How to Use the Linux journalctl Command to Read systemd Logs

Historically, Linux system logs were scattered across dozens of plain-text files inside the /var/log directory. Administrators had to manually hunt down the correct file (e.g., auth.log for logins, syslog for system events) and use text-parsing tools like grep to find answers.

Modern Linux distributions (like Ubuntu, CentOS, and Arch) have transitioned to systemd, which unifies all system, kernel, and application logs into a single, highly indexed, binary database called the journal. To read and query this database, you must use the journalctl command.

Basic Usage: Viewing the Entire Journal

To view every single log entry recorded since your system was installed, simply type:

journalctl

This will open the logs in a paginated view (using less). You can use your arrow keys to scroll, press Spacebar to jump a page, and press q to quit. However, because a server can generate thousands of log entries per minute, this raw view is rarely useful without filtering.

Filtering Logs by Time

The true power of journalctl lies in its ability to parse natural language timestamps.

• To view only the logs generated since the server was last rebooted, use the -b (boot) flag:

  journalctl -b

• To view logs from a specific timeframe, use the --since and --until flags. For example, to see everything that happened yesterday:

  journalctl --since "yesterday"

• To investigate a crash that happened exactly one hour ago:

  journalctl --since "1 hour ago"

• To look at a highly specific chronological window:

  journalctl --since "2023-10-25 14:00:00" --until "2023-10-25 14:15:00"

Filtering Logs by Specific Services

If you are troubleshooting a specific application—such as your Nginx web server or the SSH daemon—you can instruct journalctl to exclusively display logs generated by that specific systemd unit using the -u (unit) flag.

journalctl -u sshd.service

You can combine flags for pinpoint accuracy. If your web server crashed this morning, you can instantly find the exact error by combining the unit flag with a time constraint:

journalctl -u nginx.service --since "today"

Real-Time Log Monitoring

Just like the traditional tail command, journalctl can “follow” the logs, printing new entries to your terminal screen in real-time as they occur. This is invaluable when actively testing a new configuration.

Use the -f (follow) flag:

journalctl -f

Press Ctrl + C to exit the real-time monitoring stream.