journalctl is used to view logs collected by systemd’s journal service. It replaces traditional log files and gives you powerful filtering for debugging issues.
▶️ Basic Usage
View all logs
journalctl
Follow logs in real-time (like tail -f)
journalctl -f
⏱️ Filter Logs by Time
Show logs from today
journalctl --since today
Show logs from the last hour
journalctl --since "1 hour ago"
Custom time range
journalctl --since "2026-05-04 10:00:00" --until "2026-05-04 12:00:00"
🔧 Filter by Service
View logs for a specific service
journalctl -u nginx
Follow logs for a service
journalctl -u apache2 -f
✔ Essential for debugging services like web servers or drivers
⚠️ View Errors Only
journalctl -p err
Other levels:
0= emergency3= error4= warning6= info
🖥️ View Logs from Current Boot
journalctl -b
Previous boot
journalctl -b -1
✔ Useful after crashes or failed startups
📂 Kernel Logs Only
journalctl -k
✔ Similar to dmesg, but more detailed
👤 Filter by User
journalctl _UID=1000
📄 Output Options
Show latest 50 lines
journalctl -n 50
Disable pager (no scrolling)
journalctl --no-pager
Export logs to file
journalctl > logs.txt
🔐 Disk Usage & Cleanup
Check journal size
journalctl --disk-usage
Clear old logs (keep last 7 days)
sudo journalctl --vacuum-time=7d
⚠️ Common Issues
No logs showing?
Run as root:
sudo journalctl
Logs disappear after reboot?
Persistent logging may not be enabled. Check:
sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald
🧠 When to Use journalctl
- System crashes or boot failures
- Service errors (Apache, Nginx, Docker, etc.)
- Hardware or driver issues
- Kernel debugging
💡 Pro Tip
Use this combo for fast troubleshooting:
journalctl -xe
✔ Shows recent errors with explanations
✔ Great starting point when something breaks
