View and filter logs collected by systemd-journald.
journalctl reads the systemd journal: a centralized log store used on many modern Linux systems. It lets you inspect boot logs, service logs, kernel messages, recent errors, and much more.
# Show all journal entries journalctl # Show newest entries first-like paging behavior via tailing journalctl -e # Follow logs live journalctl -f
-b Show current boot logs -b -1 Show previous boot logs -u UNIT Show logs for a systemd service unit -f Follow logs live -e Jump to end of journal -n 50 Show last 50 lines -p err Show only a priority level or higher -k Kernel messages only --since TIME Show entries since time --until TIME Show entries until time -x Add explanatory help text on some entries -r Reverse order (newest first) --no-pager Print directly without pager -o short Output format -o json JSON output
0 emerg System is unusable 1 alert Action must be taken immediately 2 crit Critical condition 3 err Error condition 4 warning Warning condition 5 notice Normal but significant 6 info Informational 7 debug Debug-level messages
A common filter is -p warning or -p err.
# 1) Show logs for current boot journalctl -b
# 2) Show logs from previous boot journalctl -b -1
# 3) Follow logs live journalctl -f
# 4) Follow a specific service journalctl -u sshd -f
# 5) Show last 100 lines journalctl -n 100
# 6) Show only errors and above journalctl -p err
# 7) Show kernel messages journalctl -k
# 8) Show logs since this morning journalctl --since today
# 9) Show logs in a time range journalctl --since "2026-04-01 08:00:00" --until "2026-04-01 10:00:00"
# 10) Show service logs for NetworkManager journalctl -u NetworkManager
# 11) Show newest entries first journalctl -r -n 50
# 12) Disable pager for scripting journalctl -u sshd --no-pager
# Investigate why a service failed journalctl -u nginx -b
# Check only warnings and errors from current boot journalctl -b -p warning
# Watch logs while restarting a service in another terminal journalctl -u httpd -f
# Look at kernel messages from previous boot journalctl -k -b -1
# Search recent logs for a keyword journalctl --since "1 hour ago" | grep -i timeout
# Show disk-space usage of the journal journalctl --disk-usage
# Vacuum old journal logs by size sudo journalctl --vacuum-size=500M
# Vacuum logs older than 14 days sudo journalctl --vacuum-time=14d
sshd, ssh, NetworkManager, httpd, apache2, etc.journalctl --list-boots to see available boot records.-p err means error and more severe, not only errors.less by default unless you use --no-pager.# Good troubleshooting sequence: journalctl --list-boots journalctl -b -p warning journalctl -u your-service-name -b journalctl -u your-service-name -f
That gives you: available boots, high-priority messages, service-specific history, then live follow mode.
Traditional Unix and Linux logging centered around plain-text log files in /var/log/ and tools like syslog. As systems using systemd became common, the journal provided a centralized, queryable log system with richer metadata.
journalctl is itself the modern log viewer for systemd-based Linux systems. Traditional companions or alternatives include dmesg for kernel ring buffer messages and direct inspection of files under /var/log/.