Managing System Logs with journald
1. Viewing System Logs
| Command | Description | Notes |
|---|---|---|
| journalctl | View all system logs | Default behavior shows logs from current boot |
| journalctl -f | Follow logs in real-time | Similar to tail -f |
| journalctl -u <unit> | View logs for a specific systemd unit | Replace <unit> with actual unit name (e.g., nginx.service) |
| journalctl -p <priority> | Filter logs by priority level | emerg, alert, crit, err, warning, notice, info, debug |
| journalctl --since "2024-01-01" | View logs since a specific date | Can also use relative times like --since "1 hour ago" |
| journalctl --until "2024-01-02" | View logs until a specific date | Can be combined with --since |
Note:
journalctl is part of systemd and provides a unified logging interface for Linux systems.2. Following Logs in Real-Time
| Command | Description | Options |
|---|---|---|
| journalctl | View and control the systemd journal | -f, --follow to follow the log output in real-time |
| journalctl | View logs from a specific service | -u <service> to filter logs by unit name |
| journalctl | View logs from a specific time | --since "2024-01-01 00:00:00" to filter logs from a specific time |
Note: The
-f or --follow option allows you to continuously monitor new log entries as they are added to the journal.
3. Filtering by Service
| Service Name | Filter Command | Description |
|---|---|---|
| systemd-journald | journalctl -u systemd-journald |
Filter logs for the systemd journal service itself |
| nginx | journalctl -u nginx |
Filter logs for the Nginx web server service |
| mysql | journalctl -u mysql |
Filter logs for the MySQL database service |
| postgresql | journalctl -u postgresql |
Filter logs for the PostgreSQL database service |
| docker | journalctl -u docker |
Filter logs for the Docker daemon service |
Example: Filter logs for a specific service
journalctl -u nginx --since "2024-01-01" --until "2024-01-02"Note: The
-u flag filters logs by unit name. Ensure the service is running and its unit file exists.4. Filtering by Time Range
| Filter Type | Description | Usage Example |
|---|---|---|
| --since | Display logs from a specific date/time onwards | journalctl --since "2024-01-01 00:00:00" |
| --until | Display logs up to a specific date/time | journalctl --until "2024-01-01 12:00:00" |
| --since --until | Combine both to filter logs within a time range | journalctl --since "2024-01-01" --until "2024-01-02" |
| --since "1 hour ago" | Filter logs from the last hour | journalctl --since "1 hour ago" |
| --since "today" | Filter logs from today | journalctl --since "today" |
| --since "yesterday" | Filter logs from yesterday | journalctl --since "yesterday" |
Example: Filtering logs between two specific timestamps
journalctl --since "2024-01-01 09:00:00" --until "2024-01-01 10:00:00"
Note: Time formats can be specified in various ways including ISO 8601 format, relative times like "1 hour ago", or keywords like "today" and "yesterday". The
journalctl command supports flexible time parsing.
5. Filtering by Priority
| Priority Level | Description | Corresponding Syslog Level | journald CLI Equivalent |
|---|---|---|---|
| 0 (EMERGENCY) | System is unusable | LOG_EMERG |
journalctl -p emerg |
| 1 (ALERT) | Action must be taken immediately | LOG_ALERT |
journalctl -p alert |
| 2 (CRITICAL) | Critical conditions | LOG_CRIT |
journalctl -p crit |
| 3 (ERROR) | Error conditions | LOG_ERR |
journalctl -p err |
| 4 (WARNING) | Warning conditions | LOG_WARNING |
journalctl -p warning |
| 5 (NOTICE) | Normal but significant condition | LOG_NOTICE |
journalctl -p notice |
| 6 (INFO) | Informational | LOG_INFO |
journalctl -p info |
| 7 (DEBUG) | Debug-level messages | LOG_DEBUG |
journalctl -p debug |
Note: The priority levels are inclusive; filtering with
-p err includes all logs at err, warning, notice, info, and debug levels.
6. Viewing Boot Logs
| Command | Description | Notes |
|---|---|---|
| journalctl --boot | View logs from the current boot | Default behavior when no arguments provided |
| journalctl --boot=0 | View logs from the current boot (explicit) | Same as above, more explicit |
| journalctl --boot=-1 | View logs from the previous boot | Use negative numbers to go back in time |
| journalctl --boot=last | View logs from the previous boot | Alternative syntax for previous boot |
| journalctl --boot=last-previous | View logs from boot before previous | Use for older boots |
Example: View boot logs with timestamp
journalctl --boot=0 --since "2026-01-01 00:00:00" --until "2026-01-01 01:00:00"Note: The
--boot option is useful for troubleshooting boot issues or analyzing system behavior during startup.7. Viewing Logs for Specific PID
| Option | Values | Description |
|---|---|---|
| --identifier | string |
Filter logs by process identifier (PID) |
| --since | timestamp |
Show logs since a specific time |
| --until | timestamp |
Show logs until a specific time |
Example: View logs for a specific PID with time range
journalctl --identifier=12345 --since="2025-04-01 00:00:00" --until="2025-04-01 01:00:00"8. Exporting Logs
| Method | Description | Example |
|---|---|---|
| journalctl --output=short | Exports logs in short format to stdout | journalctl --output=short |
| journalctl --output=json | Exports logs in JSON format for structured consumption | journalctl --output=json |
| journalctl --output=export | Exports logs in export format for archival or transfer | journalctl --output=export |
| journalctl --output=verbose | Exports logs with full details including timestamps and priority | journalctl --output=verbose |
Example: Exporting logs with a time range
journalctl --since="2025-01-01" --until="2025-01-02" --output=export > /var/log/filtered-logs.export
Note: The
--output=export format is compatible with systemd-journal-remote for remote log collection.
Warning: Large log sets may cause memory issues when exporting to stdout. Use redirection or filtering.
9. Configuring Journal Storage
| Option | Values | Description |
|---|---|---|
| Storage | persistent, volatile, auto, none |
Determines where logs are stored. persistent stores in /var/log/journal, volatile in /run/log/journal, auto uses persistent if available, none disables journaling. |
| Compress | yes, no |
Whether to compress log entries. Defaults to yes. |
| Seal | yes, no |
Enables sealing of journal files for integrity. Defaults to yes. |
| MaxFileSec | Time duration (e.g., 1month, 1week) |
Maximum time a journal file can exist before rotation. Defaults to 1month. |
| MaxRetentionSec | Time duration (e.g., 1month, 3months) |
Maximum time to retain journal files. Defaults to 1month. |
| KeepFree | Size (e.g., 1G, 500M) |
Minimum free space to keep on disk. Defaults to 100M. |
| MaxLevelStore | emerg, alert, crit, err, warning, notice, info, debug |
Maximum log level to store. Defaults to info. |
Example: Journal Storage Configuration
[Journal]
Storage=persistent
Compress=yes
Seal=yes
MaxFileSec=1month
MaxRetentionSec=3months
KeepFree=500M
MaxLevelStore=debug
Note: Configuration changes require restarting the systemd-journald service to take effect.
10. Clearing Journal Logs
| Command | Description | Notes |
|---|---|---|
| journalctl --disk-usage | Shows current disk usage of journal logs | Helps assess how much space is used by logs |
| journalctl --vacuum-size=100M | Reduces journal logs to maximum 100MB total size | Automatically removes oldest entries when limit is exceeded |
| journalctl --vacuum-time=1d | Removes logs older than 1 day | Useful for cleaning up old entries based on time |
| journalctl --rotate | Rotates the journal log files | Creates new log files and archives old ones |
| journalctl --flush | Flushes all pending log entries to disk | Ensures logs are written before clearing or rotation |
Note: These commands require root privileges or appropriate permissions to modify system logs.
11. Viewing Kernel Messages
| Command | Description | Notes |
|---|---|---|
| journalctl -k | View kernel messages | Shows all kernel log entries from the journal |
| journalctl -k -b | View kernel messages from current boot | Filters logs to only show entries from the current system boot |
| journalctl -k -b -1 | View kernel messages from previous boot | Displays logs from the last completed boot |
| journalctl -k --since "1 hour ago" | View kernel messages from last hour | Filters logs to only show entries within the specified time range |
| journalctl -k --until "2026-01-01 12:00:00" | View kernel messages until a specific time | Filters logs to only show entries before the specified timestamp |
Example: View kernel messages from last boot with timestamp
journalctl -k -b -1 --since "2026-01-01 10:00:00"
Note: Kernel messages are typically logged with priority levels (e.g.,
info, warning, error). Use -p to filter by priority.
Summary of Kernel Log Filtering Options
-k: Show only kernel messages-b: Show logs from current boot-b -1: Show logs from previous boot--since/--until: Filter logs by time range-p: Filter logs by priority level (e.g.,err,warn,info)
12. Searching Logs
| Option | Values | Description |
|---|---|---|
| journalctl | --since |
Filter logs from a specific date/time |
| journalctl | --until |
Filter logs until a specific date/time |
| journalctl | -p |
Filter by priority level (emerg, alert, crit, err, warning, notice, info, debug) |
| journalctl | --grep |
Filter logs by a regex pattern in the message field |
| journalctl | -u |
Filter logs by a specific unit (service) |
| journalctl | --output |
Set output format (short, json, json-pretty, export, cat) |
Note: Use
--no-pager to prevent output from being piped through a pager like less.