System
journalctl
journalctl commands for systemd log management.
31 commands
Windows
MacOS
Linux
#logging
#linux
Basic Viewing
Show all journal entries
journalctl
Show the last 50 entries
journalctl -n 50
Follow new entries in real time
journalctl -f
Show entries in reverse chronological order
journalctl -r
Output without paging
journalctl --no-pager
Show logs from the current boot
journalctl -b
Show logs from the previous boot
journalctl -b -1
Filtering by Unit
Show logs for a specific service
journalctl -u nginx
Show logs for multiple services
journalctl -u nginx -u php-fpm
Service logs from today
journalctl -u nginx --since today
Show logs from a specific process ID
journalctl _PID=1234
Show logs from a specific user ID
journalctl _UID=1000
Time Filtering
Logs since a specific date
journalctl --since "2024-01-15"
Logs from the last hour
journalctl --since "1 hour ago"
Logs in a time range
journalctl --since "09:00" --until "12:00"
Logs from yesterday
journalctl --since yesterday --until today
Logs since exact timestamp
journalctl --since "2024-01-15 10:00:00"
Priority & Format
Show only error messages and above
journalctl -p err
Show warnings and above
journalctl -p warning
Output in formatted JSON
journalctl -o json-pretty
Output with ISO timestamps
journalctl -o short-iso
Show all metadata fields
journalctl -o verbose
Show only kernel messages
journalctl -k
Maintenance
Show journal disk usage
journalctl --disk-usage
Reduce journal to 500 MB
sudo journalctl --vacuum-size=500M
Remove entries older than 30 days
sudo journalctl --vacuum-time=30d
Force rotation of journal files
sudo journalctl --rotate
List all recorded boot sessions
journalctl --list-boots
Quick Commands
Follow logs for a specific service in real time
journalctl -u nginx -f
Show log entries from the last hour
journalctl --since "1 hour ago"
Show only error-level log messages and above
journalctl -p err