journalctlQuery systemd's journal: service, boot and kernel logs
journalctl reads the systemd journal, which collects stdout and stderr of every service, syslog messages and kernel messages in one indexed store. You filter by unit, time, priority or boot, follow logs live, and manage how much disk the journal uses.
journalctl [OPTIONS] [MATCHES]...Users report 502s. Look at nginx's recent log entries, then watch new ones while you reproduce the problem.
journalctlThe reader for the binary journal files in /var/log/journal (or /run/log/journal).
systemd-journald collects from several sources: the stdout and stderr streams of every service (systemd connects them to a socket at start), the syslog socket /dev/log, the native journal API (sd_journal_send) and the kernel ring buffer (/dev/kmsg). It stores each message as a structured entry with trusted fields it adds itself, such as _PID, _UID, _SYSTEMD_UNIT, _BOOT_ID and _HOSTNAME, plus MESSAGE and PRIORITY. Entries are written to indexed binary files in /var/log/journal/<machine-id>/ (persistent) or /run/log/journal (memory only, lost at reboot). journalctl reads those files directly and uses the field indexes, so -u nginx or _PID=1234 doesn't scan the whole log. Size is bounded by SystemMaxUse (default 10% of the filesystem, capped at 4G) in journald.conf. Files are rotated and old ones deleted automatically, and --vacuum-* deletes archived files on demand. Non-root users see only their own entries unless they're in the adm or systemd-journal group.
-u UNITEntries for one unit (repeat for several)-fFollow new entries-n NLast N entries (default 10 with -n alone)--since / --untilTime window: '09:00', 'yesterday', '-1h'-p PRIOPriority filter: emerg alert crit err warning notice info debug-b [N]This boot, or -b -1 for the previous one-kKernel messages only (like dmesg, but kept across boots)-xAdd explanation text from the message catalog-eJump to the end in the pager-g PATTERNGrep MESSAGE with a regular expression-o short-iso|json|catOutput format--no-pagerPrint straight to stdout (scripts, pipes)--list-bootsBoots recorded in the journal--disk-usage / --vacuum-size=Journal size / delete archived files down to a sizejournalctl | grep nginxIt decodes the entire journal and pipes it through grep, which is slow, and it also matches unrelated lines that mention nginx.
journalctl -u nginx --since todayExpecting yesterday's boot logs with journalctl -b -1 on a fresh Ubuntu cloud imageIf /var/log/journal doesn't exist, the journal is volatile (in /run) and lost at reboot.
sudo mkdir -p /var/log/journal && sudo systemctl restart systemd-journald # or Storage=persistentsudo rm /var/log/journal/*/*.journal to free spaceDeleting files journald has open leaves the space in use and can corrupt the active file.
sudo journalctl --vacuum-size=500M (or --vacuum-time=7d)Using -f in a script or cron job-f never exits, so the script hangs forever.
journalctl -u app --since -5m --no-pagerTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox is a container without journald. Write the command that shows the last 50 lines of the ssh service's log, without a pager.
Write the command that shows only errors (and worse) from the current boot.
Write the command that follows nginx's log, starting with entries from the last 10 minutes.
The sandbox has classic log files instead. Find the ERROR lines from /var/log/app/app.log, as you would with journalctl -p err for a service.
journalctlQuery systemd's journal: service, boot and kernel logs
journalctl reads the systemd journal, which collects stdout and stderr of every service, syslog messages and kernel messages in one indexed store. You filter by unit, time, priority or boot, follow logs live, and manage how much disk the journal uses.
journalctl [OPTIONS] [MATCHES]...Users report 502s. Look at nginx's recent log entries, then watch new ones while you reproduce the problem.
journalctlThe reader for the binary journal files in /var/log/journal (or /run/log/journal).
systemd-journald collects from several sources: the stdout and stderr streams of every service (systemd connects them to a socket at start), the syslog socket /dev/log, the native journal API (sd_journal_send) and the kernel ring buffer (/dev/kmsg). It stores each message as a structured entry with trusted fields it adds itself, such as _PID, _UID, _SYSTEMD_UNIT, _BOOT_ID and _HOSTNAME, plus MESSAGE and PRIORITY. Entries are written to indexed binary files in /var/log/journal/<machine-id>/ (persistent) or /run/log/journal (memory only, lost at reboot). journalctl reads those files directly and uses the field indexes, so -u nginx or _PID=1234 doesn't scan the whole log. Size is bounded by SystemMaxUse (default 10% of the filesystem, capped at 4G) in journald.conf. Files are rotated and old ones deleted automatically, and --vacuum-* deletes archived files on demand. Non-root users see only their own entries unless they're in the adm or systemd-journal group.
-u UNITEntries for one unit (repeat for several)-fFollow new entries-n NLast N entries (default 10 with -n alone)--since / --untilTime window: '09:00', 'yesterday', '-1h'-p PRIOPriority filter: emerg alert crit err warning notice info debug-b [N]This boot, or -b -1 for the previous one-kKernel messages only (like dmesg, but kept across boots)-xAdd explanation text from the message catalog-eJump to the end in the pager-g PATTERNGrep MESSAGE with a regular expression-o short-iso|json|catOutput format--no-pagerPrint straight to stdout (scripts, pipes)--list-bootsBoots recorded in the journal--disk-usage / --vacuum-size=Journal size / delete archived files down to a sizejournalctl | grep nginxIt decodes the entire journal and pipes it through grep, which is slow, and it also matches unrelated lines that mention nginx.
journalctl -u nginx --since todayExpecting yesterday's boot logs with journalctl -b -1 on a fresh Ubuntu cloud imageIf /var/log/journal doesn't exist, the journal is volatile (in /run) and lost at reboot.
sudo mkdir -p /var/log/journal && sudo systemctl restart systemd-journald # or Storage=persistentsudo rm /var/log/journal/*/*.journal to free spaceDeleting files journald has open leaves the space in use and can corrupt the active file.
sudo journalctl --vacuum-size=500M (or --vacuum-time=7d)Using -f in a script or cron job-f never exits, so the script hangs forever.
journalctl -u app --since -5m --no-pagerTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox is a container without journald. Write the command that shows the last 50 lines of the ssh service's log, without a pager.
Write the command that shows only errors (and worse) from the current boot.
Write the command that follows nginx's log, starting with entries from the last 10 minutes.
The sandbox has classic log files instead. Find the ERROR lines from /var/log/app/app.log, as you would with journalctl -p err for a service.