journalctl for systemd logs in Linux CLI - Commands & Configuration

Introduction

Systemd manages many services on Linux and keeps logs of their activity. journalctl is a command that helps you read these logs easily to understand what is happening or troubleshoot problems.

When you want to see recent system errors to fix a problem with your computer.

When you need to check if a service started correctly after a reboot.

When you want to watch live logs as a program runs to understand its behavior.

When you want to filter logs by a specific service to focus on its messages.

When you want to check logs from a past boot to investigate an issue that happened earlier.

Commands

Shows the most recent system logs with extra details and highlights important messages. Useful for quick troubleshooting.

Terminal

journalctl -xe

Expected Output

Jun 10 14:22:01 my-computer systemd[1]: Starting Daily Cleanup...

Jun 10 14:22:02 my-computer systemd[1]: Started Daily Cleanup.

Jun 10 14:23:45 my-computer sshd[1234]: Accepted password for user from 192.168.1.5 port 54321 ssh2

→

-x - Show explanatory help for log messages

→

-e - Jump to the end of the journal to see latest logs

Filters logs to show only messages related to the sshd service. Helps focus on one service's logs.

Terminal

journalctl -u sshd.service

Expected Output

Jun 10 14:20:00 my-computer systemd[1]: Starting OpenSSH server daemon...

Jun 10 14:20:01 my-computer sshd[1200]: Server listening on 0.0.0.0 port 22.

Jun 10 14:23:45 my-computer sshd[1234]: Accepted password for user from 192.168.1.5 port 54321 ssh2

→

-u - Specify the systemd unit (service) to filter logs

Shows logs from the previous boot. Useful to investigate problems that happened before the current session.

Terminal

journalctl -b -1

Expected Output

Jun 09 08:00:00 my-computer systemd[1]: Starting Network Manager...

Jun 09 08:00:01 my-computer systemd[1]: Started Network Manager.

Jun 09 08:05:12 my-computer kernel: usb 1-1: new high-speed USB device number 2 using xhci_hcd

→

-b - Show logs from a specific boot

→

-1 - Select the previous boot (one before current)

Follows the journal live, showing new log entries as they happen. Like watching a live feed of system messages.

Terminal

journalctl -f

Expected Output

Jun 10 14:25:00 my-computer systemd[1]: Starting Backup Service...

Jun 10 14:25:01 my-computer backup[2345]: Backup started

→

-f - Follow logs live, showing new entries as they appear

Key Concept

If you remember nothing else from this pattern, remember: journalctl lets you read and filter systemd logs easily to find and understand system events.

Common Mistakes

Running journalctl without sudo and getting permission denied errors.

Normal users often cannot read system logs without proper permissions.

Run journalctl commands with sudo to access all system logs.

Using journalctl without any filters and getting overwhelmed by too many logs.

The journal contains all system logs, which can be very large and hard to read.

Use filters like -u for services or -b for boots to narrow down the logs.

Trying to read logs from a service that is not managed by systemd.

journalctl only shows logs from systemd-managed services.

Check if the service uses systemd and use other log tools if not.

Summary

Use journalctl -xe to see recent detailed system logs for quick troubleshooting.

Filter logs by service with journalctl -u servicename to focus on specific components.

Use journalctl -b -1 to view logs from the previous boot session.

Follow live logs with journalctl -f to watch system events as they happen.