Journalctl Usage Guide — Reading System Logs and Debugging Services

Complete guide to using journalctl for reading systemd journal logs, filtering by service, time, priority, and exporting logs for debugging Linux issues. This guide covers everything you need to know about this topic, including common causes, step-by-step solutions, and answers to frequently asked questions.

Here are the key things to understand: journalctl reads the systemd journal which collects logs from all systemd services, the kernel, and syslog. Logs are stored in binary format in /var/log/journal/ and survive reboots (if configured). Filtering options: by unit (-u), by time (--since, --until), by priority (-p), by boot (-b). Journal can grow large — configure rotation in /etc/systemd/journald.conf. journalctl -f provides live log streaming similar to tail -f. Understanding these fundamentals will help you diagnose and resolve this issue more effectively.

The most common reasons this occurs include: Service failures generating error logs that need investigation. System boot failures leaving diagnostic messages in the journal. Disk space consumed by unrotated journal files. Missing logs because journald is configured for volatile storage (RAM only). Identifying the root cause is the first step toward finding the right solution.

To resolve this, follow these recommended steps: View all logs: journalctl (press Space to page, q to quit). View specific service: journalctl -u nginx.service -n 100 --no-pager. View since time: journalctl --since '2024-01-15 10:00:00' --until '2024-01-15 12:00:00'. View only errors: journalctl -p err (priorities: emerg, alert, crit, err, warning, notice, info, debug). View current boot: journalctl -b 0 (previous boot: -b -1). Follow live logs: journalctl -f -u servicename. Clean old logs: journalctl --vacuum-size=500M or journalctl --vacuum-time=30d. If these steps do not resolve the issue, consider consulting additional resources or a qualified professional.

This article is part of our Linux Error Codes collection on Error Codes Wiki. We provide comprehensive, up-to-date information to help you find solutions quickly.