How to view system logs with journalctl

· Category: Linux

Short answer

journalctl queries the systemd journal, offering powerful filtering by unit, time, priority, and boot.

Steps

  1. View all logs:
journalctl
  1. Logs for a specific service:
journalctl -u nginx
  1. Follow real-time logs:
journalctl -f
  1. Logs since last boot:
journalctl -b
  1. Time range:
journalctl --since "2025-10-01" --until "2025-10-20"

Tips

  • journalctl --disk-usage shows journal size.
  • journalctl -p err filters by priority.
  • Persistent logging requires creating /var/log/journal.

Common issues

  • Empty output: the journal may be volatile or the service uses a different logger.
  • Very large journals: configure rotation with journald.conf.