journalctl — reading the systemd journal

cheat sheet · Ubuntu 24.04 · systemd 255 https://lab.dimsanych.ru/en/wiki/journalctl/

Cheat sheet

journalctl -u nginx -f tail a service's logs
journalctl -xeu nginx investigate a failure
journalctl -p err -b errors from the current boot
journalctl -k kernel messages
journalctl _COMM=sshd -g fail by process, plus a text match
journalctl -b -1 the previous boot
journalctl --vacuum-time=7d clean up

Options

Flag	Meaning
`-u <unit>`	only this service
`-f` / `-e`	follow / jump to the end
`-x`	add explanations to messages
`-p <prio>`	this priority or higher: emerg..debug (or err, warning)
`-b [N]`	the current (or Nth) boot
`-k`	kernel messages
`-g RE`	grep the text
`-o <fmt>`	output format: short, json, json-pretty, cat, verbose
`--since/--until`	a time range

Filtering by structured fields (without naming a service):

bash

journalctl _PID=1234              # by PID
journalctl _COMM=sshd             # by process name
journalctl _UID=1000 --since today
journalctl _SYSTEMD_UNIT=ssh.service -p warning
journalctl -o json-pretty -u nginx -n 1   # every field of one entry
journalctl --user -u myapp        # a user service