📜
journalctl cheat sheet
journalctl reads the systemd journal, the log store used by most modern Linux systems. Add sudo if you are not in the systemd-journal group.
Click any command to copy it.
Everyday use
| Command | What it does |
|---|---|
journalctl -u NAME | Show logs for one service. |
journalctl -u NAME -f | Follow a service's logs live, like tail -f. |
journalctl -n 100 | Show the last 100 lines. |
journalctl -f | Follow all new log entries. |
journalctl -r | Show newest entries first. |
journalctl --no-pager | Print without the pager, handy for piping. |
journalctl -u a -u b | Combine logs from several units. |
Filter by time and boot
| Command | What it does |
|---|---|
journalctl --since "1 hour ago" | Entries from the last hour. |
journalctl --since today | Entries since midnight. |
journalctl --since "2026-01-01 08:00" --until "2026-01-01 09:00" | Entries within a time window. |
journalctl -b | Entries from the current boot. |
journalctl -b -1 | Entries from the previous boot. |
journalctl --list-boots | List the boots stored in the journal. |
Filter by priority and content
| Command | What it does |
|---|---|
journalctl -p err | Only errors and worse (emerg, alert, crit, err). |
journalctl -p warning -b | Warnings and worse since boot. |
journalctl -k | Kernel messages only (like dmesg). |
journalctl -g "timeout" | Filter messages matching a regular expression. |
journalctl _PID=1234 | Entries from one process ID. |
journalctl -o json-pretty | Output entries as formatted JSON. |
Disk usage and cleanup
| Command | What it does |
|---|---|
journalctl --disk-usage | Show how much space the journal uses. |
journalctl --vacuum-time=2weeks | Destructive: Delete journal entries older than two weeks. |
journalctl --vacuum-size=500M | Destructive: Shrink the journal to at most 500 MB by deleting the oldest entries. |
journalctl --verify | Check journal files for corruption. |
Frequently asked questions
Why do I see no logs for my service?
Persistent storage may be disabled, or you may lack permission. Run with sudo, and check that /var/log/journal exists if you need logs to survive reboots.
How do I limit journal size permanently?
Set SystemMaxUse=500M in /etc/systemd/journald.conf and restart systemd-journald.