journalctl Linux Command
Queries and displays logs from the systemd journal.
What does journalctl do?
Queries and displays logs from the systemd journal.
Syntax
journalctl [options]Practical example
journalctl -u ssh -fQuestions about journalctl
How do I see all system logs?
Use `journalctl` to view all system logs from the systemd journal. This includes boot, service, and kernel messages.
How do I see logs for a specific service?
Use `journalctl -u service_name` to see logs only for that service. For example, `journalctl -u nginx`.
How do I follow logs in real time?
Use `journalctl -f` to follow all logs like tail -f. Use `journalctl -u service -f` to follow a specific service.
How do I see logs from the last boot?
Use `journalctl -b` to see logs from the current boot. Use `journalctl -b -1` for the previous boot.
How do I see logs since a specific time?
Use `journalctl --since '2024-01-01'` or `journalctl --since '1 hour ago'` to filter by time.
How do I see error messages only?
Use `journalctl -p err` to show only error-level messages and above. Priority levels: emerg, alert, crit, err, warning, notice, info, debug.
How do I see kernel logs with journalctl?
Use `journalctl -k` to see only kernel messages, equivalent to dmesg output.
How do I see logs for a failed service?
Use `journalctl -u service_name -b` or `systemctl status service_name` to see why a service failed.
Related Service Commands
serviceLegacy command to run SysV init scripts (works on both SysV and systemd).
systemctl startStarts a systemd service immediately.
systemctl list-unitsLists all loaded and active systemd units (services, mounts, sockets, etc.).
systemctl stopStops a running systemd service immediately.
systemctl statusShows the current status, recent logs, and PID of a systemd service.
systemctl restartStops and then starts a systemd service.