Why not just tail /var/log/syslog
- One source. Kernel, init, services, syslog API, and the stdin/stderr of processes launched through systemd.
- Structured fields. Beyond plain text there are
_PID,_UID,_COMM,MESSAGE_ID, and anyKEY=valuefields an application writes. - Binary format. More compact than plain text, and indexed.
- Boot-aware. The journal tracks individual boots, so you can filter by boot session.
Basic commands
bash
journalctl # entire journal (oldest first)
journalctl -e # jump to the end (like less -G)
journalctl -f # follow (like tail -f)
journalctl -n 50 # last 50 lines
journalctl -r # reverse: newest first
Filters
bash
journalctl -u nginx # only the nginx unit (see [[cmd-systemctl]])
journalctl -u nginx -u php-fpm # multiple units
journalctl -p err # priority: emerg/alert/crit/err/warning/notice/info/debug
journalctl --since "1 hour ago"
journalctl --since "2024-01-01" --until "2024-01-02 12:00"
journalctl _PID=1234 # by PID (structured field)
journalctl _COMM=sshd # by process name
journalctl -k # kernel messages only (= dmesg)
By boot session
bash
journalctl --list-boots # list all recorded boot sessions
journalctl -b # current boot only
journalctl -b -1 # previous boot (`-1` = one back)
This matters when the system crashed and restarted. You can separate what happened before the crash from what happened after.
Output formats
bash
journalctl -u nginx -o json # one JSON object per line, useful for parsing
journalctl -u nginx -o json-pretty
journalctl -o cat -u nginx # MESSAGE only, no prefixes
journalctl -o verbose # ALL structured fields
Journal size
bash
journalctl --disk-usage # how much space the journal uses on disk
sudo journalctl --vacuum-size=500M # trim to 500 MB
sudo journalctl --vacuum-time=7d # delete entries older than 7 days
Size limits are configured in /etc/systemd/journald.conf (SystemMaxUse=,
MaxRetentionSec=).
Persistent vs volatile
On many distributions the journal is stored in RAM (/run/log/journal) by
default and is lost on reboot. To make it persistent:
bash
sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald