journalctl: read the systemd journal

Updated November 2026

On systemd-based Linux systems, services, the kernel and the boot process log to the journal. journalctl reads it and can filter by service, time, boot and priority far more precisely than searching through text files.

Examples

journalctl -u nginx                       # one service
journalctl -u nginx -b                    # one service, since the last boot
journalctl -u nginx -f                    # follow live (like tail -f)
journalctl -u nginx -n 50 --no-pager      # last 50 lines, without the pager
journalctl -b                             # everything since the last boot
journalctl -b -1                          # the previous boot (why did it crash?)
journalctl --list-boots
journalctl -p err -b                      # errors and worse since boot
journalctl --since "2026-11-02 08:00" --until "2026-11-02 09:00"
journalctl --since "1 hour ago"
journalctl --since yesterday -u cron
journalctl -k                             # kernel messages (like dmesg)
journalctl _UID=1000                      # messages from processes of user 1000
journalctl /usr/sbin/sshd                 # messages from one program
journalctl -g "Failed password"           # search with a pattern (grep option)
journalctl -u ssh -o cat                  # message text only
journalctl -u nginx -o json-pretty -n 1   # all fields of one entry

Priorities

-p takes a level and shows that level and everything more serious: emerg (0), alert, crit, err, warning, notice, info, debug (7). -p warning is a good daily check.

Keep logs across reboots

On some systems the journal lives only in memory (/run/log/journal) and is lost at reboot. To keep it, make sure /var/log/journal exists, or set Storage=persistent in /etc/systemd/journald.conf, then restart journald:

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

Disk space

journalctl --disk-usage
sudo journalctl --rotate --vacuum-size=500M   # archive current files, then delete the oldest until under 500 MB
sudo journalctl --vacuum-time=4weeks      # remove entries older than four weeks

For a permanent limit, set SystemMaxUse=1G in /etc/systemd/journald.conf.

Permissions

Normal users see only their own messages. Members of the systemd-journal group (and adm on Debian and Ubuntu) can read everything; otherwise use sudo.

Text log files

Some systems also run rsyslog, which copies journal messages to text files such as /var/log/syslog (Ubuntu; Debian before 12 or with rsyslog installed) or /var/log/messages (RHEL), and applications such as nginx write their own files in /var/log. Read those with tail, less and grep. To control services, see systemctl.