Useful journalctl Command Examples (Cheat Sheet)

Updated: 28 September 2026 · Applies to: systemd-journald (systemd 252 to 259) on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

journalctl reads the systemd journal, where the kernel, systemd and every service write their messages. It is the fastest way to find out why a service failed or what happened before a reboot. Run it as root, or as a member of the systemd-journal group, to see all entries.

1. Logs of one service

journalctl -u nginx                 # everything from nginx
journalctl -u nginx -n 50           # the last 50 lines
journalctl -u nginx -f              # follow new lines live (Ctrl+C to stop)

This is usually the first command after systemctl status nginx reports a failure.

2. Only errors

journalctl -p err -b

-p err shows priority "error" and worse (critical, alert, emergency). -p warning adds warnings.

3. A time range

journalctl --since "2026-09-28 09:00" --until "2026-09-28 10:30"
journalctl --since "1 hour ago"
journalctl --since today -u sshd

4. Per boot, including before a crash

journalctl --list-boots        # boots stored in the journal
journalctl -b                  # current boot
journalctl -b -1 -e            # previous boot, jump to its end

-b -1 -e shows the last messages before the previous shutdown or crash. This needs a persistent journal, which is the default on AlmaLinux, Rocky Linux, RHEL, Ubuntu and Debian (the journal is stored in /var/log/journal).

5. Kernel messages and searching

journalctl -k -b               # kernel messages of this boot (like dmesg)
journalctl -g "Out of memory"  # search message text
journalctl _PID=1234           # one process

6. Output formats for scripts

journalctl -u nginx -o short-iso -n 20     # ISO timestamps
journalctl -u nginx -o json-pretty -n 1    # all fields of an entry
journalctl -u nginx --no-pager | grep 502  # plain output for pipes

Disk space used by the journal

journalctl --disk-usage
journalctl --vacuum-size=500M      # shrink it now
journalctl --vacuum-time=30d       # delete entries older than 30 days

To set a permanent limit, create /etc/systemd/journald.conf.d/size.conf with:

[Journal]
SystemMaxUse=1G

Then run systemctl restart systemd-journald.

Common problems

• "No journal files were found" or only the current boot: the journal is kept in RAM only. Create the folder with mkdir -p /var/log/journal and run systemctl restart systemd-journald.
• Not all entries shown as a normal user: add the user to the systemd-journal group.

Official documentation: journalctl and journald.conf.