journalctl

Updated

July 31, 2026

Overview

journalctl queries the systemd journal — structured logs from the kernel, services, and many applications. It replaces much of traditional /var/log/syslog grepping on journald systems.

Syntax

journalctl [options] [matches...]

Common Options

Option Description
-u UNIT Messages for unit
-b / -b -1 Current / previous boot
-f Follow (like tail -f)
-e Jump to end
-n N Last N lines
-p PRIORITY Priority threshold (e.g. err)
-S / -U Since / until time
-o json / json-pretty Machine-readable
-k Kernel messages only
-x Extra explanations when available
--disk-usage Journal size on disk
--vacuum-size= / --vacuum-time= Reclaim space
-g REGEX Filter message regex (newer)

Key Use Cases

  1. Debug a failed service
  2. Watch live logs while reproducing a bug
  3. Inspect previous boot after crash
  4. Export structured logs for processing

Examples with Explanations

Unit logs

journalctl -u ssh.service -n 50 --no-pager
journalctl -u nginx --since "1 hour ago"

Follow

journalctl -u myapp -f

Previous boot

journalctl -b -1 -p err..alert

Kernel / dmesg-like

journalctl -k -b

Time window

journalctl --since "2026-07-31 09:00:00" --until "2026-07-31 10:00:00"

Priority

journalctl -p err -b

JSON for jq

journalctl -u nginx -o json-pretty -n 5
journalctl -u nginx -o json -n 100 | jq -r '.MESSAGE'

Disk usage and vacuum

journalctl --disk-usage
sudo journalctl --vacuum-size=500M
sudo journalctl --vacuum-time=14d

Understanding Output

Default is a pager (less-like). Timestamps, hostname, syslog identifier, PID, and message are shown. Use --no-pager in scripts/CI.

Common Usage Patterns

Failed service triage

systemctl status myapp --no-pager
journalctl -u myapp -b --no-pager -n 100

Boot list

journalctl --list-boots

Notes & Pitfalls

  • Persistent journals need /var/log/journal and proper config; otherwise logs may be volatile in /run/log/journal.
  • Access to other users’ journals may require membership in systemd-journal or adm.
  • Large journals: vacuum or rate-limit noisy units.

Additional Resources

  • man journalctl
  • man journald.conf