journalctl Command in Linux: Query and Filter System Logs

journalctl queries logs collected by systemd-journald, the systemd logging daemon. It gives you structured access to kernel messages, service output, and authentication events from a single interface.

Unlike /var/log/syslog, which is plain text, the systemd journal stores structured metadata alongside each log entry, including unit name, PID, UID, and priority. This makes precise filtering possible without grepping through unstructured text.

How the journalctl Command Works in Linux

The syntax is:

bashjournalctl [OPTIONS] [MATCHES]

Without options, journalctl shows all logs from the oldest entry, piped through a pager (press q to exit). Common viewing options:

bashjournalctl -r          # newest entries firstjournalctl -e          # jump to end of logjournalctl -n 50       # last 50 linesjournalctl --no-pager  # print to terminal directly (required in scripts)

To stream new entries in real time, similar to tail -f:

bashjournalctl -f

Access permissions. Only root, members of the adm group, or members of the systemd-journal group can read system logs. Regular users can view their own session logs with --user. To grant log access without sudo:

bashsudo usermod -aG systemd-journal username

Filter Logs by Unit, Time, Priority, and Boot

Filter by systemd unit using -u. This is the most common filtering pattern:

bashjournalctl -u nginx             # all nginx logsjournalctl -u nginx -f          # follow nginx logs livejournalctl -u nginx -u php-fpm  # two units at oncejournalctl -u nginx -n 100 --no-pager

Filter by time with --since and --until. Both accept natural language expressions:

bashjournalctl --since "1 hour ago"journalctl --since "yesterday"journalctl --since "2026-02-01 10:00" --until "2026-02-01 12:00"journalctl -u nginx --since "1 hour ago"

Filter by priority with -p. Priority levels follow the syslog standard from 0 (emerg) to 7 (debug). Using -p err returns err and everything above it — emerg, alert, crit, and err:

bashjournalctl -p errjournalctl -p warning --since "1 hour ago"

Filter by boot session with -b. This is essential for diagnosing crashes, since the current boot has no logs from before the crash:

bashjournalctl -b               # current bootjournalctl -b -1            # previous bootjournalctl --list-boots     # all boot sessions with IDs and timestampsjournalctl -b -1 -p err     # errors from the previous boot

Kernel messages only with -k (equivalent to dmesg):

bashjournalctl -kjournalctl -k -p err -b -1  # kernel errors from previous boot

Search, Output Formats, and Managing Journal Size

Search log messages with -g, which accepts PCRE2 regular expressions:

bashjournalctl -g "failed"journalctl -u ssh -g "invalid user"

For complex matching, pipe to grep:

bashjournalctl -u nginx -n 500 --no-pager | grep -Ei "error|failed|timeout"

Filter by process fields. The journal stores structured metadata per entry. Query it directly with journal field matches:

bashjournalctl _COMM=sshd     # by process namejournalctl _UID=1000      # by user IDjournalctl _PID=1234      # by PID

Change output format with -o:

bashjournalctl -o short-iso    # ISO 8601 timestampsjournalctl -o json-pretty  # formatted JSON (useful for log shipping or scripting)journalctl -o cat          # message text only, no metadata

Manage journal disk usage. Journal files are stored in /var/log/journal/. Check and trim size:

bashjournalctl --disk-usagejournalctl --vacuum-size=500M   # trim archived logs to 500 MBjournalctl --vacuum-time=30d    # remove entries older than 30 days

For a permanent size limit, set SystemMaxUse=500M in /etc/systemd/journald.conf and restart systemd-journald. On distributions where the journal is stored in memory and lost on reboot, create /var/log/journal/ and set Storage=persistent in the same config file to enable persistence.

A practical troubleshooting workflow: start with systemctl status service, then journalctl -u service -p err -n 100 --no-pager to surface recent errors. For crashes, add -b -1 to inspect the previous boot session. Leave a comment below if you run into any issues.