Cheat Sheet logoCheat Sheet Today

Linux journalctl Cheat Sheet

Linux journalctl•Permalink

Read, filter, follow, export, and troubleshoot systemd journal logs.

Sign in to save
View
StandardDetailedCompact
Export
Copy the compact sheet, download it, or print it.
Download
`D` dense toggle · `C` copy all

Basics

Read and follow the journal.

Show journal logs

Print the journal from oldest to newest by default.

↗#
bashANYjournalctllogsbasic
bash
journalctl

Basic journal read command.

Show newest first

Reverse output order.

↗#
bashANYjournalctlreverse
bash
journalctl -r

Helpful when looking for the latest errors.

Follow live logs

Tail journal output like tail -f.

↗#
bashANYjournalctlfollowtail
bash
journalctl -f

Streams new log entries as they arrive.

Disable pager

Print directly to stdout.

↗#
bashANYjournalctlpagerscripts
bash
journalctl --no-pager

Useful in scripts and pipes.

Show last N lines

Limit output to recent entries.

↗#
bashANYjournalctltailrecent
bash
journalctl -n 100

Quickly inspect recent logs.

Service and Unit Filters

Focus logs on specific services or units.

Logs for one unit

Show logs for a service unit.

↗#
bashANYjournalctlunitservice
bash
journalctl -u nginx

Most common service-level filter.

Follow service logs

Tail logs for a specific unit.

↗#
bashANYjournalctlunitfollow
bash
journalctl -u nginx -f

Great for live troubleshooting.

Logs for multiple units

Filter by more than one service.

↗#
bashANYjournalctlmultipleunits
bash
journalctl -u nginx -u php-fpm

Useful for related services in one view.

Logs for a user unit

Read logs from the user manager.

↗#
bashANYjournalctluserunit
bash
journalctl --user -u myapp.service

Used with per-user systemd services.

Time and Boot Filters

Inspect one boot or a specific time window.

List boots

Show known boot sessions.

↗#
bashANYjournalctlbootshistory
bash
journalctl --list-boots

Lets you reference prior boots by index.

Current boot logs

Show logs from the current boot only.

↗#
bashANYjournalctlbootcurrent
bash
journalctl -b

Common first step after reboot issues.

Previous boot logs

Inspect the prior boot session.

↗#
bashANYjournalctlbootprevious
bash
journalctl -b -1

Very useful after crash or reboot analysis.

Logs since a time

Filter by starting time.

↗#
bashANYjournalctlsincetime
bash
journalctl --since "2026-03-01 10:00:00"

Can use natural-ish formats like today, yesterday, or specific timestamps.

Logs in time range

Filter by start and end times.

↗#
bashANYjournalctluntiltime
bash
journalctl --since "1 hour ago" --until "now"

Useful for narrow incident windows.

Priority, Kernel, Fields

Filter by severity, kernel messages, and structured fields.

Priority warning and above

Show warnings, errors, and critical logs.

↗#
bashANYjournalctlpriorityseverity
bash
journalctl -p warning

You can also use err, crit, alert, and emerg.

Priority range

Filter a priority range.

↗#
bashANYjournalctlpriorityrange
bash
journalctl -p err..alert

Handy for focused incident review.

Kernel messages

Show kernel logs from the journal.

↗#
bashANYjournalctlkerneldmesg
bash
journalctl -k

Modern equivalent to dmesg-style inspection with journal persistence.

Kernel logs for current boot

Show current-boot kernel messages.

↗#
bashANYjournalctlkernelboot
bash
journalctl -k -b

Helpful for boot and driver issues.

Filter by executable

Show entries from a specific executable path.

↗#
bashANYjournalctlfieldsexe
bash
journalctl _EXE=/usr/sbin/sshd

Field filters are powerful when you know journald metadata.

Filter by command name

Filter by command field.

↗#
bashANYjournalctlfieldscomm
bash
journalctl _COMM=nginx

Useful when unit names vary but process name is stable.

Output, Export, Maintenance

Change output mode and inspect journal health.

Output as JSON

Emit journal entries in JSON format.

↗#
bashANYjournalctljsonoutput
bash
journalctl -o json

Great for scripts, jq, and structured analysis.

Pretty JSON output

Human-readable JSON output.

↗#
bashANYjournalctljsonpretty
bash
journalctl -o json-pretty

Useful for quick manual inspection of fields.

Use ISO timestamps

Display logs in short ISO format.

↗#
bashANYjournalctltimestampsiso
bash
journalctl -o short-iso

Better for copy/paste and incident timelines.

Show journal disk usage

Inspect space used by journal files.

↗#
bashANYjournalctldiskusage
bash
journalctl --disk-usage

Helps with log retention and cleanup decisions.

Vacuum journal to size

Delete archived journals until under size limit.

↗#
bashANYjournalctlvacuumretention
bash
sudo journalctl --vacuum-size=500M

Use carefully on production systems.

Vacuum journal by age

Delete archived logs older than a time window.

↗#
bashANYjournalctlvacuumtime
bash
sudo journalctl --vacuum-time=14d

Retention control by age.

Verify journal files

Check journal file integrity.

↗#
bashANYjournalctlverifyintegrity
bash
journalctl --verify

Useful if you suspect journal corruption.

More in Linux journalctl

No other published sheets yet.

Recommended next

No recommendations yet.
Browse all sheets →