Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · process & service management

journalctl

read the system logs

journalctl queries the journal, where systemd collects everything services print, along with kernel and boot messages. Instead of opening files in /var/log you ask for one unit, one time range, or errors only.

A service failed? journalctl -u name -e shows the end of its log, where the reason is.

One service
-u NAME
the unit’s log only
Follow
-f
live, like tail -f
Time
--since, --until
"1 hour ago", "today"
Errors only
-p err
by priority

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashsystemd
$ journalctl -u nginx --since "10 min ago" --no-pager
1Sep 30 10:38:11 netflow systemd[1]: Starting nginx.service - A high performance web server...
2Sep 30 10:38:11 netflow nginx[5120]: nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
3Sep 30 10:38:11 netflow systemd[1]: nginx.service: Failed with result 'exit-code'.
4$ journalctl -p err -b --no-pager | tail -1
Sep 30 10:38:11 netflow systemd[1]: Failed to start nginx.service - A high performance web server.
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
One unit, the last ten minutes

Each line has the time, the host, the program and its process id, then the message.

2
The actual reason

nginx could not bind to port 80 because something else already has it. This line is what systemctl status hints at but cuts short.

3
systemd’s verdict

The service exited with an error, so the unit is marked failed.

4
Errors since boot

-p err keeps messages of priority error and worse; -b limits them to the current boot.

Switches

A switch changes how the command behaves. These are the ones used day to day; man journalctl lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-u UNIT
Show the log of one service.
-f
Follow: print new entries as they arrive.
-e
Jump to the end of the log.
-b
Only entries from the current boot. -b -1 is the previous boot.
-p LEVEL
Only this priority and worse: err, warning, info.
--since TIME
From this time: "today", "1 hour ago", "2026-09-30 09:00".
-n NUM
Show the last NUM lines.
-k
Kernel messages only.
--no-pager
Print directly instead of opening a pager.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

journalctl -f

Follows every log on the system live.

journalctl -u ssh -e

Opens one service’s log at its end.

journalctl -k -b

Kernel messages from this boot, like dmesg.

journalctl --disk-usage

Shows how much space the journal is taking.

In cybersecurity

The journal is the first place to look after anything unexpected.

Logins and sudo

"journalctl -u ssh" shows every accepted and failed login; "journalctl _COMM=sudo" shows who ran what as root.

Who may read it

Full access needs root or membership of the adm or systemd-journal group, because the logs contain user names, addresses and commands.

Logs on the same machine can be erased

An intruder with root can clear the journal. Forwarding logs to another host is what makes them trustworthy evidence.

Protocols it shows

Syslog

Read alongside

systemctlControls systemd services — start, stop, restart, enable at boot — and reports the state of each one.tailPrints the last lines of a file, and with -f keeps printing new lines as they are written.