journalctl
Processes and system
Usage
journalctl -u <unit> [-f]Reads the binary log systemd collects; without /var/log/journal the log is wiped at reboot, and `-u` needs the unit's exact name.
Common flags
| Flag | Meaning |
|---|---|
| -u <unit> | Only one unit. The name must match exactly. |
| -f | Follow new lines as they arrive, like tail -f. |
| -n 100 | The last 100 lines instead of the whole journal. |
| --since "1 hour ago" | Limit by time; --until does the other end. |
| -p err | Only this priority and worse (emerg, alert, crit, err, warning...). |
| -b / -b -1 | This boot only / the previous boot. |
| -k | Kernel messages only. |
| --no-pager | Print straight to stdout so you can pipe it. |
Examples
journalctl -u nginx -n 50 --no-pagerThe last fifty lines from one service.
journalctl -fu myappWatch a service live while you reproduce a bug.
journalctl --since "10 min ago" -p errOnly recent errors, from every unit.
What is running and what is eating the machine. Identifying it comes before killing it.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does journalctl do?
Reads the binary log systemd collects; without /var/log/journal the log is wiped at reboot, and `-u` needs the unit's exact name.
Q. How do I type it?
journalctl -u <unit> [-f] — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
8 are listed here; the full set is in man journalctl. This command sits under Processes and system.
Related commands
man page: man journalctl