Logs in Linux: journalctl and /var/log

journalctl reads the system journal that systemd keeps; many services also write text logs under /var/log.

Common cases

journalctl -u nginx          # one service's logs
journalctl -f                # follow new entries (like tail -f)
journalctl -b                # logs since the last boot
journalctl --since today     # today's logs
sudo tail -f /var/log/syslog # an old-style text log
dmesg                        # kernel messages

How it works: the journal and text files

systemd keeps its own journal in a binary format - that is what journalctl reads, so a plain cat will not work on it. The journal is easy to filter: by service (-u), by time (--since), by priority (-p err). Many programs still write text files under /var/log (syslog, auth.log, nginx logs) - you read those with the usual tail, less, grep. Kernel messages live apart and are shown by dmesg.

In the book

This topic is covered in full in the chapter Logging and journald.

See also

Services: systemctl, The /proc filesystem.