journalctl Explained: How to Read and Filter systemd Logs.

On most modern Linux servers, services log to the systemd journal. journalctl is the tool for reading it, and a handful of options turn thousands of lines into the few you need.

Key takeaways

• journalctl -u nginx shows one service; -f follows new lines live.
• --since and --until narrow by time; -p err shows only errors and worse.
• -b limits output to the current boot, -b -1 to the previous one.
• The journal may be stored only in memory - enable persistent storage to keep logs after reboot.
• Use --vacuum-size or SystemMaxUse to keep the journal from filling the disk.

The basics

journalctl                 # everything, oldest first, in a pager
journalctl -r              # newest first
journalctl -n 100          # last 100 lines
journalctl -f              # follow new entries live (like tail -f)

Reading the full journal usually needs root or membership in the systemd-journal group.

Filtering by service

journalctl -u nginx
journalctl -u nginx -u php-fpm      # several units together
journalctl -u myapp -f              # follow one service

If a unit has a different name than you expect, list them with systemctl list-units --type=service.

Filtering by time

journalctl --since "2026-10-18 02:00" --until "2026-10-18 03:30"
journalctl --since "1 hour ago"
journalctl --since today
journalctl --since yesterday --until today

Combine with a unit to answer "what did the app log around the outage?":

journalctl -u myapp --since "02:50" --until "03:10"

Filtering by priority

Journal priorities follow the syslog levels:

journalctl -p err -b         # errors and worse since boot
journalctl -p warning..err   # a range

Filtering by boot

journalctl --list-boots
journalctl -b          # current boot
journalctl -b -1       # previous boot - useful after an unexpected restart
journalctl -k -b -1    # kernel messages from the previous boot (out-of-memory, disk errors)

Other useful filters

journalctl _PID=4211
journalctl _COMM=sshd
journalctl -g "timeout|refused"       # grep the message text (newer systemd)
journalctl -u myapp -o json-pretty    # every field, structured
journalctl -u myapp -o cat            # message text only

Keeping logs after reboot

On some distributions the journal lives in /run and disappears at reboot - exactly when you need it most. Make it persistent:

sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald

Or set Storage=persistent in /etc/systemd/journald.conf.

Controlling disk usage

journalctl --disk-usage
sudo journalctl --vacuum-size=1G     # shrink to 1 GB
sudo journalctl --vacuum-time=14d    # drop entries older than 14 days

For a permanent limit, set SystemMaxUse=1G in journald.conf.

From logs to alerts

The journal tells you what happened on one server. For incidents, pair it with:

• an external uptime monitor that tells you when users are affected,
• central log collection so you can search all servers at once,
• heartbeat checks for timers and scheduled jobs.

Frequently asked questions

• Why don't I see older logs?

  +

  Either the journal isn't persistent (logs vanished at reboot) or it was rotated by size or time limits. Check journalctl --list-boots and journalctl --disk-usage.

• How do I see logs of a service that keeps restarting?

  +

  journalctl -u name -n 200 --no-pager shows the last lines across restarts. systemctl status name also shows the exit code and the most recent lines.

• Does journalctl replace /var/log files?

  +

  On many systems both exist: rsyslog may still write text files such as /var/log/syslog from the journal. Either works; the journal has richer filtering.