Linux journalctl Cheat Sheet

journalctl

# Print the journal from oldest to newest by default.

journalctl -r

# Reverse output order.

journalctl -f

# Tail journal output like tail -f.

journalctl --no-pager

# Print directly to stdout.

journalctl -n 100

# Limit output to recent entries.

journalctl -u nginx

# Show logs for a service unit.

journalctl -u nginx -f

# Tail logs for a specific unit.

journalctl -u nginx -u php-fpm

# Filter by more than one service.

journalctl --user -u myapp.service

# Read logs from the user manager.

journalctl --list-boots

# Show known boot sessions.

journalctl -b

# Show logs from the current boot only.

journalctl -b -1

# Inspect the prior boot session.

journalctl --since "2026-03-01 10:00:00"

# Filter by starting time.

journalctl --since "1 hour ago" --until "now"

# Filter by start and end times.

journalctl -p warning

# Show warnings, errors, and critical logs.

journalctl -p err..alert

# Filter a priority range.

journalctl -k

# Show kernel logs from the journal.

journalctl -k -b

# Show current-boot kernel messages.

journalctl _EXE=/usr/sbin/sshd

# Show entries from a specific executable path.

journalctl _COMM=nginx

# Filter by command field.

journalctl -o json

# Emit journal entries in JSON format.

journalctl -o json-pretty

# Human-readable JSON output.

journalctl -o short-iso

# Display logs in short ISO format.

journalctl --disk-usage

# Inspect space used by journal files.

sudo journalctl --vacuum-size=500M

# Delete archived journals until under size limit.

sudo journalctl --vacuum-time=14d

# Delete archived logs older than a time window.

journalctl --verify

# Check journal file integrity.