journalctl
Query the systemd journal (logs)
Overview
Used to query and display messages from the systemd journal. View system logs, filter by time, service, priority, and more.
Syntax
journalctl [OPTIONS...] [MATCHES...]Common Options
-f, --followShow only the most recent journal entries, and follow the journal as new entries are appended.
-n, --lines=NShow the most recent N journal entries.
-u, --unit=UNITShow messages for the specified systemd unit.
-p, --priority=PRIORITYFilter output by message priorities (emerg, alert, crit, err, warning, notice, info, debug).
--since=DATEShow entries on or newer than the specified date.
--until=DATEShow entries on or older than the specified date.
-b, --boot[=ID]Show messages from a specific boot. Without argument, messages from the current boot are shown.
-k, --dmesgShow only kernel messages (equivalent to dmesg).
-e, --pager-endJump to the end of the journal inside the pager.
-x, --catalogAugment log lines with explanation texts from the message catalog.
-o, --output=FORMATControls the formatting of journal entries (short, verbose, json, cat).
--no-pagerDo not pipe output into a pager.
Examples
Show all logs for the nginx service.
Follow nginx logs in real-time (like tail -f).
Show nginx logs from the last hour.
Show nginx logs for a specific date range.
Show only error-level messages and above.
Show messages from the current boot.
Show messages from the previous boot.
List all available boots in the journal.
Show kernel messages (similar to dmesg).
Show the last 50 journal entries.
Show how much disk space the journal is using.
Show last 10 nginx logs in JSON format.