Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

journalctl — reading the systemd journal

5 min Ubuntu 24.04 · systemd 255

Reading the systemd journal (journald) — filters by service, time, priority.

Cheat sheet

7 commands Printable version
  • journalctl -u nginx -f tail a service's logs
  • journalctl -xeu nginx investigate a failure
  • journalctl -p err -b errors from the current boot
  • journalctl -k kernel messages
  • journalctl _COMM=sshd -g fail by process, plus a text match
  • journalctl -b -1 the previous boot
  • journalctl --vacuum-time=7d clean up

Overview

journalctl reads the centralized systemd journal (journald) — service stdout/stderr, kernel messages and syslog all land there. The journal is structured: you can filter by service, time, priority, boot, PID, field.

By default on Ubuntu the journal may be non-persistent (lost on reboot). To store it on disk:

bash 
sudo mkdir -p /var/log/journal && sudo systemctl restart systemd-journald

Options

14
Flag Meaning
-u <unit> only this service
-f / -e follow / jump to the end
-x add explanations to messages
-p <prio> this priority or higher: emerg..debug (or err, warning)
-b [N] the current (or Nth) boot
-k kernel messages
-g RE grep the text
-o <fmt> output format: short, json, json-pretty, cat, verbose
--since/--until a time range

Filtering by structured fields (without naming a service):

bash 
journalctl _PID=1234              # by PID
journalctl _COMM=sshd             # by process name
journalctl _UID=1000 --since today
journalctl _SYSTEMD_UNIT=ssh.service -p warning
journalctl -o json-pretty -u nginx -n 1   # every field of one entry
journalctl --user -u myapp        # a user service
Option What it does Example
-u --unit unit Only entries from the given service (unit). journalctl -u nginx
-f --follow Follow the journal in real time, like tail -f. journalctl -u nginx -f
-p --priority priority Only entries at this priority or higher (err, warning, …). journalctl -p err -b
-b --boot ID|+-N Entries from the current boot; with an offset, another boot (-1 is the previous one). journalctl -b -1
--since date Start of the time range. journalctl --since "1 hour ago"
--until date End of the time range. journalctl --until today
-e --pager-end Jump straight to the end of the journal. journalctl -eu nginx
-x --catalog Add explanatory text to messages, when available. journalctl -xeu nginx
-k --dmesg Kernel messages only (like dmesg). journalctl -k
-g --grep pattern Show only entries matching the regular expression. journalctl -g 'fail'
-o --output format Output format — short, json, json-pretty, cat, verbose, and others. journalctl -o json-pretty -u nginx -n 1
-t --identifier tag Only entries with this tag (program name or logger -t). journalctl -t cleanup
--disk-usage How much disk space the journal is using. journalctl --disk-usage
--vacuum-time time Delete entries older than the given time. dangerous journalctl --vacuum-time=7d

Nothing found. Try a shorter query.

Recipes

2

Commands

bash 
journalctl -u nginx               # entries from the nginx service
journalctl -u nginx -f            # follow in real time (like tail -f)
journalctl -u nginx --since "10 min ago"
journalctl -xeu nginx             # tail plus explanations (x) when debugging
journalctl -p err -b              # only errors from the current boot
journalctl -k                     # kernel messages (like dmesg)
journalctl --since today --until "1 hour ago"
journalctl -b -1                  # the journal of the PREVIOUS boot (before the last reboot)
journalctl -g 'pattern'           # grep messages (regex)
journalctl --disk-usage           # how much space it takes
sudo journalctl --vacuum-time=7d  # drop entries older than 7 days

Your own lines in the journal: logger and -t

text 
student@ubuntu:~$ logger -t cleanup "removed 3 files"
student@ubuntu:~$ journalctl -t cleanup --no-pager -n 2
Oct 20 10:50:48 ubuntu cleanup[1143]: removed 3 files

logger -t tag writes a line to the journal under that tag, and journalctl -t tag shows only those lines. Output of a script run by a service is tagged with the script name: journalctl -t clean.sh. Outside the adm and systemd-journal groups, student sees only its own entries — read other users' and system entries with sudo.

Troubleshooting

5

The journal is empty after a reboot

journald isn't persistent. Create /var/log/journal (see "Overview"). journalctl -b -1 will then show the previous boot.

The journal is filling up the disk

journalctl --disk-usage, then --vacuum-time=7d or --vacuum-size=500M. A permanent cap goes in /etc/systemd/journald.conf (SystemMaxUse=500M).

You need logs for a specific failure

journalctl -xeu <unit> --since "5 min ago" is the most common diagnostic query (see systemctl).

The time in the journal looks "wrong"

journald stores entries in UTC internally and shows the local timezone. Check timedatectl; use journalctl --utc for UTC.

A service's logs show up in /var/log too (duplicates)

journald and rsyslog can both log the same thing. See rsyslog for text files vs journalctl for structured, per--u queries.

See also

  • systemctl — Managing systemd services — start/stop/restart/status/enable/reload.
  • systemd — The init system and service manager (PID 1): units, targets, dependencies, logs.

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Topics
Loading…