
• Logs can be large. Combine --since, -n, and -p to narrow output.
• Some systems do not keep persistent logs unless journald persistence is enabled.
• If output opens in less, press q to quit.