Logs with journalctl

When a service misbehaves, its logs are the first place to look, and journalctl finds them fast.

systemd's journal collects stdout/stderr of every service, kernel messages and syslog messages into one indexed store. journalctl queries it, and filters combine:

-u nginx one unit (repeat -u for several), -k kernel messages only,
-f follow live, -n 50 the last 50 entries, -e jump to the end,
--since "1 hour ago", --since today, --until "2026-10-01 12:00",
-p err priority error and worse (emerg, alert, crit, err, warning, notice, info, debug),
-b this boot, -b -1 the previous boot, --list-boots all of them,
field matches such as _PID=1234 or _UID=1000, and -o json-pretty to see all fields.

Output goes through a pager; add --no-pager in scripts and pipe to grep as usual. Without sudo (or membership in adm / systemd-journal) you see only your own user's logs.

Whether logs survive a reboot depends on persistent storage: if /var/log/journal exists they do, otherwise they live in /run and vanish. Size limits are set in /etc/systemd/journald.conf; check usage with --disk-usage and trim with --vacuum-size or --vacuum-time.

Many applications (nginx, PostgreSQL) also or instead write classic text logs under /var/log, rotated by logrotate; read those with less, tail -f and grep.

Example

journalctl -u nginx                     # one unit's logs
journalctl -u nginx -f                  # follow live
journalctl -u nginx --since "1 hour ago" --no-pager | grep -i error
journalctl -p err -b                    # errors and worse, this boot
journalctl -b -1 -e                     # previous boot, jump to the end
journalctl -k -n 20                     # last 20 kernel messages
journalctl _PID=1234                    # by field
journalctl -u nginx -o json-pretty -n 1 # every field of one entry
journalctl --disk-usage
sudo journalctl --vacuum-time=2weeks    # drop older entries
sudo tail -F /var/log/nginx/error.log   # classic log files

Remember

journalctl -u unit -f --since ... -p err -b filter and follow
-b -1 reads the previous boot (with persistent storage)
Many apps also write text logs in /var/log, rotated by logrotate

Watch out for

Looking for logs from before a crash-reboot when the journal is not persistent.

Check yourself

How do you see errors from the boot before the current one?
journalctl shows only a few lines for a system service when run without sudo. Why?

Official docs: www.freedesktop.org/software/systemd/man/latest/journalctl.html

Example

Remember

Watch out for

Check yourself

Builds on

Unlocks