journalctl for systemd logs in Linux CLI - Step-by-Step Execution

Concept Flow - journalctl for systemd logs

Start journalctl command

↓

Read systemd journal logs

↓

Apply filters (if any)

↓

Display logs on screen

↓

Wait for user or exit

The journalctl command reads systemd logs, applies any filters, then shows the logs on the screen.

Execution Sample

Linux CLI

journalctl -u sshd.service --since today

This command shows logs for the sshd service from today.

Execution Table

Step	Action	Filter Applied	Output Example	Notes
1	Start journalctl command	None	No output yet	Command begins execution
2	Read systemd journal logs	None	Reads all logs	Reads full journal
3	Apply filter '-u sshd.service'	Unit=sshd.service	Logs only for sshd	Filters logs by service
4	Apply filter '--since today'	Since today	Logs from today only	Filters logs by time
5	Display filtered logs	Unit=sshd.service, Since today	Shows sshd logs from today	Output shown to user
6	End	N/A	Command ends	No more logs to show or user exits

💡 All matching logs displayed or user stops output

Variable Tracker

Variable	Start	After Step 3	After Step 4	Final
Filter	None	Unit=sshd.service	Unit=sshd.service + Since today	Unit=sshd.service + Since today
Output	None	All sshd logs	Sshd logs from today	Displayed logs on screen

Key Moments - 2 Insights

Why do we see fewer logs after applying filters?

Because filters like '-u sshd.service' and '--since today' limit logs to only those matching the service and time, as shown in execution_table steps 3 and 4.

What happens if no filters are applied?

journalctl shows all systemd logs, which can be very long. This is before step 3 in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, what filter is applied at step 3?

A No filter

B Since today

C Unit=sshd.service

D Priority=error

💡 Hint

Check the 'Filter Applied' column at step 3 in execution_table

At which step does journalctl apply the time filter?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Look at the 'Filter Applied' column for '--since today' in execution_table

If we remove the '-u sshd.service' filter, how does the output change?

A Shows no logs

B Shows logs for all services

C Shows only sshd logs

D Shows logs only before today

💡 Hint

Refer to variable_tracker 'Filter' values and execution_table step 3

Concept Snapshot

journalctl reads systemd logs and shows them.
Use filters like '-u service' for service logs.
Use '--since' or '--until' for time filtering.
Output is shown on screen, can be paged.
No filters means all logs shown.
Useful for troubleshooting system services.

Full Transcript

The journalctl command is used to read logs collected by systemd. When you run journalctl, it reads the systemd journal logs and shows them on your screen. You can add filters to see only logs you want, like logs for a specific service using '-u servicename' or logs from a certain time using '--since'. For example, 'journalctl -u sshd.service --since today' shows logs for the sshd service from today. The command starts by reading all logs, then applies filters step by step, and finally displays the filtered logs. If no filters are used, it shows all logs, which can be very long. This helps you find problems or check what happened with your system services.