journalctl for systemd logs in Linux CLI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is journalctl used for in Linux?

journalctl is a command-line tool to view and manage systemd logs on Linux systems. It helps you read system and service logs stored by systemd's journal.

beginner

How do you show the most recent logs using journalctl?

Use journalctl -r to display logs in reverse order, showing the newest entries first.

beginner

How can you filter logs for a specific service, for example, ssh.service?

Use journalctl -u ssh.service to see logs only for the SSH service.

beginner

What option shows live logs as they happen with journalctl?

Use journalctl -f to follow logs live, similar to tail -f.

beginner

How do you limit journalctl output to logs from the current boot only?

Use journalctl -b to show logs from the current boot session.

Which command shows the latest systemd logs first?

A journalctl -r

B journalctl -b

C journalctl -f

D journalctl -u

journalctl -r shows logs in reverse order, newest first.

How do you view logs only for the nginx.service?

A journalctl -f nginx.service

B journalctl -b nginx.service

C journalctl -u nginx.service

D journalctl -r nginx.service

-u filters logs by the specified service unit.

What does journalctl -f do?

A Filters logs by user

B Shows logs from the last boot

C Shows logs in reverse order

D Follows logs live as they are written

-f follows the log output live, like tail -f.

Which option limits logs to the current boot session?

A -b

B -u

C -r

D -f

-b shows logs from the current boot only.

If you want to see all logs without filtering, which command do you use?

A journalctl -u

B journalctl

C journalctl -f

D journalctl -b

Running journalctl alone shows all logs stored in the journal.

Explain how to use journalctl to check logs for a specific service and follow them live.

Think about filtering by service and watching logs as they update.

Describe how to view only the logs from the current boot using journalctl and why this might be useful.

Focus on isolating logs to the current system start.