journalctl command builder
Tick what you want to see in the systemd journal and get the journalctl command, with every flag explained.
Last updated
In short: journalctl reads the systemd journal, the log where Linux services write their messages. The most useful form is journalctl -u name -b -p err: messages from one service, since the last boot, errors only. Add --since '1 hour ago' to limit the time, -f to watch live, and sudo (or the systemd-journal group) to see every message.
Your input never leaves your browser. Everything is calculated on your device; nothing you type is sent to a server.
Review generated files before you use them. Provided as-is — see Terms.
How does the journalctl command builder work?
On a Linux system with systemd, services do not each write their own log file. They write to the
journal, one central log that systemd-journald keeps in binary form.
You read it with journalctl. Without options it prints every message since the
oldest one it still has, which can be millions of lines, so the trick is to filter: by service
(-u), by time (--since, --until), by boot (-b),
by importance (-p) or by text (-g). Filters combine, and each one makes
the output shorter.
There are two journals. The system journal holds messages from system services
and the kernel; reading all of it needs sudo or the systemd-journal
group. Your user journal holds messages from services you run with
systemctl --user, such as rootless podman containers; read it with
journalctl --user. Looking in the wrong journal is the most common reason for
"no entries".
The journal can live in RAM (/run/log/journal, gone after a reboot) or on disk
(/var/log/journal). Many distributions keep it on disk; some minimal and cloud
images do not. If journalctl --list-boots shows only one boot, create
/var/log/journal so the next crash is still there to read. All options are in
journalctl(1); storage
settings in journald.conf(5).
Worked examples
Why did my service fail to start?
Input Service nginx, this boot, errors only, no pager gives journalctl -u nginx -b -p err --no-pager
-u picks the service (journalctl adds .service), -b limits to the current boot and -p err hides everything below error level. If nothing shows up, drop -p err: many programs log their errors at the normal info level.
Watch a user service live
Input My user services, podman-auto-update.service, live follow gives journalctl --user -u podman-auto-update.service -f
Services you manage with systemctl --user (such as rootless podman quadlets) log to your user journal, so the command needs --user. -f keeps printing new lines until you press Ctrl+C.
What happened before the crash?
Input Previous boot, warnings and worse, newest first, with sudo gives sudo journalctl -b -1 -p warning -r
-b -1 is the boot before the current one. It only exists when the journal is stored on disk: if journalctl --list-boots shows one line, create /var/log/journal and restart systemd-journald so the next crash is kept.
Frequently asked questions
How do I see the logs of one systemd service?
Run journalctl -u name, for example journalctl -u sshd. Add -b for this boot only, -n 50 for the last 50 lines, or -f to follow new messages live. For a service you run with systemctl --user, add --user: journalctl --user -u name.
Why does journalctl -b -1 say there is no previous boot?
Because your journal is volatile: it is kept in RAM under /run/log/journal and lost at every reboot. Make it persistent with sudo mkdir -p /var/log/journal && sudo systemctl restart systemd-journald, or set Storage=persistent in /etc/systemd/journald.conf. Only boots after that change are kept.
Why do I only see my own messages, or get a permissions error?
Reading the whole system journal needs root or membership of the systemd-journal group (on some distributions adm or wheel works too). Use sudo journalctl, or run sudo usermod -aG systemd-journal $USER and log out and back in.
How do I show only errors in journalctl?
Use -p err: it shows err, crit, alert and emerg messages. -p warning also shows warnings. The priority is set by the program, though, and many programs write their errors as normal info messages, so a text search with -g error can find more.
How do I get out of journalctl?
Press q. journalctl opens its output in a pager (less), where the arrow keys scroll, / searches and q quits. In follow mode (-f) press Ctrl+C instead. Add --no-pager to print everything straight to the terminal.
How much disk space does the journal use?
Check with journalctl --disk-usage. By default a persistent journal may use up to 10 % of its file system, capped at 4 GB (see journald.conf(5)). Shrink it now with sudo journalctl --vacuum-size=500M, or for good with SystemMaxUse= in journald.conf.