Linux journalctl Cheat Sheet

Read, filter, follow, export, and troubleshoot systemd journal logs.

View
StandardDetailedCompact
Export
Copy the compact sheet, download it, or print it.
Download
`D` dense toggle · `C` copy all
## Basics
Show journal logs
journalctl

# Print the journal from oldest to newest by default.

Show newest first
journalctl -r

# Reverse output order.

Follow live logs
journalctl -f

# Tail journal output like tail -f.

Disable pager
journalctl --no-pager

# Print directly to stdout.

Show last N lines
journalctl -n 100

# Limit output to recent entries.

## Service and Unit Filters
Logs for one unit
journalctl -u nginx

# Show logs for a service unit.

Follow service logs
journalctl -u nginx -f

# Tail logs for a specific unit.

Logs for multiple units
journalctl -u nginx -u php-fpm

# Filter by more than one service.

Logs for a user unit
journalctl --user -u myapp.service

# Read logs from the user manager.

## Time and Boot Filters
List boots
journalctl --list-boots

# Show known boot sessions.

Current boot logs
journalctl -b

# Show logs from the current boot only.

Previous boot logs
journalctl -b -1

# Inspect the prior boot session.

Logs since a time
journalctl --since "2026-03-01 10:00:00"

# Filter by starting time.

Logs in time range
journalctl --since "1 hour ago" --until "now"

# Filter by start and end times.

## Priority, Kernel, Fields
Priority warning and above
journalctl -p warning

# Show warnings, errors, and critical logs.

Priority range
journalctl -p err..alert

# Filter a priority range.

Kernel messages
journalctl -k

# Show kernel logs from the journal.

Kernel logs for current boot
journalctl -k -b

# Show current-boot kernel messages.

Filter by executable
journalctl _EXE=/usr/sbin/sshd

# Show entries from a specific executable path.

Filter by command name
journalctl _COMM=nginx

# Filter by command field.

## Output, Export, Maintenance
Output as JSON
journalctl -o json

# Emit journal entries in JSON format.

Pretty JSON output
journalctl -o json-pretty

# Human-readable JSON output.

Use ISO timestamps
journalctl -o short-iso

# Display logs in short ISO format.

Show journal disk usage
journalctl --disk-usage

# Inspect space used by journal files.

Vacuum journal to size
sudo journalctl --vacuum-size=500M

# Delete archived journals until under size limit.

Vacuum journal by age
sudo journalctl --vacuum-time=14d

# Delete archived logs older than a time window.

Verify journal files
journalctl --verify

# Check journal file integrity.

More in Linux journalctl

No other published sheets yet.

Recommended next

No recommendations yet.