LinuxVIII · Logging and journaldJournal queries
journalctl — querying the systemd journal
Foundation⏱ ~12 minbashjournalctl
What you'll learn
- Filter journal entries by unit, time, priority, and arbitrary fields
- Follow a service's log in real time
- Export journal entries in text or JSON for further analysis
- Verify the journal is recording what you expect
Prerequisites
Verified against Ubuntu 24.04 LTS · Debian 12 (Bookworm) · RHEL 9.x · Rocky Linux 9.x · AlmaLinux 9.x · Linux kernel 6.1 LTS / 6.6 LTS · systemd 255+ · OpenSSH 8.7p1 (RHEL 9) / 9.6p1 (Ubuntu 24.04) · nftables 1.0.x · chrony 4.x · Pacemaker 2.1.x · Corosync 3.1.x · 2026-08-09
Not yet marked complete on this device.
journalctl is the diagnostic tool you will reach for more often
than any other on a systemd-managed host. Mastering its filters
turns a 30-minute diagnostic into a 30-second query.
The basic queries
Read-only / Safejournalctl -u— -u filters by systemd unit. --since accepts a relative or absolute time. --no-pager disables paging (essential for scripts). The output is one entry per line, indexed by the journal.
$ journalctl -u sshd --since '1 hour ago' --no-pagerAug 9 11:23:45 host sshd[12345]: Accepted publickey for alice from 10.0.0.5 port 51234 ssh2
Aug 9 11:24:12 host sshd[12345]: pam_unix(sshd:session): session opened for user alice by (uid=0)
...Illustrative output
Read-only / Safejournalctl -p— -p filters by priority: emerg, alert, crit, err, warning, notice, info, debug. The filter includes all messages at the chosen level and above. -p err shows err, crit, alert, and emerg.
$ journalctl -p err --since '1 hour ago' --no-pagerAug 9 11:42:01 host kernel: Out of memory: Killed process 12345 (myapp) total-vm:...
Aug 9 11:45:23 host myapp[12345]: ERROR database connection refused
Aug 9 11:50:01 host sshd[23456]: error: maximum authentication attempts exceeded for adminIllustrative output
Time filters
Read-only / Safetime filters— --since and --until accept absolute or relative times. -b is since boot; -b -1 is the previous boot. -b -2 is two boots ago, etc. Useful when the host just rebooted and you want the previous session's logs.
$ journalctl --since "2026-08-09 11:00" --until "2026-08-09 12:00" --no-pager; journalctl -b; journalctl -b -1...Illustrative output
| Filter | Meaning |
|---|---|
--since "1 hour ago" | Last hour |
--since "2026-08-09" | Since midnight on that date |
--until "2026-08-09 12:00" | Until that time |
-b | Since the current boot |
-b -1 | Since the previous boot |
--since yesterday | Since 00:00 yesterday |
Following in real time
Read-only / Safefollow— -f follows new entries as they arrive. Like tail -f for the journal. Useful during a deployment or when restarting a service to watch for the next error.
$ journalctl -u sshd -f...Illustrative output
Field filters
The journal stores structured fields, not just text. You can filter by any field:
Read-only / Safefield filters— _UID filters by user ID. _PID filters by process ID. The journal indexes these fields, so queries are fast. Other useful fields: _SYSTEMD_UNIT, _COMM, _EXE, _HOSTNAME, _BOOT_ID.
$ journalctl _UID=1000 --since '1 hour ago' --no-pager; journalctl _PID=12345 --no-pager...Illustrative output
| Field | Meaning |
|---|---|
_UID= | User ID |
_GID= | Group ID |
_PID= | Process ID |
_BOOT_ID= | Boot ID |
_SYSTEMD_UNIT= | systemd unit name |
_COMM= | Process name (comm) |
_EXE= | Executable path |
_HOSTNAME= | Hostname |
_TRANSPORT= | How the message arrived (syslog, journal, stdout, kernel) |
_KERNEL_DEVICE= | Kernel device (for kernel messages) |
Combining filters
Filters combine as AND:
Read-only / Safecombined filters— All filters AND together. Here: sshd unit, error priority or higher, last hour, syslog identifier 'sshd'. The journal evaluates these as a single query plan.
$ journalctl -u sshd -p err --since '1 hour ago' SYSLOG_IDENTIFIER=sshd --no-pager...Illustrative output
Read-only / SafeOR— journalctl supports + for OR. This shows messages from unit sshd OR with UID 33 (www-data) in the last hour. Useful for 'either the service or the user' queries.
$ journalctl -u sshd + _UID=33 --since '1 hour ago' --no-pager...Illustrative output
Output formats
Read-only / Safeoutput formats— -o short-iso shows timestamps as ISO 8601 (2026-08-09T12:00:00+0000) instead of the default local format. -o json outputs one JSON object per entry — perfect for piping into jq or a log aggregator.
$ journalctl -u sshd --since '1 hour ago' -o short-iso --no-pager; journalctl -u sshd --since '1 hour ago' -o json --no-pager | head -1...Illustrative output
| Format | Use |
|---|---|
short | Default; ISO date without year |
short-iso | Full ISO 8601 |
short-precise | ISO with microseconds |
json | One JSON object per line |
json-pretty | Pretty-printed JSON |
cat | Just the message, no metadata |
with-unit | Like default but with [unit] prefix on each line |
Exporting for analysis
Read-only / Safeexport— Redirect to a file for sharing with a colleague or attaching to an incident. Pipe to jq for structured analysis: count errors, extract IPs, summarise by source.
$ journalctl -u sshd --since '1 hour ago' --no-pager > /tmp/sshd.log; journalctl -u sshd --since '1 hour ago' -o json --no-pager | jq -r '.MESSAGE'...Illustrative output
Production patterns
- Always combine filters.
-u sshd -p erris faster and more useful than-u sshd - **Use
--no-pagerin scripts.** Paging breaks automation - **Export with
-o json** when piping to jq or a SIEM - **Use
-fonly interactively.** Following in scripts is rarely useful - **Check
--list-bootsafter a reboot** to find previous-session logs - **Tune
SystemMaxUse** in/etc/systemd/journald.conffor retention tuning - **Verify with
--verify** in CI that the journal is recording what you expect
Knowledge check
Knowledge check · 3 questions
Q1. What does `journalctl -u sshd -p err` show?
Q2. To read the log of the boot that ended in a crash, you run `journalctl -b -1` after the host has come back up.
Q3. Which of the following are correct journalctl practices? Select all that apply.
Passing score: 75%. Answers are checked in this browser.