How to View and Analyze System Logs in Linux Using journalctl

When troubleshooting issues on a modern Linux system (like Ubuntu, Debian, CentOS, or Fedora), system logs are the first place you should look. Almost all modern Linux distributions use systemd as their init system, which includes a powerful logging daemon called systemd-journald. To interact with these logs, you use the journalctl command.

Basic Log Viewing

By default, running journalctl without any arguments will display every single log entry on the system, starting from the oldest. This is rarely useful due to the sheer volume of data.

sudo journalctl

To view logs in reverse (starting from the most recent entries at the bottom), use the -r flag:

sudo journalctl -r

Following Logs in Real-Time

If you are actively restarting a service or monitoring a live issue, you can “follow” the logs as they are written to the system, similar to using tail -f. Use the -f flag:

sudo journalctl -f

Filtering Logs by Service or Time

The real power of journalctl lies in its filtering capabilities. To see logs specifically for the Nginx web server, use the -u (unit) flag:

sudo journalctl -u nginx.service

If you only want to see logs that occurred today, you can filter by time using the --since flag:

sudo journalctl --since "today"

You can also define specific times, for example, viewing logs from the last hour:

sudo journalctl --since "1 hour ago"

Filtering by Severity

To find critical errors and ignore informational messages, you can filter by priority using the -p flag. For example, to see only errors (priority 3) and above:

sudo journalctl -p 3 -b

Note: The -b flag limits the output to only the logs from the current system boot.