Linux Command - journalctl

The linux command journalctl is a systemd tool used to display logs from the systemd journal.

Here we are covering some of the more common / useful variations of this command.

journalctl                    # all logs from all units in a pager
journalctl -r                 # reverse
journalctl -k                 # only kernel related messages
journalctl -u apache2         # view logs for specific service
journalctl -u mysql           # view logs for specific service
journalctl | grep -i nvidia   # search for keyword

journalctl -f                 # tail logs, monitor in real time as they are written
journalctl --disk-usage       # disk usage for logs

Selecting a time range:

journalctl --since yesterday                                              # since a certain time
journalctl --since 2023-12-25 09:00:00 --until 2024-03-15 15:00:00        # between two dates

More useful commands:

journalctl --utc          # UTC instead of local timezone

journalctl -p 3           # filter by priority 0: emergency, 7: debug
journalctl -p warning     # filter by priority level


journalctl -n 10           # only 10 lines
journalctl --no-page       # don't page

journalctl -o verbose      # verbose output
journalctl -o json         # json output
journalctl -o json-pretty


journalctl --list-boots    # view a list of system boots
journalctl -b -1           # view logs from previous boot