journalctl Command in Linux: View, Filter, and Troubleshoot System Logs

Sep 6, 2019 Aug 5, 2026 Rohan Timalsina Deepak Prasad

Tested on	RHEL 10.2 (Coughlan)
Package	`systemd 257-23.el10_2.2`
Applies to	Ubuntu, Debian, Kali Linux, Linux Mint, Pop!_OS, Raspberry Pi OS, elementary OS, Zorin OS, Parrot OS, MX Linux, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream, Fedora, Arch Linux
Privilege	Normal user for your own journal; sudo or root for the full system journal, vacuum, and journald configuration
Man page	journalctl(1)
Scope	Query the systemd journal: recent output, units, boots, time windows, priorities, follow mode, disk usage, and vacuum. Does not replace every `/var/log` text file or deep journald architecture — see linked guides.
Related guides	systemd-journald logging systemctl command Enable persistent journald logging grep command Linux commands cheat sheet

systemd-journald collects kernel, service, and syslog-compatible messages with indexed metadata. journalctl is the reader. Volatile journals live under /run/log/journal and are cleared on reboot; persistent journals use /var/log/journal when enabled. Many hosts still keep plain-text logs under /var/log — journalctl does not replace every text log.

journalctl — quick reference

Basic viewing

Open the system journal, limit line count, or skip the pager for scripts.

When to use	Command
Show the system journal (pager opens by default)	`journalctl`
Print the last N lines without scrolling the whole journal	`journalctl -n 100`
Newest entries first	`journalctl -r -n 50`
Send output straight to the terminal (no `less`)	`journalctl --no-pager -n 20`
Follow new entries like `tail -f`	`journalctl -f`
Follow one unit with recent context	`journalctl -u sshd.service -f -n 50`

Boot sessions

Inspect logs from the current boot, a previous boot, or list boot IDs.

When to use	Command
List recorded boots with offsets and IDs	`journalctl --list-boots`
Logs since the current boot only	`journalctl -b`
Logs from the previous boot (`-1`)	`journalctl -b -1`
Kernel messages from the current boot	`journalctl -k -b`

Filter by service and time

Narrow output to one unit or a time window. On RHEL-family systems the SSH unit is usually sshd.service; on Ubuntu it is often ssh.service.

When to use	Command
Logs for one systemd unit	`journalctl -u sshd.service`
Multiple units in one query	`journalctl -u crond.service -u sshd.service`
Unit logs from the current boot	`journalctl -u nginx.service -b`
Failed unit after `systemctl start`	`journalctl -u UNIT -b --no-pager`
Entries since the start of today	`journalctl --since today`
Relative window (last hour)	`journalctl --since "1 hour ago"`
Fixed start and end timestamps	`journalctl --since "2026-07-01 10:00" --until "2026-07-01 11:00"`

Priority and field filters

Match severity levels or journal fields such as _PID and executable path.

When to use	Command
Errors from the current boot	`journalctl -b -p err`
Warning through critical range	`journalctl -p warning..crit`
Messages from one process ID	`journalctl _PID=1234`
Messages from a binary path	`journalctl /usr/sbin/sshd`

Output format and inspection

Change how lines render or export structured data.

When to use	Command
One-line short format (default in many configs)	`journalctl -o short -n 10`
ISO timestamps on each line	`journalctl -o short-iso -n 10`
Full field metadata per entry	`journalctl -o verbose -n 3`
JSON for scripts or log forwarders	`journalctl -o json -n 5`
Add catalog explanations when available	`journalctl -x -n 10`

Journal maintenance

Check disk use and trim old archived journals. Vacuum commands modify stored logs — run only when retention policy requires it.

When to use	Command
Show total journal disk usage	`journalctl --disk-usage`
Drop archived journals older than seven days	`sudo journalctl --vacuum-time=7d`
Shrink journals until total size is below 500 MB	`sudo journalctl --vacuum-size=500M`
Keep only the five newest journal files	`sudo journalctl --vacuum-files=5`

Persistent storage

When to use	Command
Check volatile vs persistent paths	`ls -ld /var/log/journal /run/log/journal`
Enable persistent storage (drop-in)	`Storage=persistent` in `/etc/systemd/journald.conf.d/*.conf`, then `systemctl restart systemd-journald`
Full walkthrough	See enable persistent journald logging

journalctl — command syntax

Synopsis from journalctl --help on RHEL 10.2 (systemd 257):

text

journalctl [OPTIONS...] [MATCHES...]

Matches are field predicates such as _SYSTEMD_UNIT=ssh.service or executable paths. Persistent journals live under /var/log/journal when enabled; volatile journals use /run/log/journal.

journalctl — command examples

Essential Last lines and reverse order

Start troubleshooting by reading recent events instead of the entire journal. -n limits count; -r shows newest first.

bash

journalctl -n 5 --no-pager

Sample output:

output

Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session closed for user root
Jul 01 18:06:54 server1 usermod[17682]: change user 'usermodlab3' home from '/home/usermodlab3' to '/opt/usermodlab3_home'
Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)
Jul 01 18:06:54 server1 sudo[17679]: pam_unix(sudo:session): session closed for user root
Jul 01 18:06:54 server1 sudo[17679]: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)

Newest-first view:

bash

journalctl -n 3 -r --no-pager

Sample output:

output

Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session closed for user root
Jul 01 18:06:54 server1 usermod[17682]: change user 'usermodlab3' home from '/home/usermodlab3' to '/opt/usermodlab3_home'
Jul 01 18:06:54 server1 sudo[17681]: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)

Use --no-pager in scripts so output is not piped through less.

Essential Service unit logs — sshd.service on RHEL

Filter by unit name when a daemon misbehaves. RHEL-family systems use sshd.service; Ubuntu often uses ssh.service.

bash

journalctl -u sshd.service -n 2 --no-pager

Sample output:

output

Aug 05 17:55:20 localhost.localdomain sshd-session[33711]: Accepted publickey for root from 10.0.2.2 port 56988 ssh2: RSA SHA256:QctH5c77yvxCJMG6WUQfAfwvfxRR4VBhFK+1rAFsoCY
Aug 05 17:55:20 localhost.localdomain sshd-session[33711]: pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0)

List units if you are unsure of the name with systemctl list-units --type=service | grep -i ssh. The systemctl command guide covers failed units and status output.

Essential Failed systemd service

After systemctl start fails, read the unit journal for the exit reason on the current boot.

bash

journalctl -u nginx.service -b --no-pager | tail -5

When the unit exists but failed to start, look for status=1/FAILURE or Failed with result lines. Pair with systemctl status UNIT for a short summary and journalctl -xeu UNIT for expanded context.

Common Follow logs in real time

Use -f like tail -f. Add -n for history before the follow loop. Press Ctrl+C to stop.

bash
timeout 2 journalctl -u sshd.service -f -n 1 --no-pager

Sample output:

output

Aug 05 17:55:20 localhost.localdomain sshd-session[33711]: pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0)

Combine -f with -p warning when you only want live warnings from a service during a change window.

Common List boots and read previous boot

Boot offsets from --list-boots feed -b. Zero is the running boot; -1 is the one before it.

bash

journalctl --list-boots | tail -3

Sample output:

output

-2 be4ac1bc5ef54219bd97a5fbd285dd82 Wed 2026-07-01 08:54:24 IST Wed 2026-07-01 15:31:10 IST
 -1 1cf54d68c0ad4ed991c3184036e0043f Wed 2026-07-01 15:30:36 IST Wed 2026-07-01 17:33:41 IST
  0 eb6453538d0841eb8fdc238594229fa7 Wed 2026-07-01 17:34:26 IST Wed 2026-07-01 18:06:54 IST

Errors from the previous boot (requires a persistent journal):

bash

journalctl -b -1 -p err --no-pager | head -5

On a volatile-only host you may see:

output

Specifying boot ID or boot offset has no effect, no persistent journal was found.

Enable persistent storage before you rely on -b -1 after reboot.

Common Time filters — today and last hour

Time expressions accept today, yesterday, and relative phrases such as "1 hour ago".

bash
journalctl --since "1 hour ago" -n 2 --no-pager

Sample output:

output

Aug 05 18:49:19 localhost.localdomain systemd[1]: Started systemd-hostnamed.service - Hostname Service.
Aug 05 18:49:26 localhost.localdomain chronyd[1077]: System clock was stepped by 0.000000 seconds

Combine with -u to see one service during an incident window.

Common Priority filter and kernel ring

-p accepts a single level or a range. -k restricts to kernel messages — similar to dmesg but boot- and time-aware.

bash
journalctl -b -p err --no-pager | head -3
journalctl -k -n 2 --no-pager

Sample output:

output

Jul 01 17:34:26 server1 systemd-udevd[343]: /usr/lib/udev/rules.d/90-alsa-restore.rules:16 GOTO="alsa_restore_std" has no matching label, ignoring.
Jul 01 17:34:27 server1 kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* vmwgfx seems to be running on an unsupported hypervisor.
Jul 01 18:01:27 server1 kernel: workqueue: e1000_watchdog [e1000] hogged CPU for >10000us 4 times, consider switching to WQ_UNBOUND
Jul 01 18:01:29 server1 kernel: workqueue: e1000_watchdog [e1000] hogged CPU for >10000us 5 times, consider switching to WQ_UNBOUND

Advanced Verbose metadata and JSON export

-o verbose prints structured fields for deep dives. -o json suits pipelines and log shippers.

bash
journalctl -n 1 -o verbose --no-pager | head -12

Sample output:

output

Wed 2026-07-01 18:06:54.405288 IST [s=7599c31c0c1f4f2bae82229b69b0b7b9;i=129d1;…]
    _HOSTNAME=server1
    PRIORITY=6
    _UID=0
    _GID=0
    SYSLOG_IDENTIFIER=sudo
    MESSAGE=pam_unix(sudo:session): session closed for user root

One JSON object per line:

bash

journalctl -n 1 -o json --no-pager

Sample output (truncated):

text

{"PRIORITY":"6","_HOSTNAME":"server1","SYSLOG_IDENTIFIER":"sudo","MESSAGE":"pam_unix(sudo:session): session closed for user root",…}

Common Volatile vs persistent journal paths

Check where this host stores journals before you expect previous-boot history to survive a reboot.

bash
ls -ld /var/log/journal /run/log/journal 2>&1

Sample output:

output

drwxr-sr-x+ 3 root systemd-journal 60 Aug  4 10:08 /run/log/journal
drwxr-sr-x+ 2 root systemd-journal  6 Aug  5 18:52 /var/log/journal

Both paths can exist after you enable persistence. See enable persistent journald logging for Storage=persistent and directory setup.

Advanced Disk usage — read-only check

Check how much space journals consume before planning vacuum. This command is read-only.

bash

journalctl --disk-usage

Sample output:

output

Archived and active journals take up 8M in the file system.

If policy requires trimming, use --vacuum-time or --vacuum-size with sudo during a maintenance window — those delete archived data.

journalctl — when to use / when not

Use journalctl when	Use something else when
The host runs systemd and you need one tool for kernel, service, and boot logs	The system uses syslog-only files → `grep` / `tail` on `/var/log/syslog` or `/var/log/messages`
You want filters by unit, boot ID, priority, or time without writing scripts	You need a quick kernel ring buffer snapshot → run `dmesg`
You are correlating service failures after reboot (`-b`, `-u`)	You are on embedded firmware without journald
You export JSON for monitoring	You only need HTTP/API debugging → curl
You must enforce journal retention on disk	Edit `/etc/systemd/journald.conf` for permanent limits, not only vacuum

journalctl vs traditional log files

	journalctl (journald)	`/var/log` text files
Storage	Binary journal with indexed fields	Plain text, often rotated by logrotate
Query	`-u`, `-b`, `--since`, `_PID=`, priorities	`grep`, `awk`, `tail`
Boot correlation	Built-in boot IDs and offsets	Depends on syslog configuration
Default on	Modern systemd distros	Still present on many hosts alongside journald
Tools	`journalctl` only	`tail`, `less`, rsyslog forwarding

Many hosts keep both journald and rsyslog; know which source your runbook expects.

journalctl — interview corner

What is journalctl used for?

journalctl is the front end for logs stored by systemd-journald. One command can show kernel lines, daemon stdout/stderr, authentication events, and boot records. Filters include unit name (-u), boot session (-b), priority (-p), and time (--since / --until).

Persistent storage is under /var/log/journal when enabled; otherwise logs may be volatile in /run/log/journal and lost on reboot.

A strong answer is:

"journalctl queries the systemd journal — kernel, services, and boot logs in one place. I filter by unit, time, priority, and boot ID instead of grepping dozens of files."

How do you follow logs in real time with journalctl?

Use -f (follow), like tail -f. Combine with -u to watch one service:

bash

journalctl -u nginx.service -f

Press Ctrl+C to stop. Add -n 50 to print recent history before following new lines.

A strong answer is:

"journalctl -f follows new entries; I add -u unit for one daemon and -n for context before the follow loop."

How do you view logs from the previous boot?

Run journalctl --list-boots to see offsets. 0 is the current boot; -1 is the previous session.

bash

journalctl -b -1 -p err --no-pager

You can also pass a boot ID from the list instead of a numeric offset.

A strong answer is:

"I list boots, then journalctl -b -1 for the prior session — often with -p err to find why the host rebooted."

Where does journald store logs?

Volatile journals live in /run/log/journal (RAM, cleared on reboot). Persistent journals use /var/log/journal when that directory exists and Storage= in journald.conf allows it.

Check footprint with:

bash

journalctl --disk-usage

A strong answer is:

"Volatile in /run/log/journal; persistent in /var/log/journal when configured. I check disk-usage and journald.conf retention before vacuuming."

Why does journalctl say Permission denied?

Non-privileged users may see only their own user journal. The full system journal usually requires root or membership in systemd-journal, adm, or wheel depending on distro policy.

bash

sudo journalctl -b -p err

A strong answer is:

"Full system logs need root or systemd-journal group. User journals work without sudo; I use sudo for host-wide incidents."

Troubleshooting

Symptom	Likely cause	Fix
No logs after reboot	Volatile storage only	Create `/var/log/journal`, set `Storage=persistent` in `journald.conf`, restart `systemd-journald`
`Permission denied`	Insufficient privileges	`sudo journalctl` or add user to `systemd-journal` / `adm`
`-u sshd` shows nothing	Unit name differs	`systemctl list-units \| grep ssh` — Ubuntu may use `ssh.service`; RHEL uses `sshd.service`
Pager hides script output	Default pager enabled	Add `--no-pager` or set `SYSTEMD_PAGER=`
Huge disk use	Long retention defaults	`journalctl --disk-usage`, then planned `--vacuum-size` or config limits
`--vacuum-*` not allowed	Missing privileges	Run vacuum commands with sudo
Empty time filter	Clock skew or wrong timezone	Widen window; try `--utc` for UTC timestamps
`grep` on binary journal path fails	Journal is not a text file	Use `journalctl` filters or `-o cat`, not `grep` on `/var/log/journal/*`

References

Upstream journalctl documentation

Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.

Expertise

Linux
HTML5
JavaScript
Web Design
Front-end Web Development

journalctl — quick reference

Basic viewing

Boot sessions

Filter by service and time

Priority and field filters

Output format and inspection

Journal maintenance

Persistent storage

journalctl — command syntax

journalctl — command examples

journalctl — when to use / when not

journalctl vs traditional log files

journalctl — interview corner

Troubleshooting

References

Related Articles

Enable Persistent Logging in systemd-journald on Linux

Schedule Tasks with systemd Timers in Linux

Manage systemd Targets in Linux