System logs and journald

When something breaks, the first place you look is the logs. On systems with systemd the central log is kept by the journald service, and you read it through journalctl. It collects service output, kernel messages, and login events.

$ journalctl              # the whole journal, oldest first
$ journalctl -e           # jump to the end, to the latest entries
$ journalctl -f           # follow new lines in real time

Filters

The journal is large, so you almost always narrow it: by service, by time, by severity.

$ journalctl -u ssh              # only the ssh service entries
$ journalctl -u ssh -b           # the same, but for the current boot
$ journalctl --since "today"     # since the start of the day
$ journalc