The Journal (journalctl)
journalctl
systemd logs to the journal. Query it with journalctl.
| Command | Shows |
|---|---|
journalctl -u nginx | Logs for one unit |
journalctl -f | Follow (live tail) |
journalctl -b | This boot only |
journalctl -b -1 | Previous boot |
journalctl -p err | Errors and worse |
journalctl --since '1 hour ago' | Time filter |
journalctl --disk-usage | Journal size |
By default the journal is in RAM (/run/log/journal) and lost on reboot. Make it persistent by creating /var/log/journal and running systemctl restart systemd-journald.
$ journalctl -u sshd --since today -p warningExam tip: Priority levels (-p): 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug.