journalctl Commands Cheatsheet for Troubleshooting

Linux systems continuously generate logs from services, kernel events, and system activities. With systemd, these logs are centralized in the journal, making journalctl the primary tool for accessing and analyzing them. It provides structured, searchable logs with powerful filtering options, simplifying troubleshooting and system monitoring.

Understanding The Systemd Journal System

Journalctl is the command-line tool that lets you access and filter the systemd journal – basically your system's diary of everything that happens behind the scenes. Unlike old-school log files scattered across your system, the systemd journal centralizes everything in a structured, searchable format.

Think of it as having a search engine specifically for your system events. Instead of manually digging through text files, you can quickly pull up exactly what you need with the right command.

A Quick Reference For Journalctl Commands

Here's a handy reference table of the most useful journalctl commands for quick lookup:

4 Essential Daily Journalctl Commands For Quick Troubleshooting

Let's start with the bread and butter commands you'll reach for most often:

Viewing Complete System Journal History

journalctl

Simple, right? This shows you everything – the whole journal from oldest to newest. It's like opening a book from page one. You'll get a pager view (similar to less command) where you can navigate with arrow keys, Page Up/Down, or search with the slash key (/).

Displaying Recent Events In Reverse Order

journalctl -r

The -r flips the script, showing newest entries first. Much more useful when you're troubleshooting something that just happened.

Monitoring Live System Events As They Happen

journalctl -f

This is your live feed. The -f (follow) option keeps the journal open and shows new entries as they happen – super handy when you're actively debugging an issue. It's like watching the system narrate what it's doing.

Restricting Output To Most Recent Journal Entries

journalctl -n 50

This shows only the most recent 50 log entries. Change the number to whatever makes sense for your situation. Great for quick checks without scrolling through thousands of entries.

Time-Based Filtering Techniques For Targeted Log Analysis

When troubleshooting, timing is everything. These commands help you narrow down logs to specific timeframes:

Viewing Current And Previous Boot Session Logs

journalctl -b

Only shows logs from the current boot. Add a number to see older boots:

journalctl -b -1  # Previous boot
journalctl -b -2  # Two boots ago

Retrieving All Logs From The Current Day

journalctl --since today

Just today's logs – perfect for daily system checks.

Setting Precise Time Windows For Targeted Investigation

journalctl --since "2023-09-10 10:00:00" --until "2023-09-10 11:00:00"

Zoom in on a specific window of time. You can also use relative times:

journalctl --since "1 hour ago"

Service-Specific Filtering Methods For Efficient Debugging

Instead of wading through every log, focus on just the service you care about:

Isolating Logs From Individual System Services

journalctl -u ssh

This shows only logs from the SSH service. Replace ssh with any service name like apache2, nginx, or docker.

Combining Multiple Service Logs In One View

journalctl -u ssh -u apache2

Track multiple related services in one view.

Extracting Kernel-Specific Messages For Hardware Troubleshooting

journalctl -k

Just the kernel messages – useful for hardware or driver issues.

Severity-Based Priority Filtering For Critical Issue Detection

Not all logs are created equal. Filter by severity to focus on what matters:

Focusing On High Priority Error Messages

journalctl -p err

This shows only error, critical, alert, and emergency messages – the stuff you need to worry about.

Combining Service And Priority Filters For Precise Results

journalctl -p warning -u nginx

Combining filters gives you laser-focused results.

Output Formatting Options For Enhanced Log Readability

Raw logs can be tough to parse. These options make them easier on the eyes:

Disabling Pager For Continuous Terminal Output

journalctl --no-pager

Dumps the entire output to your terminal instead of using the pager interface.

Converting Log Output To JSON Format For Script Processing

journalctl -o json

Perfect for piping to other tools or scripts for automated analysis.

Stripping Metadata To See Only The Core Message Content

journalctl -o cat

Strips the metadata and just shows you the messages themselves.

Advanced Troubleshooting Techniques For Linux Power Users

Ready to level up? These power-user commands will make you look like a Linux wizard:

Searching Log Entries With Grep-Like Pattern Matching

journalctl -g "error|failed"

This grep-like search finds all entries containing either "error" or "failed" – adjust the pattern to match what you're hunting for.

Monitoring Individual Process IDs For Targeted Debugging

journalctl _PID=1234

Focus on logs from a specific process ID. Great when you know exactly which process is acting up.

Analyzing Journal Storage Consumption On Your System

journalctl --disk-usage

See how much space your journal is taking up. Useful when storage is tight.

Reclaiming Disk Space By Removing Outdated Journal Entries

sudo journalctl --vacuum-time=2weeks

Keep your system tidy by removing logs older than two weeks.

Practical Real-World Troubleshooting Scenarios Using Journalctl

Let's combine these commands for some common troubleshooting scenarios:

Diagnosing Service Startup Failures With Error Filtering

journalctl -u nginx -b -p err

This shows all error messages from the nginx service since the last boot.

Uncovering System Crash Causes From Previous Boot Records

journalctl -b -1 -p crit

Check critical messages from the previous boot to find what caused a crash.

Real-Time Security Monitoring Of SSH Authentication Events

journalctl -u ssh -f

Watch SSH service logs in real-time to monitor login attempts as they happen.

Configuring Persistent Journal Storage For Complete System History

By default, journalctl logs might not persist across reboots. Make them stick with this one-time setup:

Restart the journal:

sudo systemctl restart systemd-journald

Adjust permissions:

sudo systemd-tmpfiles --create --prefix /var/log/journal

Create the log directory:

sudo mkdir -p /var/log/journal

Now your logs will survive reboots, giving you a complete history when you need it most.

Wrap-Up

With these commands, you've got the tools to tackle almost any log-related task on your Linux system. No more blindly searching through text files or guessing what went wrong.

FAQs

How do I check if the journald service is running properly?

Check the status of the systemd-journald service with:

systemctl status systemd-journald

This will show if the service is active, enabled, and running without errors.

Why can't I see logs older than a few days?

By default, the journal might be configured for volatile storage that clears on reboot. To check your current settings:

journalctl --disk-usage

If it's low, follow the persistent configuration steps in this guide to maintain logs across reboots.

Can I export journal logs to a text file?

Yes, redirect the output to a file:

journalctl -u apache2 > apache_logs.txt

For a specific timeframe:

journalctl --since yesterday --until today > yesterday_logs.txt

How do I troubleshoot when my system won't boot properly?

Boot from a live USB, then mount your system drive and use journalctl with the path to the journal:

sudo mount /dev/sdaX /mnt
sudo journalctl -D /mnt/var/log/journal

This lets you access the journal from your unbootable system.

What's the difference between journalctl and traditional log files?

Traditional logs are plain text files in /var/log/ with different formats per application. Journalctl provides a unified interface to structured binary logs with rich metadata, advanced filtering, and built-in rotation – all from one command.

How can I increase or limit the journal size?

Edit /etc/systemd/journald.conf and set maximum disk usage:

[Journal]
SystemMaxUse=2G

After editing, restart the journal:

sudo systemctl restart systemd-journald

This limits journal size to 2GB. Adjust as needed based on your storage constraints.