Command library / journalctl

Query the systemd journal (system and service logs)

Reads the systemd journal — the central, structured log almost every modern Linux service writes to. -u scopes it to one service, -b to the current boot, -f follows new lines live like tail -f, and -p filters by minimum severity.

Usage

Options and flags

• -u, --unit UNIT

  only logs from this systemd service (e.g. sshd.service)

• -b, --boot

  only logs since the current boot

• -f, --follow

  follow the log live, like tail -f

• -p, --priority LEVEL

  minimum severity: emerg, alert, crit, err, warning, notice, info, debug

• -n, --lines N

  show only the last N lines

Examples

• journalctl -u sshd.service

  Every logged event for the SSH daemon.

• journalctl -u sshd.service -b

  SSH events since the machine last booted — rules out anything from before a restart.

• journalctl -f

  Watch new log lines appear live — leave it running while you reproduce an issue.

• journalctl -p err

  Only error-level and worse, across every service — a fast first look at a sick system.

Common mistakes

Related commands