Understanding Systemd Journal and journalctl

What is the Journal?

Systemd captures all logs from services, the kernel, and system messages in a structured binary format. journalctl is the tool to query these logs.

Basic Usage

# Show all logs
journalctl

# Follow in real time
journalctl -f

# Last 50 lines
journalctl -n 50

# Since last boot
journalctl -b

Filter by Service

journalctl -u nginx
journalctl -u nginx -f    # Follow
journalctl -u nginx --since "1 hour ago"

Time-Based Filtering

journalctl --since "2026-02-25 10:00"
journalctl --since "2 hours ago"
journalctl --since today
journalctl --since yesterday --until today

Priority Levels

# Only errors and above
journalctl -p err

# Warnings and above
journalctl -p warning

# Priority levels: emerg, alert, crit, err, warning, notice, info, debug

Disk Usage Management

# Check journal size
journalctl --disk-usage

# Limit to 500 MB
sudo journalctl --vacuum-size=500M

# Keep only last 7 days
sudo journalctl --vacuum-time=7d

Output Formats

# JSON output (for parsing)
journalctl -u nginx --output=json-pretty

# Short format with timestamps
journalctl -u nginx --output=short-iso