bash
journalctlNotes
Basic journal read command.
Linux journalctl Cheat Sheet
Read, filter, follow, export, and troubleshoot systemd journal logs.
Export
Copy the compact sheet, download it, or print it.
Download
`D` dense toggle · `C` copy all
Basics
Read and follow the journal.
bash
journalctl -rNotes
Helpful when looking for the latest errors.
bash
journalctl -fNotes
Streams new log entries as they arrive.
bash
journalctl --no-pagerNotes
Useful in scripts and pipes.
bash
journalctl -n 100Notes
Quickly inspect recent logs.
Service and Unit Filters
Focus logs on specific services or units.
bash
journalctl -u nginxNotes
Most common service-level filter.
bash
journalctl -u nginx -fNotes
Great for live troubleshooting.
bash
journalctl -u nginx -u php-fpmNotes
Useful for related services in one view.
bash
journalctl --user -u myapp.serviceNotes
Used with per-user systemd services.
Time and Boot Filters
Inspect one boot or a specific time window.
bash
journalctl --list-bootsNotes
Lets you reference prior boots by index.
bash
journalctl -bNotes
Common first step after reboot issues.
bash
journalctl -b -1Notes
Very useful after crash or reboot analysis.
bash
journalctl --since "2026-03-01 10:00:00"Notes
Can use natural-ish formats like today, yesterday, or specific timestamps.
bash
journalctl --since "1 hour ago" --until "now"Notes
Useful for narrow incident windows.
Priority, Kernel, Fields
Filter by severity, kernel messages, and structured fields.
Priority warning and above
Show warnings, errors, and critical logs.
bashANYjournalctlpriorityseverity
bash
journalctl -p warningNotes
You can also use err, crit, alert, and emerg.
bash
journalctl -p err..alertNotes
Handy for focused incident review.
bash
journalctl -kNotes
Modern equivalent to dmesg-style inspection with journal persistence.
bash
journalctl -k -bNotes
Helpful for boot and driver issues.
bash
journalctl _EXE=/usr/sbin/sshdNotes
Field filters are powerful when you know journald metadata.
bash
journalctl _COMM=nginxNotes
Useful when unit names vary but process name is stable.
Output, Export, Maintenance
Change output mode and inspect journal health.
bash
journalctl -o jsonNotes
Great for scripts, jq, and structured analysis.
bash
journalctl -o json-prettyNotes
Useful for quick manual inspection of fields.
bash
journalctl -o short-isoNotes
Better for copy/paste and incident timelines.
bash
journalctl --disk-usageNotes
Helps with log retention and cleanup decisions.
Vacuum journal to size
Delete archived journals until under size limit.
bashANYjournalctlvacuumretention
bash
sudo journalctl --vacuum-size=500MNotes
Use carefully on production systems.
bash
sudo journalctl --vacuum-time=14dNotes
Retention control by age.
bash
journalctl --verifyNotes
Useful if you suspect journal corruption.
More in Linux journalctl
No other published sheets yet.