cheatsheet

journalctl Command in Linux: View, Filter, and Troubleshoot System Logs

journalctl reads logs collected by systemd-journald — kernel messages, service output, boot sessions, and syslog traffic in one queryable journal. Filter by unit, time, priority, boot, and process fields without hunting separate files under /var/log.

Published

Updated

Read time 9 min read

Reviewed byDeepak Prasad

journalctl Command in Linux: View, Filter, and Troubleshoot System Logs
About journalctl reads logs collected by systemd-journald — kernel messages, service output, boot sessions, and syslog traffic in one queryable journal. Filter by unit, time, priority, boot, and process fields without hunting separate files under /var/log.
Tested on Ubuntu 25.04 (Plucky Puffin); systemd 257.4; kernel 7.0.0-27-generic
Package systemd
Man page journalctl(1)
Privilege none / sudo for full system journal
Distros

systemd-based distros (Fedora, RHEL 7+, Ubuntu 16.04+, Debian 8+, Arch, …).

Plain-text syslog workflows: traditional files under /var/log and rsyslog.
Related guide

journalctl — quick reference

Basic viewing

Open the system journal, limit line count, or skip the pager for scripts.

When to use Command
Show the system journal (pager opens by default) journalctl
Print the last N lines without scrolling the whole journal journalctl -n 100
Newest entries first journalctl -r -n 50
Send output straight to the terminal (no less) journalctl --no-pager -n 20
Follow new entries like tail -f journalctl -f

Boot sessions

Inspect logs from the current boot, a previous boot, or list boot IDs.

When to use Command
List recorded boots with offsets and IDs journalctl --list-boots
Logs since the current boot only journalctl -b
Logs from the previous boot (-1) journalctl -b -1
Kernel messages from the current boot journalctl -k -b

Filter by service and time

Narrow output to one unit or a time window. On Ubuntu 24.04+, the SSH unit is often ssh.service, not sshd.

When to use Command
Logs for one systemd unit journalctl -u ssh.service
Unit logs from the current boot journalctl -u nginx.service -b
Entries since the start of today journalctl --since today
Relative window (last hour) journalctl --since "1 hour ago"
Fixed start and end timestamps journalctl --since "2026-07-01 10:00" --until "2026-07-01 11:00"

Priority and field filters

Match severity levels or journal fields such as _PID and executable path.

When to use Command
Errors from the current boot journalctl -b -p err
Warning through critical range journalctl -p warning..crit
Messages from one process ID journalctl _PID=1234
Messages from a binary path journalctl /usr/sbin/sshd

Output format and inspection

Change how lines render or export structured data.

When to use Command
One-line short format (default in many configs) journalctl -o short -n 10
ISO timestamps on each line journalctl -o short-iso -n 10
Full field metadata per entry journalctl -o verbose -n 3
JSON for scripts or log forwarders journalctl -o json -n 5
Add catalog explanations when available journalctl -x -n 10

Journal maintenance

Check disk use and trim old archived journals. Vacuum commands modify stored logs — run only when retention policy requires it.

When to use Command
Show total journal disk usage journalctl --disk-usage
Drop archived journals older than seven days sudo journalctl --vacuum-time=7d
Shrink journals until total size is below 500 MB sudo journalctl --vacuum-size=500M
Keep only the five newest journal files sudo journalctl --vacuum-files=5

journalctl — command syntax

Synopsis from journalctl --help on Ubuntu 25.04 (systemd 257):

text 
journalctl [OPTIONS...] [MATCHES...]

Matches are field predicates such as _SYSTEMD_UNIT=ssh.service or executable paths. Persistent journals live under /var/log/journal when enabled; volatile journals use /run/log/journal.

journalctl — command examples

Essential Last lines and reverse order

Start troubleshooting by reading recent events instead of the entire journal. -n limits count; -r shows newest first.

bash 
journalctl -n 5 --no-pager

Sample output:

text 
Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session closed for user root
Jul 01 18:06:54 server1 usermod[17682]: change user 'usermodlab3' home from '/home/usermodlab3' to '/opt/usermodlab3_home'
Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)
Jul 01 18:06:54 server1 sudo[17679]: pam_unix(sudo:session): session closed for user root
Jul 01 18:06:54 server1 sudo[17679]: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)

Newest-first view:

bash 
journalctl -n 3 -r --no-pager

Sample output:

text 
Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session closed for user root
Jul 01 18:06:54 server1 usermod[17682]: change user 'usermodlab3' home from '/home/usermodlab3' to '/opt/usermodlab3_home'
Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)

Use --no-pager in scripts so output is not piped through less.

Essential Service unit logs — ssh.service on Ubuntu

Filter by unit name when a daemon misbehaves. Ubuntu ships ssh.service; older docs may say sshd.

bash 
journalctl -u ssh.service -n 3 --no-pager

Sample output:

text 
Jul 01 17:35:28 server1 sshd-session[4387]: Accepted password for golinuxcloud from 10.0.2.2 port 59071 ssh2
Jul 01 17:35:28 server1 sshd-session[4387]: pam_unix(sshd:session): session opened for user golinuxcloud(uid=1000) by golinuxcloud(uid=0)

List units if you are unsure of the name:

List loaded units or installed unit files with systemctl list-units; the systemctl command filters by state, type, and failed services.

bash 
systemctl list-units --type=service --state=running | grep -i ssh
Common List boots and read previous boot

Boot offsets from --list-boots feed -b. Zero is the running boot; -1 is the one before it.

bash 
journalctl --list-boots | tail -3

Sample output:

text 
-2 be4ac1bc5ef54219bd97a5fbd285dd82 Wed 2026-07-01 08:54:24 IST Wed 2026-07-01 15:31:10 IST
 -1 1cf54d68c0ad4ed991c3184036e0043f Wed 2026-07-01 15:30:36 IST Wed 2026-07-01 17:33:41 IST
  0 eb6453538d0841eb8fdc238594229fa7 Wed 2026-07-01 17:34:26 IST Wed 2026-07-01 18:06:54 IST

Errors from the previous boot:

bash 
journalctl -b -1 -p err --no-pager | head -5
Common Time filters — today and last hour

Time expressions accept today, yesterday, and relative phrases such as "1 hour ago".

bash 
journalctl --since today --no-pager | wc -l
journalctl --since "1 hour ago" -n 2 --no-pager

Sample output (line count varies by host):

text 
14502
Jul 01 17:35:28 server1 sshd-session[4387]: Accepted password for golinuxcloud from 10.0.2.2 port 59071 ssh2
Jul 01 17:35:28 server1 sshd-session[4387]: pam_unix(sshd:session): session opened for user golinuxcloud(uid=1000) by golinuxcloud(uid=0)

Combine with -u to see one service during an incident window.

Common Priority filter and kernel ring

-p accepts a single level or a range. -k restricts to kernel messages — similar to dmesg but boot- and time-aware.

bash 
journalctl -b -p err --no-pager | head -3
journalctl -k -n 2 --no-pager

Sample output:

text 
Jul 01 17:34:26 server1 systemd-udevd[343]: /usr/lib/udev/rules.d/90-alsa-restore.rules:16 GOTO="alsa_restore_std" has no matching label, ignoring.
Jul 01 17:34:27 server1 kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* vmwgfx seems to be running on an unsupported hypervisor.
Jul 01 18:01:27 server1 kernel: workqueue: e1000_watchdog [e1000] hogged CPU for >10000us 4 times, consider switching to WQ_UNBOUND
Jul 01 18:01:29 server1 kernel: workqueue: e1000_watchdog [e1000] hogged CPU for >10000us 5 times, consider switching to WQ_UNBOUND
Advanced Verbose metadata and JSON export

-o verbose prints structured fields for deep dives. -o json suits pipelines and log shippers.

bash 
journalctl -n 1 -o verbose --no-pager | head -12

Sample output:

text 
Wed 2026-07-01 18:06:54.405288 IST [s=7599c31c0c1f4f2bae82229b69b0b7b9;i=129d1;…]
    _HOSTNAME=server1
    PRIORITY=6
    _UID=0
    _GID=0
    SYSLOG_IDENTIFIER=sudo
    MESSAGE=pam_unix(sudo:session): session closed for user root

One JSON object per line:

bash 
journalctl -n 1 -o json --no-pager

Sample output (truncated):

text 
{"PRIORITY":"6","_HOSTNAME":"server1","SYSLOG_IDENTIFIER":"sudo","MESSAGE":"pam_unix(sudo:session): session closed for user root",…}
Advanced Disk usage — read-only check

Check how much space journals consume before planning vacuum. This command is read-only.

bash 
journalctl --disk-usage

Sample output:

text 
Archived and active journals take up 149.7M in the file system.

If policy requires trimming, use --vacuum-time or --vacuum-size with sudo during a maintenance window — those delete archived data.

journalctl — when to use / when not

Use journalctl when Use something else when
The host runs systemd and you need one tool for kernel, service, and boot logs The system uses syslog-only files → grep / tail on /var/log/syslog or /var/log/messages
You want filters by unit, boot ID, priority, or time without writing scripts You need a quick kernel ring buffer snapshot → run dmesg
You are correlating service failures after reboot (-b, -u) You are on embedded firmware without journald
You export JSON for monitoring You only need HTTP/API debugging → curl
You must enforce journal retention on disk Edit /etc/systemd/journald.conf for permanent limits, not only vacuum

journalctl vs traditional log files

journalctl (journald) /var/log text files
Storage Binary journal with indexed fields Plain text, often rotated by logrotate
Query -u, -b, --since, _PID=, priorities grep, awk, tail
Boot correlation Built-in boot IDs and offsets Depends on syslog configuration
Default on Modern systemd distros Still present on many hosts alongside journald
Tools journalctl only tail, less, rsyslog forwarding

Many hosts keep both journald and rsyslog; know which source your runbook expects.

Command One line
Beginner's guide to systemd Start, stop, and inspect units you filter with -u
dmesg Kernel ring buffer without journal filters
tail Follow plain-text log files
grep Search lines when you already exported or use syslog files

Browse the full index in our Linux commands reference.

journalctl — interview corner

What is journalctl used for?

journalctl is the front end for logs stored by systemd-journald. One command can show kernel lines, daemon stdout/stderr, authentication events, and boot records. Filters include unit name (-u), boot session (-b), priority (-p), and time (--since / --until).

Persistent storage is under /var/log/journal when enabled; otherwise logs may be volatile in /run/log/journal and lost on reboot.

A strong answer is:

"journalctl queries the systemd journal — kernel, services, and boot logs in one place. I filter by unit, time, priority, and boot ID instead of grepping dozens of files."

How do you follow logs in real time with journalctl?

Use -f (follow), like tail -f. Combine with -u to watch one service:

bash 
journalctl -u nginx.service -f

Press Ctrl+C to stop. Add -n 50 to print recent history before following new lines.

A strong answer is:

"journalctl -f follows new entries; I add -u unit for one daemon and -n for context before the follow loop."

How do you view logs from the previous boot?

Run journalctl --list-boots to see offsets. 0 is the current boot; -1 is the previous session.

bash 
journalctl -b -1 -p err --no-pager

You can also pass a boot ID from the list instead of a numeric offset.

A strong answer is:

"I list boots, then journalctl -b -1 for the prior session — often with -p err to find why the host rebooted."

Where does journald store logs?

Volatile journals live in /run/log/journal (RAM, cleared on reboot). Persistent journals use /var/log/journal when that directory exists and Storage= in journald.conf allows it.

Check footprint with:

bash 
journalctl --disk-usage

A strong answer is:

"Volatile in /run/log/journal; persistent in /var/log/journal when configured. I check disk-usage and journald.conf retention before vacuuming."

Why does journalctl say Permission denied?

Non-privileged users may see only their own user journal. The full system journal usually requires root or membership in systemd-journal, adm, or wheel depending on distro policy.

bash 
sudo journalctl -b -p err

A strong answer is:

"Full system logs need root or systemd-journal group. User journals work without sudo; I use sudo for host-wide incidents."

Troubleshooting

Symptom Likely cause Fix
No logs after reboot Volatile storage only Create /var/log/journal, set Storage=persistent in journald.conf, restart systemd-journald
Permission denied Insufficient privileges sudo journalctl or add user to systemd-journal / adm
-u sshd shows nothing Unit name differs systemctl list-units | grep ssh — Ubuntu may use ssh.service
Pager hides script output Default pager enabled Add --no-pager or set SYSTEMD_PAGER=
Huge disk use Long retention defaults journalctl --disk-usage, then planned --vacuum-size or config limits
--vacuum-* not allowed Missing privileges Run vacuum commands with sudo
Empty time filter Clock skew or wrong timezone Widen window; try --utc for UTC timestamps
grep on binary journal path fails Journal is not a text file Use journalctl filters or -o cat, not grep on /var/log/journal/*

References

Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.

Related Articles

system-administration

How to enable persistent logging in systemd-journald without reboot

Enable persistent logging in systemd-journald by changing storage type to persistent in journald.conf to store …

4 min readcheatsheet

hostnamectl Command in Linux: Syntax, Options & Practical Examples (systemd)

On systemd-based Linux, hostnamectl queries and changes the static, transient, and pretty hostnames plus …

10 min readcheatsheet

systemctl Command in Linux: Syntax, Options & Practical Examples (systemd)

systemctl is the main control tool for systemd on modern Linux. It lists units, shows service status, reads …

10 min read