journalctl Cheat Sheet: View & Filter systemd Logs

Q: How do I see logs from the previous boot?

journalctl -b -1 . If it says no persistent journal is available, create /var/log/journal and restart systemd-journald so logs survive reboots.

Q: How do I follow a service's log live?

journalctl -u nginx -f shows the last lines and keeps printing new ones, like tail -f .

Q: How do I clear or shrink journal logs?

sudo journalctl --vacuum-size=500M or --vacuum-time=2weeks deletes the oldest archived journal files. Set SystemMaxUse= in journald.conf for a permanent cap.

Q: Why can't I see all logs without sudo?

System logs are readable by root and members of the systemd-journal group (and adm or wheel on some distros). Without them you only see your own user's messages.

Most used

journalctl -u nginx -f                 # follow one service live
journalctl -u nginx -e                 # jump to the end of its log
journalctl -b -p err                   # errors since this boot
journalctl -b -1 -e                    # end of the previous boot (after a crash)
journalctl --since '1 hour ago'        # recent messages
journalctl -k                          # kernel messages (like dmesg)

journalctl reads the binary log written by systemd-journald. Output opens in less: use / to search, G to jump to the end and q to quit. Run with sudo (or join the systemd-journal group) to see all system messages. To control the services behind the logs, see the systemctl cheat sheet.

Viewing and following

Command	What it does
`journalctl`	Entire journal, oldest first
`journalctl -e`	Open the pager at the end
`journalctl -f`	Follow new messages (Ctrl+C to stop)
`journalctl -n 50`	Last 50 lines
`journalctl -r`	Newest first
`journalctl --no-pager`	Print everything, no pager (for pipes and scripts)
`journalctl -x`	Add explanatory help text to known messages
`journalctl -xeu nginx`	Explained, at the end, for one unit (what systemctl suggests after a failure)
`journalctl -q`	Hide informational header lines

Filter by unit, process and user

Command	What it does
`journalctl -u ssh`	Messages from one systemd unit
`journalctl -u nginx -u php-fpm`	Several units, interleaved by time
`journalctl -u 'docker*'`	Units matching a glob
`journalctl --user -u myapp`	Your own user service
`journalctl _PID=1234`	One process ID
`journalctl _UID=1000`	Everything logged by a user ID
`journalctl _COMM=sshd`	By executable name
`journalctl /usr/bin/sudo`	By executable path
`journalctl -t sudo`	By syslog identifier (tag)
`journalctl _SYSTEMD_UNIT=cron.service + _COMM=sudo`	`+` means OR between match groups
`journalctl -F _SYSTEMD_UNIT`	List all values a field has (here, every unit that logged)

Filter by boot and time

Command	What it does
`journalctl -b`	Current boot only
`journalctl -b -1`	Previous boot (`-2` the one before)
`journalctl --list-boots`	All recorded boots with IDs and time ranges
`journalctl --since today`	Since midnight
`journalctl --since yesterday --until today`	All of yesterday
`journalctl --since '2026-10-16 09:00' --until '2026-10-16 09:30'`	Exact time window
`journalctl -S -15m`	Last 15 minutes (`-S` = `--since`, `-U` = `--until`)
`journalctl -u nginx -b -S -1h`	Filters combine: unit, this boot, last hour

Filter by priority and content

Priorities: 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug. -p err shows err and everything more severe.

Command	What it does
`journalctl -p err`	Errors and worse
`journalctl -p warning -b`	Warnings and worse this boot
`journalctl -p 4..6`	A priority range (warning to info)
`journalctl -g 'timeout\|refused'`	Grep the message text (regex, case-insensitive if all lowercase)
`journalctl -g 'Out of memory' -k`	Find OOM-killer events (see Out of memory: Killed process)
`journalctl -k`	Kernel ring buffer messages for this boot
`journalctl -k -b -1 -p err`	Kernel errors from the previous boot (driver crashes, hangs)
`journalctl --facility=auth`	Syslog facility (auth, authpriv, cron, daemon…)

Output formats

Command	What it does
`journalctl -o short-iso`	ISO 8601 timestamps
`journalctl -o short-precise`	Microsecond timestamps
`journalctl -o cat`	Message text only, no metadata
`journalctl -o verbose`	Every field of every entry
`journalctl -o json-pretty -n 1`	Structured JSON (use `-o json` for one entry per line)
`journalctl --utc`	Show times in UTC
`journalctl --output-fields=MESSAGE,_PID -o json`	Only selected fields
`journalctl -b -o export > boot.journal`	Binary export format for transfer

Disk usage and maintenance

Command	What it does
`journalctl --disk-usage`	Space used by journal files
`sudo journalctl --vacuum-size=500M`	Delete oldest archived files until under 500 MB
`sudo journalctl --vacuum-time=2weeks`	Delete archived entries older than two weeks
`sudo journalctl --vacuum-files=5`	Keep at most 5 archived files
`sudo journalctl --rotate`	Close active files so vacuum can remove them
`sudo journalctl --flush`	Move logs from `/run` to persistent storage
`sudo journalctl --verify`	Check journal files for corruption
`journalctl -D /mnt/var/log/journal`	Read journal files from another system (e.g. from a live USB)
`journalctl --file=system.journal`	Read a single journal file

To cap the size permanently, create /etc/systemd/journald.conf.d/size.conf:

[Journal]
SystemMaxUse=500M
MaxRetentionSec=1month

sudo systemctl restart systemd-journald

Common recipes

Why did a service fail to start? (The step after Job for X.service failed.)

systemctl status myapp --no-pager -l
journalctl -xeu myapp --no-pager | tail -40

What happened just before the last crash or freeze?

journalctl -b -1 -n 100 --no-pager
journalctl -b -1 -p warning --no-pager | tail -50

Make the journal persistent so -b -1 works after reboots (already the default on Fedora, Arch and current Ubuntu/Debian; needed where /var/log/journal is missing):

sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald

Failed SSH logins today:

journalctl -u ssh -u sshd --since today -g 'Failed password|Invalid user' --no-pager

Errors per unit this boot, most frequent first:

journalctl -b -p err -o json --no-pager | jq -r '._SYSTEMD_UNIT // .SYSLOG_IDENTIFIER' | sort | uniq -c | sort -rn

Slow boot? Combine the journal with systemd-analyze (full walkthrough in fix slow boot on Ubuntu):

systemd-analyze blame | head
journalctl -b -u NetworkManager-wait-online --no-pager

Write your own message to the journal from a script:

echo "backup finished" | systemd-cat -t backup -p info
journalctl -t backup -n 5

Gotchas

No previous boots? If --list-boots shows only one entry, the journal is volatile (kept in /run, lost at shutdown). Create /var/log/journal as shown above, or set Storage=persistent.
Missing lines without sudo. As a normal user outside systemd-journal/adm/wheel, you see only your own messages and journalctl prints a hint about it.
Vacuum doesn't touch active files. --vacuum-* removes only archived files. Run --rotate first if usage barely drops.
-u misses some messages. Kernel messages or output from processes outside the unit's cgroup (e.g. a crash reported by the kernel) aren't tagged with the unit. Look at -k or the whole boot around the same time.
Unit names differ. SSH logs as ssh on Debian/Ubuntu and sshd on Fedora/Arch/openSUSE; passing both -u options is harmless.
rsyslog may also be running. Ubuntu and Mint usually install rsyslog too, so /var/log/syslog and /var/log/auth.log exist alongside the journal. Debian 12 and later, Fedora and Arch rely on the journal alone unless you install rsyslog.
Relative times need quotes. --since 1 hour ago fails; write --since '1 hour ago' or -S -1h.

Reference: journalctl(1), journald.conf(5). Background on units and the journal: systemd basics.

Frequently asked questions

How do I see logs from the previous boot?

journalctl -b -1. If it says no persistent journal is available, create /var/log/journal and restart systemd-journald so logs survive reboots.

How do I follow a service's log live?

journalctl -u nginx -f shows the last lines and keeps printing new ones, like tail -f.

How do I clear or shrink journal logs?

sudo journalctl --vacuum-size=500M or --vacuum-time=2weeks deletes the oldest archived journal files. Set SystemMaxUse= in journald.conf for a permanent cap.

Why can't I see all logs without sudo?

System logs are readable by root and members of the systemd-journal group (and adm or wheel on some distros). Without them you only see your own user's messages.

Spotted a mistake or a command that no longer works? Send a correction — pages are re-checked when reports come in.