journalctl — systemd logs

journalctl reads logs collected by systemd-journald. It provides access to service logs, kernel events, boot messages and system activity from a single interface.

The -u option filters logs by systemd unit. This is one of the most useful commands when troubleshooting a service.

-f behaves similarly to tail -f and continuously displays new events as they are written.

--since and --until allow logs to be restricted to a specific time range.

The -p option filters messages by syslog priority. Useful values include emerg, alert, crit, err, warning, notice, info and debug.

journalctl can separate logs by system boot. -b shows the current boot, while negative indexes inspect previous boots.

-k displays kernel messages recorded in the journal. This is useful for drivers, hardware, networking and filesystem problems.

Logs can also be filtered by process ID, executable or other journal fields.

Output formats can make journalctl easier to use in scripts or pipelines.

The journal can consume disk space over time. journalctl can report usage and remove older entries according to size or age.

When a service fails, first inspect its systemd status and then move into journalctl for the detailed event history.