journalctl — Query and Search the systemd Journal

journalctl is your window into the systemd journal – the central log store that collects messages from the kernel, services and applications in a structured, queryable form. Instead of grepping through scattered files under /var/log, you filter precisely by unit, time range, priority or process and follow new entries in real time. This guide walks you through the queries you actually reach for when debugging and operating systems – from diagnosing a single service to reclaiming space from an overgrown journal.

Basic Usage

journalctl — Show all journal entries (oldest first) in a pager.

journalctl

journalctl -r — Show entries in reverse order (newest first).

journalctl -r

journalctl -n N — Show only the last N entries (default: 10).

journalctl -n 50

journalctl -f — Follow mode — continuously show new log entries (like tail -f).

journalctl -f

journalctl -e — Jump to the end of the journal in the pager.

journalctl -e

journalctl --no-pager — Output directly without a pager. Useful for piping.

journalctl --no-pager -n 100

Filter by Unit/Service

journalctl -u UNIT — Show logs for a specific systemd unit/service.

journalctl -u nginx.service

journalctl -u UNIT -f — Follow logs for a specific service.

journalctl -u nginx.service -f

journalctl -u UNIT1 -u UNIT2 — Show logs for multiple services.

journalctl -u nginx.service -u php-fpm.service

journalctl -u 'nginx*' — Show logs for units matching a pattern.

journalctl -u 'nginx*'

journalctl -u UNIT --since today — Show today's logs for a service.

journalctl -u sshd.service --since today

Filter by Time

journalctl --since 'YYYY-MM-DD HH:MM:SS' — Show entries since a specific date and time.

journalctl --since '2024-01-15 09:00:00'

journalctl --until 'YYYY-MM-DD HH:MM:SS' — Show entries until a specific date and time.

journalctl --until '2024-01-15 17:00:00'

journalctl --since today — Show entries from today.

journalctl --since today

journalctl --since yesterday --until today — Show yesterday's entries.

journalctl --since yesterday --until today

journalctl --since '1 hour ago' — Show entries from the last hour.

journalctl --since '1 hour ago'

journalctl --since '30 min ago' — Show entries from the last 30 minutes.

journalctl --since '30 min ago'

journalctl --since '2 days ago' — Show entries from the last 2 days.

journalctl --since '2 days ago'

Filter by Priority

journalctl -p err — Show only error messages and above (err, crit, alert, emerg).

journalctl -p err

journalctl -p warning — Show warnings and above.

journalctl -p warning

journalctl -p crit — Show only critical and above.

journalctl -p crit

journalctl -p info — Show info and above (default).

journalctl -p info

journalctl -p debug — Show all messages including debug level.

journalctl -p debug

journalctl -p err..warning — Show messages in a priority range.

journalctl -p err..warning

Filter by Process & User

journalctl _PID=PID — Show logs for a specific process ID.

journalctl _PID=1234

journalctl _UID=UID — Show logs from a specific user ID.

journalctl _UID=1000

journalctl _GID=GID — Show logs from a specific group ID.

journalctl _GID=33

journalctl _COMM=COMMAND — Show logs from processes with a specific command name.

journalctl _COMM=sshd

journalctl _EXE=PATH — Show logs from a specific executable.

journalctl _EXE=/usr/sbin/nginx

journalctl _HOSTNAME=HOST — Show logs from a specific hostname (useful with remote journaling).

journalctl _HOSTNAME=webserver01

Kernel Messages

journalctl -k — Show only kernel messages (equivalent to dmesg).

journalctl -k

journalctl -k -b — Show kernel messages from the current boot.

journalctl -k -b

journalctl -k -p err — Show kernel errors.

journalctl -k -p err

journalctl -k -f — Follow kernel messages in real time.

journalctl -k -f

Boot Logs

journalctl -b — Show logs from the current boot.

journalctl -b

journalctl -b -1 — Show logs from the previous boot.

journalctl -b -1

journalctl -b -2 — Show logs from two boots ago.

journalctl -b -2

journalctl --list-boots — List all available boot sessions with timestamps.

journalctl --list-boots

Output Formats

journalctl -o short — Default syslog-style output.

journalctl -o short -n 10

journalctl -o short-precise — Syslog-style with microsecond precision.

journalctl -o short-precise -n 10

journalctl -o short-iso — Syslog-style with ISO 8601 timestamps.

journalctl -o short-iso -n 10

journalctl -o verbose — Show all fields for each entry.

journalctl -o verbose -n 5

journalctl -o json — Output in JSON format (one object per line).

journalctl -o json -n 5

journalctl -o json-pretty — Output in pretty-printed JSON.

journalctl -o json-pretty -n 5

journalctl -o cat — Show only the message text (no metadata).

journalctl -u nginx -o cat -n 20

journalctl -o export — Binary export format for journalctl --import.

journalctl -o export > journal.export

Search & Grep

journalctl -g PATTERN — Filter entries by a regular expression pattern (grep-like).

journalctl -g 'error|fail'

journalctl -g PATTERN --case-sensitive=no — Case-insensitive regex search.

journalctl -g 'timeout' --case-sensitive=no

journalctl | grep PATTERN — Pipe through grep for traditional text matching.

journalctl --no-pager | grep 'Failed password'

Disk Usage & Maintenance

journalctl --disk-usage — Show how much disk space the journal occupies.

journalctl --disk-usage

journalctl --vacuum-size=SIZE — Remove old entries until the journal is below SIZE. Destructive: deleted logs are gone for good.

sudo journalctl --vacuum-size=500M

journalctl --vacuum-time=TIME — Remove entries older than TIME. Destructive.

sudo journalctl --vacuum-time=30d

journalctl --vacuum-files=N — Keep only the N most recent journal files; older ones are deleted. Destructive.

sudo journalctl --vacuum-files=5

journalctl --rotate — Force rotation of journal files (close the active file, start a new one) – a prerequisite for vacuuming right away.

sudo journalctl --rotate

journalctl --verify — Verify the integrity of journal files.

journalctl --verify

Common Patterns

journalctl -u nginx -p err --since today — Today's errors from nginx.

journalctl -u nginx.service -p err --since today

journalctl -u sshd -g 'Failed password' --since '1 hour ago' — Failed SSH login attempts in the last hour.

journalctl -u sshd.service -g 'Failed password' --since '1 hour ago'

journalctl -p err -b --no-pager — All errors since current boot without pager.

journalctl -p err -b --no-pager

journalctl -u UNIT -o json --no-pager | jq . — Parse service logs as JSON with jq.

journalctl -u nginx -o json --no-pager -n 5 | jq .

journalctl -k -p err -b — Kernel errors from the current boot.

journalctl -k -p err -b

journalctl --since '5 min ago' -f — Show last 5 minutes of logs and continue following.

journalctl --since '5 min ago' -f

Conclusion

journalctl turns scattered log files into a single, searchable source: with -u, --since, -p and -f you narrow an incident down in seconds, while -b and -k take you straight to boot and kernel messages, and -x adds explanatory hints for many systemd entries. To read other users' or system-wide logs you need to be in the adm or systemd-journal group (or use sudo); whether the journal survives reboots depends on Storage=persistent and an existing /var/log/journal directory. Be careful with --vacuum-size, --vacuum-time, --vacuum-files and --rotate: these commands permanently delete or discard old entries – handy for freeing disk space, but never run them on a hunch while you still need the logs for analysis.