How to Use the Linux ‘journalctl’ Command to Filter System Logs by Time

When troubleshooting a server issue or application crash in Linux, sifting through thousands of log entries can be overwhelming. Modern Linux distributions rely on systemd, which uses the journalctl command to manage and display system logs. One of the most powerful features of journalctl is its ability to filter logs based on specific timeframes, allowing you to isolate events precisely when a problem occurred.

Instead of manually scrolling through endless output or relying on complex text-parsing tools like grep, you can instruct journalctl to display only the logs generated during a particular time window.

Filtering Logs Since a Specific Time

To view all log entries generated after a certain point in time, use the --since flag. This is incredibly useful when you know a system failure occurred recently and you only want to see events leading up to the present moment.

You can use natural language terms to filter recent logs. For example, to view all logs from the last hour, run:

journalctl --since "1 hour ago"

You can also use other relative terms such as "20 minutes ago", "yesterday", or "today". To view all logs generated since midnight today, simply type:

journalctl --since today

Filtering Logs Before a Specific Time

Conversely, if you want to view historical logs leading up to a specific event but exclude everything that happened afterwards, use the --until flag. For example, to view logs generated up until yesterday, you would use:

journalctl --until yesterday

Combining Time Filters for a Precise Window

The true power of time filtering comes from combining both flags to create a specific, narrow time window. This is the standard approach when performing post-incident forensic analysis on a Linux server.

For absolute precision, you should use exact dates and times formatted as YYYY-MM-DD HH:MM:SS. For example, if a database crashed on the 15th of August between 2:00 PM and 2:30 PM, you can extract exactly that half-hour window:

journalctl --since "2023-08-15 14:00:00" --until "2023-08-15 14:30:00"

If you omit the time portion, journalctl defaults to midnight (00:00:00) for that date. For example, --since "2023-08-15" will show logs starting from the very beginning of the 15th of August.

Viewing Live Logs in Real-Time

If you are actively trying to reproduce an error, viewing logs retroactively might not be enough. You can combine time filtering with the follow flag (-f) to stream logs as they happen.

To see all logs generated in the last ten minutes and then continue watching the log stream in real-time, execute:

journalctl --since "10 minutes ago" -f

This command provides immediate context for recent events while keeping the terminal open to capture any new errors that occur while you are troubleshooting.