Must-know cold
journalctl -u UNIT -n 100 --no-pagerjournalctl -u UNIT -f (follow)journalctl -u UNIT --since "30 min ago"journalctl -b -p err · journalctl -k (kernel)- Always pair with
systemctl status UNIT first (sheet 08)
Priority levels (-p)
Definition: syslog-style severities. Lower number = more severe. -p err shows 0–3 (emerg…err), not “err and debug.”
| Name | Priority | Notes |
|---|
| emerg | 0 | Also panic |
| alert | 1 | |
| crit | 2 | |
| err | 3 | Also error |
| warning | 4 | Also warn |
| notice | 5 | |
| info | 6 | |
| debug | 7 | |
Commands
journalctl — core filters
Definition: Query the systemd journal by unit, boot, priority, or kernel.
| Option | Argument | Meaning | Example |
|---|
| (none) | — | All journal (huge) | Avoid bare |
-u | UNIT | Unit _SYSTEMD_UNIT= plus systemd/coredump lines about it (not every app file log) | journalctl -u nginx |
-t | SYSLOG_ID | Syslog identifier | journalctl -t sshd |
-k / --dmesg | — | Kernel messages (_TRANSPORT=kernel). Implies current boot unless you add -b -1 | journalctl -k |
-b | — | Current boot only | journalctl -b |
-b | -1 / ID | Previous boot (-1 = boot before last) or boot ID | journalctl -b -1 |
--list-boots | — | List boots with IDs | journalctl --list-boots |
-n | N | Last N entries (default 10 if -n has no number). Implied by -f | journalctl -n 50 |
-f | — | Follow new entries (starts from the last -n lines) | journalctl -f |
-e | — | Jump to end in less. Implies -n 1000 and current boot. Not with --no-pager | journalctl -e |
-r | — | Reverse (newest first) | journalctl -r |
-p | PRIO | This severity and more important (numerically ≤ N) | journalctl -p err |
-p | FROM..TO | Inclusive priority range | journalctl -p err..alert |
-g / --grep | REGEX | PCRE on MESSAGE= only. All-lowercase pattern is case-insensitive | journalctl -g 'OOM|killed' |
Flag combos
| Combo | Meaning | Example |
|---|
-u UNIT -n 100 --no-pager | Last 100 for unit | Default incident |
-u UNIT -f | Live while restart | Two terminals |
-u UNIT -p err -n 50 | Errors only | |
-b -p err --no-pager | Errors this boot | |
journalctl — time windows
Definition: Restrict journal output to a since/until time range.
| Option | Argument | Meaning | Example |
|---|
--since | TIME | Start time | journalctl --since "1 hour ago" |
--until | TIME | End time | journalctl --until "10:00" |
--since | YYYY-MM-DD | From date | journalctl --since 2026-08-01 |
--since | "YYYY-MM-DD HH:MM:SS" | Precise | journalctl --since "2026-08-01 09:00:00" |
TIME forms: yesterday · today · 2 hours ago · 2026-08-01 · 2026-08-01 09:14:00
Flag combos
| Combo | Meaning | Example |
|---|
-u U --since "30 min ago" --no-pager | Recent unit window | RCA |
--since "09:00" --until "09:30" -p err | Incident slice | |
Definition: Choose journal presentation (short-iso, json, cat, etc.).
| Option | Argument | Meaning | Example |
|---|
-o | short | Default-ish short | journalctl -o short |
-o | short-iso | ISO timestamps | journalctl -o short-iso |
-o | short-precise | Higher precision time | journalctl -o short-precise |
-o | verbose | All fields | journalctl -o verbose -n 1 |
-o | json | JSON lines | journalctl -o json -n 5 |
-o | json-pretty | Pretty JSON | Tickets |
-o | cat | Message only | journalctl -o cat -u U |
-x | — | Extra explanation catalog text | journalctl -x -u U |
Flag combos
| Combo | Meaning | Example |
|---|
-u U -n 20 -o short-iso --no-pager | Clean paste | Chat/ticket |
-u U -o json-pretty -n 5 | Structured | |
journalctl — disk & vacuum
Definition: Show journal disk use and reclaim space safely.
| Option | Argument | Meaning | Example |
|---|
--disk-usage | — | Journal disk use | journalctl --disk-usage |
--vacuum-size | SIZE | Delete archived files until usage is below SIZE (not the active file) | sudo journalctl --vacuum-size=200M |
--vacuum-time | TIME | Drop archived files older than TIME | sudo journalctl --vacuum-time=14d |
--vacuum-files | N | Leave N journal files (still won’t delete the active one) | sudo journalctl --vacuum-files=5 |
--rotate | — | Archive the current file so vacuum can reclaim it | sudo journalctl --rotate --vacuum-size=200M |
Flag combos
| Combo | Meaning | Example |
|---|
--rotate --vacuum-size=200M | Rotate first, then vacuum (active file included) | Disk-full playbook |
journalctl — other useful
Definition: User journals, field matches, no-pager, and related filters.
| Option | Argument | Meaning | Example |
|---|
--no-pager | — | Print raw; scripts/SSH | Always in automation |
--user | — | Current user’s journal (needs persistent storage). Default without flags is everything the caller may read | journalctl --user -u app |
--user-unit | UNIT | User unit (_SYSTEMD_USER_UNIT=). Same idea as --user -u | journalctl --user-unit=app |
_PID= | N | Field match PID | journalctl _PID=1234 |
_COMM= | NAME | Command name field | journalctl _COMM=sshd |
-q | — | Hide “Journal begins at…” / reboot banners and “can’t read system journal” hints | journalctl -q |
--utc | — | Show UTC times | journalctl --utc |
Flag combos
| Combo | Meaning | Example |
|---|
-k --since "1 hour ago" | grep -i oom | Kernel OOM hunt | Memory incidents |
--user -u lab -f | User service live | Lab units |
Common recipes
| Goal | Command |
|---|
| Unit last 100 lines | journalctl -u nginx -n 100 --no-pager |
| Follow unit | journalctl -u nginx -f |
| Last 30 minutes | journalctl -u nginx --since "30 min ago" --no-pager |
| Previous boot unit | journalctl -b -1 -u nginx --no-pager |
| System errors this boot | journalctl -b -p err --no-pager |
| Kernel OOM (this boot) | journalctl -k --since "today" --no-pager | grep -iE 'oom|killed process' |
| Previous-boot kernel | journalctl -k -b -1 --no-pager |
| Userspace OOM (oomd) | journalctl -u systemd-oomd --since "today" --no-pager |
| Disk used by journal | journalctl --disk-usage |
| Failed unit deep dive | systemctl status U -l --no-pager; journalctl -u U -n 200 --no-pager |
Pitfalls
- Bare
journalctl is enormous — always constrain (-u, -b, --since, -n).
- No persistent journal (
Storage=auto and no /var/log/journal) → logs live in /run and die on reboot. -b -1 / --list-boots look empty.
-k and -e both imply this boot unless you pass another -b. Previous-boot kernel is journalctl -k -b -1.-p err is emerg…err (≤ 3), not “err and noisier.”-g is PCRE on MESSAGE= only (not unit names). All-lowercase patterns match case-insensitively.-e is pager-only (less) and caps at 1000 lines; do not pair with --no-pager.- App may log only to files under
/var/log — empty journal ≠ healthy app. -u will not see those.
systemd-oomd is a unit, not kernel. journalctl -k misses it.- Vacuum only deletes archived files.
--disk-usage still counts the active file — --rotate first if you need that space.
--user needs persistent storage; without it user journals may be missing.- Timezones:
--since "09:14" is host local unless --utc. Check timedatectl.
- Permissions: system journal needs root or membership in
systemd-journal / adm / wheel.
For more details, try man <command> in your terminal.