journalctl(1)
Query and display messages from the systemd journal.
Synopsis
journalctl [OPTION]... [MATCHES]Description
journalctl is used to query and display log messages recorded by systemd-journald, the system journal daemon. It can display logs from the entire system, specific services, or filtered by time, priority, and other criteria.
The journal stores structured log data in binary format, making it more powerful than traditional syslog while remaining efficient. By default, journalctl shows logs in reverse chronological order (newest first).
Common options
| Flag | What it does |
|---|---|
-u, --unit=UNIT | show logs for a specific systemd unit (service, socket, etc.) |
-f, --follow | follow journal in real-time, like tail -f |
-n, --lines=NUM | show the last NUM lines (default 10 when used with -f) |
-p, --priority=LEVEL | filter by priority: emerg, alert, crit, err, warning, notice, info, debug |
-b, --boot[=ID] | show logs from current boot or specified boot ID |
--since=DATETIME | show entries not older than date; accepts formats like '2024-01-15 10:30:00' or 'yesterday' |
--until=DATETIME | show entries not newer than specified date and time |
-o, --output=FORMAT | output format: short, short-iso, short-precise, json, cat (default is short) |
-e, --pager-end | jump to end of journal in the pager instead of showing the beginning |
--no-pager | do not pipe output into a pager |
-x, --catalog | augment log lines with message explanations from the message catalog |
-a, --all | show all fields including long data (without truncation) |
Examples
show all logs from the nginx service
journalctl -u nginx.serviceshow the last 20 lines of SSH service logs
journalctl -u ssh.service -n 20follow MySQL logs in real-time
journalctl -f -u mysql.serviceshow only ERROR and CRITICAL level messages from all services
journalctl -p errshow logs between two specific times
journalctl --since '2024-01-15 10:00:00' --until '2024-01-15 12:00:00'show logs from the previous boot
journalctl -b -1output logs as JSON and pipe to jq for parsing
journalctl -o json | jq .show logs from the bash executable
journalctl /usr/bin/bash