journalctl for systemd logs in Linux CLI - Step-by-Step Execution

Concept Flow - journalctl for systemd logs

Start journalctl command

↓

Read systemd journal logs

↓

Apply filters (if any)

↓

Display logs on screen

↓

Wait for user or exit

The journalctl command reads systemd logs, applies any filters, then shows the logs on the screen.

Execution Sample

Linux CLI

journalctl -u sshd.service --since today

This command shows logs for the sshd service from today.

Execution Table

Step	Action	Filter Applied	Output Example	Notes
1	Start journalctl command	None	No output yet	Command begins execution
2	Read systemd journal logs	None	Reads all logs	Reads full journal
3	Apply filter '-u sshd.service'	Unit=sshd.service	Logs only for sshd	Filters logs by service
4	Apply filter '--since today'	Since today	Logs from today only	Filters logs by time
5	Display filtered logs	Unit=sshd.service, Since today	Shows sshd logs from today	Output shown to user
6	End	N/A	Command ends	No more logs to show or user exits

💡 All matching logs displayed or user stops output

Variable Tracker

Variable	Start	After Step 3	After Step 4	Final
Filter	None	Unit=sshd.service	Unit=sshd.service + Since today	Unit=sshd.service + Since today
Output	None	All sshd logs	Sshd logs from today	Displayed logs on screen

Key Moments - 2 Insights

Why do we see fewer logs after applying filters?

Because filters like '-u sshd.service' and '--since today' limit logs to only those matching the service and time, as shown in execution_table steps 3 and 4.

What happens if no filters are applied?

journalctl shows all systemd logs, which can be very long. This is before step 3 in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, what filter is applied at step 3?

A No filter

B Since today

C Unit=sshd.service

D Priority=error

💡 Hint

Check the 'Filter Applied' column at step 3 in execution_table

At which step does journalctl apply the time filter?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Look at the 'Filter Applied' column for '--since today' in execution_table

If we remove the '-u sshd.service' filter, how does the output change?

A Shows no logs

B Shows logs for all services

C Shows only sshd logs

D Shows logs only before today

💡 Hint

Refer to variable_tracker 'Filter' values and execution_table step 3

Concept Snapshot

journalctl reads systemd logs and shows them.
Use filters like '-u service' for service logs.
Use '--since' or '--until' for time filtering.
Output is shown on screen, can be paged.
No filters means all logs shown.
Useful for troubleshooting system services.

Full Transcript

The journalctl command is used to read logs collected by systemd. When you run journalctl, it reads the systemd journal logs and shows them on your screen. You can add filters to see only logs you want, like logs for a specific service using '-u servicename' or logs from a certain time using '--since'. For example, 'journalctl -u sshd.service --since today' shows logs for the sshd service from today. The command starts by reading all logs, then applies filters step by step, and finally displays the filtered logs. If no filters are used, it shows all logs, which can be very long. This helps you find problems or check what happened with your system services.

Practice

1. What is the primary purpose of the journalctl command in Linux?

easy

A. To edit configuration files for systemd services

B. To start and stop systemd services

C. To view system and service logs managed by systemd

D. To display disk usage statistics

Solution

1. Step 1: Understand the role of journalctl

   The journalctl command is used to access logs collected by systemd's journal service.

2. Step 2: Compare options with command purpose

   Editing configuration files, starting/stopping services, and displaying disk usage are handled by other commands, unrelated to viewing logs.

3. Final Answer:

   To view system and service logs managed by systemd -> Option C

4. Quick Check:

   journalctl = view logs [OK]

Hint: Remember: journalctl = journal + control = view logs [OK]

Common Mistakes:

• Confusing journalctl with systemctl for service control
• Thinking journalctl edits files
• Assuming journalctl shows disk info

2. Which of the following is the correct syntax to show the last 10 lines of system logs using journalctl?

easy

A. journalctl -n 10

B. journalctl --last 10

C. journalctl -l 10

D. journalctl -t 10

Solution

1. Step 1: Recall journalctl option for number of lines

   The -n option followed by a number shows that many recent log lines.

2. Step 2: Check other options for correctness

   The other options are not valid journalctl options for limiting output lines.

3. Final Answer:

   journalctl -n 10 -> Option A

4. Quick Check:

   -n = number of lines [OK]

Hint: Use -n to limit lines shown quickly [OK]

Common Mistakes:

• Using --last instead of -n
• Confusing -l (line wrap) with line count
• Using -t which filters by syslog identifier

3. What will be the output of the command journalctl -u sshd.service -n 3?

medium

A. Shows the last 3 log entries related to the sshd service

B. Shows all logs except those from sshd service

C. Shows the first 3 lines of the system log

D. Shows logs from all services except sshd

Solution

1. Step 1: Understand the -u option

   The -u sshd.service option filters logs to only those from the sshd service.

2. Step 2: Understand the -n 3 option

   The -n 3 option limits output to the last 3 log entries.

3. Final Answer:

   Shows the last 3 log entries related to the sshd service -> Option A

4. Quick Check:

   -u sshd + -n 3 = last 3 sshd logs [OK]

Hint: -u filters by service, -n limits lines [OK]

Common Mistakes:

• Thinking -u excludes the service logs
• Confusing -n with showing first lines
• Assuming it shows all logs

4. You run journalctl -u nginx.service --since "2024-01-01" --until "2024-01-02" but get no output, even though you know nginx was active. What is the likely problem?

medium

A. The date format is incorrect; journalctl requires YYYY-MM-DD HH:MM:SS

B. The service name is wrong; it should be nginx without .service

C. The journal is empty because logging is disabled

D. The system clock is set to a different timezone causing no matching logs

Solution

1. Step 1: Check date format validity

   The date format "YYYY-MM-DD" is valid for journalctl; it does not require HH:MM:SS.

2. Step 2: Consider timezone impact

   If the system clock or journal timestamps use a different timezone, the specified range may not match any logs, causing no output.

3. Step 3: Verify service name and logging

   The service name with .service is correct, and nginx is usually logged to the journal, making incorrect service name or disabled logging unlikely.

4. Final Answer:

   The system clock is set to a different timezone causing no matching logs -> Option D

5. Quick Check:

   Timezone mismatch = no logs in range [OK]

Hint: Check timezone if date filters show no logs [OK]

Common Mistakes:

• Assuming date format is wrong
• Removing .service from unit name
• Ignoring system clock timezone

5. You want to monitor live logs from the docker.service as they happen. Which command should you use?

hard

A. journalctl -u docker.service --since now

B. journalctl -u docker.service -f

C. journalctl -u docker.service -n 0

D. journalctl -u docker.service --no-pager

Solution

1. Step 1: Identify option for live log streaming

   The -f option in journalctl streams new log entries live, similar to tail -f.

2. Step 2: Evaluate other options

   journalctl -u docker.service --since now shows logs since now but does not follow live updates. journalctl -u docker.service -n 0 shows zero lines, so no output. journalctl -u docker.service --no-pager disables paging but does not stream live.

3. Final Answer:

   journalctl -u docker.service -f -> Option B

4. Quick Check:

   -f = follow live logs [OK]

Hint: Use -f to follow logs live like tail -f [OK]

Common Mistakes:

• Using --since now without -f for live updates
• Using -n 0 which shows no lines
• Confusing --no-pager with live streaming