Wissensdatenbank

On modern Ubuntu and Debian systems, journalctl is the central tool for viewing system and service logs collected by systemd's journal — covering everything from boot messages to individual service output.

Viewing All Recent Logs

sudo journalctl

Press G to jump to the end, or use -e to open directly at the end:

sudo journalctl -e

Following Logs in Real Time

sudo journalctl -f

Useful for watching what happens as you trigger an action (like restarting a service or reproducing an error).

Viewing Logs for a Specific Service

sudo journalctl -u nginx
sudo journalctl -u ssh

Filtering by Time

sudo journalctl --since "2026-08-01" --until "2026-08-02"
sudo journalctl --since "1 hour ago"
sudo journalctl --since today

Viewing Only Errors and Warnings

sudo journalctl -p err

Priority levels: emerg, alert, crit, err, warning, notice, info, debug.

Viewing Logs Since the Last Boot

sudo journalctl -b

View logs from the previous boot (useful for diagnosing a crash):

sudo journalctl -b -1

Viewing Kernel Messages

sudo journalctl -k

Limiting Output

sudo journalctl -n 50

Checking Disk Space Used by Logs

sudo journalctl --disk-usage

Limiting Journal Size (Log Rotation)

sudo nano /etc/systemd/journald.conf

SystemMaxUse=500M

sudo systemctl restart systemd-journald

Manually Clearing Old Logs

sudo journalctl --vacuum-time=7d

Or by size:

sudo journalctl --vacuum-size=200M

Common Errors

"No journal files were found" — persistent logging may be disabled; enable it by creating /var/log/journal and restarting systemd-journald.

Logs disappear after reboot — by default, journald may only keep logs in memory (volatile). Enable persistent storage:

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

Best Practices

• Use -u SERVICE to narrow investigations instead of scrolling through the entire journal
• Set a reasonable SystemMaxUse to prevent logs from filling your disk
• Combine with grep for keyword searches: journalctl -u nginx | grep error

FAQ

Is journalctl a replacement for /var/log files?
On many modern systems it's the primary source, though some services (like auth.log) may still write plain-text logs in parallel, depending on your rsyslog configuration.

Related Articles

• How to Manage Services with systemd and systemctl
• How to Monitor Auth Logs and Detect Intrusion Attempts
• How to Check and Manage Disk Usage on a Linux VPS