{"id":130774,"date":"2025-07-02T11:15:36","date_gmt":"2025-07-02T11:15:36","guid":{"rendered":"\/tutorials\/?p=130774"},"modified":"2025-12-02T14:50:36","modified_gmt":"2025-12-02T14:50:36","slug":"journalctl-command","status":"publish","type":"post","link":"\/ca\/tutorials\/journalctl-command","title":{"rendered":"How to use the journalctl command to view Linux logs"},"content":{"rendered":"<p>The <strong>journalctl<\/strong> command is a powerful Linux utility for viewing, filtering, and managing system logs collected by systemd. It lets you inspect logs from services, users, or the kernel, troubleshoot boot errors, and monitor system activity in real time.<\/p><p>In this guide, you&rsquo;ll learn how to use <strong>journalctl<\/strong> effectively &ndash; from basic syntax and command options to advanced filtering techniques. We&rsquo;ll explain how to narrow down logs by time or source, customize log output formats, tail logs live, and manage storage with log rotation. You&rsquo;ll also find practical command examples to help you analyze issues and maintain system performance directly from the command line.<\/p><p>\n\n\n\n<\/p><h2 class=\"wp-block-heading\" id=\"h-what-is-the-journalctl-command\"><strong>What is the journalctl command?<\/strong><\/h2><p>journalctl is a Linux command-line tool that lets you view and analyze system logs collected by systemd. It serves as the main interface for querying the systemd journal, which stores logs in a binary format for fast access and advanced filtering.<\/p><p>Unlike traditional logging tools that store logs as plain text, the systemd journal keeps entries indexed and structured. This allows administrators to search logs by time, service, priority, or user with high speed and precision. As a result, journalctl is now the standard method for monitoring, troubleshooting, and auditing Linux systems using systemd.<\/p><h2 class=\"wp-block-heading\" id=\"h-journalctl-command-syntax\"><strong>journalctl command syntax<\/strong><\/h2><p>The basic syntax for the <strong>journalctl<\/strong> command is:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl [OPTIONS] [FILTERS]<\/pre><ul class=\"wp-block-list\">\n<li><strong>[OPTIONS]<\/strong> &ndash; modify how <strong>journalctl<\/strong> behaves.<\/li>\n\n\n\n<li><strong>[FILTERS]<\/strong> &ndash; narrow down your log search to specific results.<\/li>\n<\/ul><p>To display all logs, run:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl<\/pre><p>This command shows the entire system journal from the oldest entry to the newest:<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c28146c\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"272\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-1024x272.png\" alt=\"A terminal output shows the entire system journal\" class=\"wp-image-130777\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>By default, pagination is enabled. You can scroll through the logs using the <strong>Up<\/strong> and <strong>Down<\/strong> arrow keys. To exit the log view, press <strong>q<\/strong>.<\/p><p>To disable pagination and print the full output directly in the terminal, add the <strong>&ndash;no-pager<\/strong> option:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --no-pager<\/pre><p>This option lets you view all logs at once. Keep in mind that if your system has many logs, it will take a while to load everything.<\/p><p><div class=\"protip\">\n                    <h4 class=\"title\">&#128218; Suggested reading<\/h4>\n                    <p> <strong>journalctl<\/strong> is just one of many useful <a href=\"\/ca\/tutorials\/linux-commands\">Linux commands<\/a>. Check out our complete guide to learn the most essential commands, what they do, and how to use them.<\/p>\n                <\/div>\n\n\n\n<\/p><h2 class=\"wp-block-heading\" id=\"h-journalctl-options\"><strong>journalctl options<\/strong><\/h2><p>Here are the most commonly used CLI options &ndash; also called flags or parameters &ndash; for <strong>journalctl<\/strong>:<\/p><ul class=\"wp-block-list\">\n<li><strong>-p<\/strong> &ndash; displays journal logs with a specific priority level. Common levels include: <strong>emerg<\/strong>, <strong>alert<\/strong>, <strong>crit<\/strong>, <strong>err<\/strong>, <strong>warning<\/strong>, <strong>notice<\/strong>, <strong>info<\/strong>, and <strong>debug<\/strong>.<\/li>\n\n\n\n<li><strong>&ndash;directory=PATH<\/strong> &ndash; specifies the directory that contains systemd journal files, such as<strong> \/var\/log\/journal\/1234567890abcdef<\/strong>.<\/li>\n\n\n\n<li><strong>&ndash;file=PATH<\/strong> &ndash; opens a specific binary journal file, like <strong>\/var\/log\/journal\/1234567890abcdef\/system.journal<\/strong>, to view its logs.<\/li>\n\n\n\n<li><strong>&ndash;since=DATE<\/strong> &ndash; filters logs starting from the specified date. You can use an absolute date, like <strong>2025-06-01<\/strong>, or a relative time, such as <strong>&ldquo;<\/strong><strong>yesterday&rdquo;<\/strong><strong> <\/strong>or<strong> <\/strong><strong>1 &ldquo;hour ago&rdquo;<\/strong>.<\/li>\n\n\n\n<li><strong>&ndash;until=DATE<\/strong> &ndash; shows logs up to the specified date or relative time.<\/li>\n\n\n\n<li><strong>&ndash;unit=UNIT<\/strong> &ndash; displays logs from a specific systemd unit, such as <strong>nginx.service<\/strong>.<\/li>\n\n\n\n<li><strong>&ndash;grep=PATTERN<\/strong> &ndash; filters logs by a search pattern. For example, use <strong>&ndash;grep= &ldquo;error&rdquo;<\/strong> to show only error messages.<\/li>\n\n\n\n<li><strong>&ndash;case-sensitive=BOOL<\/strong> &ndash; enables or disables case sensitivity for <strong>&ndash;grep<\/strong>. Use <strong>true<\/strong> to enable or <strong>false<\/strong> to disable. For instance: <strong>&ndash;grep= &ldquo;Error&rdquo; &ndash;case-sensitive=true<\/strong>.<\/li>\n\n\n\n<li><strong>&ndash;output=STRING<\/strong> &ndash; sets the log output format. Supported values include: <strong>short<\/strong>, <strong>short-precise<\/strong>, <strong>short-iso<\/strong>, <strong>short-iso-precise<\/strong>, <strong>short-full<\/strong>, <strong>short-monotonic<\/strong>, <strong>short-unix<\/strong>, <strong>verbose<\/strong>, <strong>export<\/strong>, <strong>json<\/strong>, <strong>json-pretty<\/strong>, <strong>json-sse<\/strong>, <strong>json-seq<\/strong>, <strong>cat<\/strong>, and <strong>with-unit<\/strong>.<\/li>\n\n\n\n<li><strong>-n INT<\/strong> &ndash; displays the last N log entries (positive number) or the first N (negative number), like <strong>50<\/strong> or <strong>-100<\/strong>.<\/li>\n\n\n\n<li><strong>&ndash;reverse<\/strong> &ndash; reverses the output order to show the newest entries first.<\/li>\n\n\n\n<li><strong>&ndash;show-cursor<\/strong> &ndash; shows the cursor position within the log stream.<\/li>\n\n\n\n<li><strong>&ndash;utc<\/strong> &ndash; displays timestamps in Coordinated Universal Time (UTC).<\/li>\n\n\n\n<li><strong>&ndash;no-pager<\/strong> &ndash; disables pagination to show all logs at once.<\/li>\n\n\n\n<li><strong>&ndash;pager-end<\/strong> &ndash; starts the pager at the end of the logs.<\/li>\n\n\n\n<li><strong>&ndash;interval=TIME<\/strong> &ndash; sets the interval between log queries. Examples include: <strong>5s<\/strong> (five seconds), <strong>6m<\/strong> (six minutes), and<strong> 1h<\/strong> (one hour).<\/li>\n\n\n\n<li><strong>&ndash;disk-usage<\/strong> &ndash; shows the total disk space used by journal logs.<\/li>\n\n\n\n<li><strong>&ndash;vacuum-size=BYTES<\/strong> &ndash; trims the journal to the specified size by deleting older logs. For instance: <strong>1G<\/strong>, <strong>256M<\/strong>.<\/li>\n\n\n\n<li><strong>&ndash;vacuum-files=INT<\/strong> &ndash; limits the number of journal files to keep. For example, <strong>5<\/strong> holds the last five files.<\/li>\n\n\n\n<li><strong>&ndash;vacuum-time=TIME<\/strong> &ndash; deletes logs older than the given time, such as <strong>1week<\/strong>, <strong>4days<\/strong>, or <strong>7hours<\/strong>.<\/li>\n<\/ul><p>Some of these options require additional arguments to work. These arguments let you filter log results or customize the output format.<\/p><p>To see the full list of available options, use:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --help<\/pre><p>You can also combine multiple options to tailor log queries to your needs. For example:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -u nginx.service -p err -n 50 --since=2025-06-01 --output=json-pretty<\/pre><p>This command shows the last <strong>50<\/strong> error messages from the <strong>nginx.service<\/strong> unit, starting from <strong>June 1, 2025<\/strong>, in a readable JSON format.<\/p><h2 class=\"wp-block-heading\" id=\"h-how-to-use-journalctl\"><strong>How to use journalctl?<\/strong><\/h2><p>You can use <strong>journalctl<\/strong> to filter logs by time and source, customize the output format, tail and monitor logs in real time, and manage log data efficiently.<\/p><p>In the following sections, we&rsquo;ll show you how to use the <strong>journalctl<\/strong> command for each of these tasks.<\/p><h3 class=\"wp-block-heading\" id=\"h-filtering-logs-by-time\"><strong>Filtering logs by time<\/strong><\/h3><p>To filter logs by time, use <strong>journalctl<\/strong> with the <strong>-b<\/strong>, <strong>&ndash;list-boots<\/strong>, <strong>&ndash;since<\/strong>, or <strong>&ndash;until<\/strong> options. Here&rsquo;s how each one works:<\/p><p><strong>Current boot<\/strong><\/p><p>You can view logs from the current boot session by adding the <strong>-b<\/strong> option:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -b<\/pre><p>Use this command to troubleshoot issues that occur right after a fresh start or to track system activity since the last reboot.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c282560\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"412\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-b-1024x412.png\" alt=\"A terminal output shows logs from the current boot session\" class=\"wp-image-130778\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p><strong>Previous boots<\/strong><\/p><p>To view logs from a past boot, add the <strong>-b<\/strong> option with an offset. For example, use <strong>-b -1<\/strong> to see logs from the previous boot:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -b -1<\/pre><p>This command helps you track errors or unusual activity that happened after the last reboot.<\/p><p>Meanwhile, to list all previous boot sessions, use:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --list-boots<\/pre><p>It displays each boot session along with its timestamp, so you can easily choose which one to investigate.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c28313b\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"153\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-list-boots-1024x153.png\" alt=\"A terminal output shows all boot sessions with timestamps\" class=\"wp-image-130781\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p><strong>Time ranges<\/strong><\/p><p>If you want to filter logs within a specific time frame, combine <strong>&ndash;since<\/strong> and <strong>&ndash;until<\/strong> in your <strong>journalctl<\/strong> command. For example:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --since=2025-06-18 --until=2025-06-19<\/pre><p>This command shows logs between <strong>June 18<\/strong> and <strong>June 19, 2025<\/strong>.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c283f07\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"260\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-since-until-1024x260.png\" alt=\"A terminal output shows logs between June 18 and June 19, 2025\" class=\"wp-image-130782\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>You can also use relative time, such as:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --since=\"1 hour ago\"<\/pre><p>Use these time filters to investigate issues that happened during a specific period &ndash; for example, after a system update or during a maintenance window.<\/p><h3 class=\"wp-block-heading\" id=\"h-filtering-logs-by-source\"><strong>Filtering logs by source<\/strong><\/h3><p><strong>journalctl<\/strong> can filter logs by specific services, users, or the kernel. To do this, use the <strong>-u<\/strong>, <strong>_UID<\/strong>, <strong>_GID<\/strong>, <strong>_PID<\/strong>, or <strong>-k<\/strong> options.<\/p><p><strong>By service or unit<\/strong><\/p><p>To view logs for a specific systemd unit, run <strong>journalctl<\/strong> with the <strong>-u<\/strong> option. Here&rsquo;s an example of filtering logs for the NGINX service:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -u nginx.service<\/pre><p>Use this command to diagnose errors, performance issues, or unexpected behavior in a particular service.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c28636e\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"329\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-u-1024x329.png\" alt=\"A terminal output shows logs for the NGINX service\" class=\"wp-image-130784\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p><div class=\"protip\">\n                    <h4 class=\"title\"> &#128161; Pro tip<\/h4>\n                    <p> If you don&rsquo;t know the service name, you can <a href=\"\/ca\/tutorials\/manage-and-list-services-in-linux\">list services in Linux<\/a> using the <strong>systemctl list-units --type=service<\/strong> command.<\/p>\n                <\/div>\n\n\n\n<\/p><p><strong>By user ID, group ID, or PID<\/strong><\/p><p>To filter logs by user, group, or process ID (PID), use the <strong>_UID<\/strong>, <strong>_GID<\/strong>, or <strong>_PID<\/strong> options.<\/p><p>For instance, to view logs for a specific user ID, run the <strong>journalctl<\/strong> command below:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl _UID=0<\/pre><p>It shows logs related to the user with ID <strong>0<\/strong>.<\/p><p>Filtering logs by user ID is invaluable for troubleshooting issues related to user-specific activity or permission problems.<\/p><p><strong>Kernel logs only<\/strong><\/p><p>You can use <strong>journalctl<\/strong> to view kernel-related logs by adding the <strong>-k<\/strong> option:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -k<\/pre><p>This command displays kernel logs, including hardware events, driver messages, and kernel panics.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c287030\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"260\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-k-1024x260.png\" alt=\"A terminal output shows kernel-related logs\" class=\"wp-image-130785\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>Use it when troubleshooting low-level system issues like hardware failures or system crashes.<\/p><h3 class=\"wp-block-heading\" id=\"h-log-output-customization\"><strong>Log output customization<\/strong><\/h3><p><strong>journalctl<\/strong> offers several options, such as <strong>-o<\/strong> and <strong>&ndash;no-pager<\/strong>, to customize how it displays logs. Here&rsquo;s how you can modify the log output to suit your needs:<\/p><p><strong>Common output formats<\/strong><\/p><p>Use the <strong>-o<\/strong> option to choose from different output formats. Here are some of the most commonly used:<\/p><ul class=\"wp-block-list\">\n<li><strong>short<\/strong> &ndash; the default format, which shows concise and readable log entries.<\/li>\n\n\n\n<li><strong>verbose<\/strong> &ndash; displays detailed log entries with extra context like timestamps, unit names, and metadata.<\/li>\n\n\n\n<li><strong>json<\/strong> &ndash; outputs logs in JSON format, making it ideal for automation or log parsing.<\/li>\n\n\n\n<li><strong>cat<\/strong> &ndash; prints raw log messages without any formatting, similar to the<a href=\"\/ca\/tutorials\/linux-cat-command\"> cat command<\/a>.<\/li>\n\n\n\n<li><strong>export<\/strong> &ndash; saves logs in a binary format so you can transfer them between systems or re-import them for analysis.<\/li>\n<\/ul><p><strong>Printing full messages<\/strong><\/p><p>To display complete, untruncated log entries, run:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -o verbose<\/pre><p>This command gives you the full message content, which may be helpful when troubleshooting, as the default view cuts off important details.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c287b0f\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"260\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-o-verbose-1024x260.png\" alt=\"A terminal output shows logs with full message content\" class=\"wp-image-130786\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p><strong>Disabling pagination<\/strong><\/p><p>As mentioned earlier, you can disable pagination using the <strong>&ndash;no-pager<\/strong> option:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --no-pager<\/pre><p>This option is handy when you&rsquo;re processing logs with other tools or redirecting output to a file, as it ensures a smooth, uninterrupted data flow.<\/p><p>For instance, to redirect the output to a file, use the <strong>&gt;<\/strong> operator:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --no-pager &gt; output.log<\/pre><p>This <strong>journalctl<\/strong> command saves all output to a file named <strong>output.log<\/strong>.<\/p><p><strong>Customizing output for automation<\/strong><\/p><p>Customizing the output format is especially useful when integrating <strong>journalctl<\/strong> into scripts or automation tools.<\/p><p>For example, you can format logs in JSON and pipe them into the<a href=\"\/ca\/tutorials\/grep-command-in-linux\"> grep command<\/a> to extract specific entries:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -o json | grep \"error\"<\/pre><p>This command outputs logs in JSON and then filters for entries that contain the word &ldquo;<strong>error<\/strong>&rdquo;.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c28869e\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"323\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-o-json-grep-1024x323.png\" alt='A terminal output shows logs in JSON with entries contain the word \"error\"' class=\"wp-image-130787\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h3 class=\"wp-block-heading\" id=\"h-tail-and-monitor-logs-in-real-time\"><strong>Tail and monitor logs in real time<\/strong><\/h3><p>You can use <strong>journalctl<\/strong> to tail and monitor logs in real time. This is especially useful when you need to watch a service or track system activity as it happens.<\/p><p>Below are some common actions:<\/p><p><strong>Tail log<\/strong><\/p><p>To view the most recent log entries, use the <strong>-n<\/strong> option followed by the number of lines you want to display. For example:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -n 50<\/pre><p>This command shows the last <strong>50<\/strong> log entries. It&rsquo;s useful for a quick look at recent system activity without waiting for new entries.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c2890b0\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"286\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-n-1024x286.png\" alt=\"A terminal output shows the last 50 log entries\" class=\"wp-image-130788\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p><strong>Follow log entries<\/strong><\/p><p>If you want <strong>journalctl<\/strong> to continuously display new log entries as they appear, use the <strong>-f<\/strong> option:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -f<\/pre><p>To stop <strong>journalctl<\/strong> from displaying new entries, hit<strong> Ctrl + C<\/strong>.<\/p><p>It works like the<a href=\"\/ca\/tutorials\/how-to-use-tail-command\"> tail -f command<\/a>, showing logs in real time as the system or services generate them.<\/p><p><strong>Real-time monitoring for specific services<\/strong><\/p><p>You can combine <strong>-f<\/strong> with filters to monitor specific services. For instance, to follow real-time logs from the NGINX service, run:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -u nginx.service -f<\/pre><p>Use this command to monitor services like NGINX or SSH and track live performance, error messages, or other important events as they occur.<\/p><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c289ba6\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"76\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-u-f-1024x76.png\" alt=\"A terminal output shows real-time logs from the NGINX service\" class=\"wp-image-130789\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h3 class=\"wp-block-heading\" id=\"h-manage-journalctl-logs\"><strong>Manage journalctl logs<\/strong><\/h3><p><strong>journalctl<\/strong> provides several ways to manage log storage, rotate logs, and control how long logs are retained.<\/p><p>These practices help reduce disk usage and keep your system efficient, especially since logs can quickly consume significant space.<\/p><p><strong>Log rotation and space control<\/strong><\/p><p><strong>journalctl<\/strong> automatically handles log rotation, but you can manually configure limits to control storage usage and the number of retained log files.<\/p><p>To do this, open the <strong>journald.conf<\/strong> file with the<a href=\"\/ca\/tutorials\/how-to-install-and-use-nano-text-editor\"> nano text editor<\/a>:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo nano \/etc\/systemd\/journald.conf<\/pre><p>Use parameters such as <strong>SystemMaxUse<\/strong>, <strong>RuntimeMaxUse<\/strong>, and <strong>MaxFileSec<\/strong> to set limits on log size and retention time. For example, to limit logs to <strong>one gigabyte<\/strong>, uncomment the line and add a value like:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">SystemMaxUse=1G<\/pre><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c28a79b\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"416\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-nano-journald-conf-systemmaxuse-highlighted-1024x416.png\" alt=\"The journald.conf file's content in the nano text editor\" class=\"wp-image-130790\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>After editing the file, save and exit by pressing <strong>Ctrl + X &rarr; Y &rarr; Enter<\/strong>.<\/p><p><strong>Persistent logs<\/strong><\/p><p>By default, <strong>journalctl<\/strong> stores logs persistently, so they can survive across system reboots. To confirm or change this behavior, open the same<strong> journald.conf<\/strong> file.<\/p><p>Then, look for the <strong>Storage<\/strong> setting. If it&rsquo;s set to <strong>auto<\/strong>, systemd writes logs to disk if the persistent storage directory (<strong>\/var\/log\/journal\/<\/strong>) exists.<\/p><p>To force persistent logging, uncomment the line and set the value to:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Storage=persistent<\/pre><p>If you want to store logs only in memory during the current boot session, use:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Storage=volatile<\/pre><p><strong>Manually delete logs<\/strong><\/p><p>If logs exceed your configured limits or you want to clean up space manually, use the <strong>&ndash;vacuum<\/strong> options:<\/p><ul class=\"wp-block-list\">\n<li><strong>Vacuum by size<\/strong> &ndash; delete logs until total disk usage drops below the specified limit:<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --vacuum-size=1G<\/pre><ul class=\"wp-block-list\">\n<li><strong>Vacuum by time <\/strong>&ndash; remove logs older than a specific duration:<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --vacuum-time=1week<\/pre><ul class=\"wp-block-list\">\n<li><strong>Vacuum by file count<\/strong> &ndash; keep only the most recent log files:<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --vacuum-files=5<\/pre><p>Additionally, to check how much space journal logs are currently using, run:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --disk-usage<\/pre><div class=\"wp-block-image\"><figure data-wp-context='{\"imageId\":\"69e1e3c28b475\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"72\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/07\/terminal-journalctl-disk-usage-1024x72.png\" alt=\"A terminal output shows the journal logs' disk usage\" class=\"wp-image-130791\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h2 class=\"wp-block-heading\" id=\"h-journalctl-examples\"><strong>journalctl examples<\/strong><\/h2><p>Below are some real-world <strong>journalctl<\/strong> command examples to help you troubleshoot common system issues and better understand how to apply different filters and options.<\/p><p><strong>Troubleshoot a service failure<\/strong><\/p><ul class=\"wp-block-list\">\n<li><strong>Task<\/strong>: Investigate why the NGINX service failed to start after a reboot.<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -u nginx.service --since=\"2025-06-01 01:00:00\" --until=\"2025-06-01 02:00:00\"<\/pre><p>This command filters logs for the <strong>nginx.service<\/strong> unit on <strong>June 1, 2025<\/strong>, between <strong>1:00 AM<\/strong> and <strong>2:00 AM<\/strong>. Use it to pinpoint when and why the issue occurred.<\/p><p><strong>Real-time log monitoring for SSH brute-force attacks<\/strong><\/p><ul class=\"wp-block-list\">\n<li><strong>Task<\/strong>: Monitor the SSH service for signs of a brute-force attack, such as repeated failed login attempts.<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -u ssh.service -f | grep \"Failed password\"<\/pre><p>It combines<strong> journalctl -f<\/strong> with <strong>grep<\/strong> to actively monitor SSH logs in real time, filtering for entries that contain &ldquo;<strong>Failed password<\/strong>.&rdquo;<\/p><p><strong>Check logs after a system crash for hardware issues<\/strong><\/p><ul class=\"wp-block-list\">\n<li><strong>Task<\/strong>: Review kernel logs after a system crash to identify possible causes.<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -k --since=2025-06-01 --until=2025-06-02<\/pre><p>This command displays kernel logs between <strong>June 1<\/strong> and <strong>June 2, 2025<\/strong>. Use it to search for hardware failures or kernel panics around the time of the crash.<\/p><p><strong>Export logs for forensic analysis<\/strong><\/p><ul class=\"wp-block-list\">\n<li><strong>Task<\/strong>: Export system logs to a file for review after a potential security breach.<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --since=2025-06-01 --until=2025-06-10 &gt; system_logs_2025-06-01_to_06-10.log<\/pre><p>It exports logs from<strong> June 1<\/strong> to <strong>June 10, 2025<\/strong>, into a file named <strong>system_logs_2025-06-01_to_06-10.log<\/strong> for further analysis or auditing.<\/p><p><strong>Track system errors during an update process<\/strong><\/p><ul class=\"wp-block-list\">\n<li><strong>Task<\/strong>: Investigate unexpected behavior after a system update by checking error logs during the update window.<\/li>\n<\/ul><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl --since=\"2025-06-01 01:00:00\" --until=\"2025-06-01 03:00:00\" -p err<\/pre><p>This command filters logs between <strong>1:00 AM<\/strong> and <strong>3:00 AM<\/strong> on <strong>June 1, 2025<\/strong>, and shows only error-level entries (<strong>-p err<\/strong>) to help you diagnose what went wrong.<\/p><h2 class=\"wp-block-heading\" id=\"h-key-takeaways-on-using-journalctl\"><strong>Key takeaways on using journalctl<\/strong><\/h2><p>journalctl is a critical command-line tool for managing system logs on Linux, offering detailed filtering, real-time monitoring, and customizable outputs. Whether you&rsquo;re diagnosing a failed service or tracking kernel-level events, knowing how to use its options effectively helps you act faster and with greater precision.<\/p><p>For VPS users, mastering journalctl provides direct insight into your server&rsquo;s behavior, making it easier to resolve issues, optimize performance, and maintain uptime. As a next step, explore related tools like systemctl for managing services, or check out our tutorials on log rotation and Linux security best practices to deepen your knowledge.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The journalctl command is a powerful Linux utility for viewing, filtering, and managing system logs collected by systemd. It lets you inspect logs from services, users, or the kernel, troubleshoot boot errors, and monitor system activity in real time. In this guide, you&rsquo;ll learn how to use journalctl effectively &ndash; from basic syntax and command [&#8230;]<\/p>\n<p><a class=\"btn btn-secondary understrap-read-more-link\" href=\"\/ca\/tutorials\/journalctl-command\">Read More&#8230;<\/a><\/p>\n","protected":false},"author":411,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"journalctl command in Linux","rank_math_description":"Learn how to use the journalctl command in Linux to view, filter, and manage system logs for troubleshooting and real-time monitoring.","rank_math_focus_keyword":"journalctl command","footnotes":""},"categories":[22703,22699],"tags":[],"class_list":["post-130774","post","type-post","status-publish","format-standard","hentry","category-managing-monitoring-and-security","category-vps"],"hreflangs":[{"locale":"en-US","link":"https:\/\/www.hostinger.com\/tutorials\/journalctl-command","default":0},{"locale":"en-CA","link":"https:\/\/www.hostinger.com\/ca\/tutorials\/journalctl-command","default":0},{"locale":"en-UK","link":"https:\/\/www.hostinger.com\/uk\/tutorials\/journalctl-command","default":0},{"locale":"en-PH","link":"https:\/\/www.hostinger.com\/ph\/tutorials\/journalctl-command","default":0},{"locale":"en-MY","link":"https:\/\/www.hostinger.com\/my\/tutorials\/journalctl-command","default":0},{"locale":"en-IN","link":"https:\/\/www.hostinger.com\/in\/tutorials\/journalctl-command","default":0},{"locale":"en-AU","link":"https:\/\/www.hostinger.com\/au\/tutorials\/journalctl-command","default":0},{"locale":"en-NG","link":"https:\/\/www.hostinger.com\/ng\/tutorials\/journalctl-command","default":0}],"_links":{"self":[{"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/posts\/130774","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/users\/411"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/comments?post=130774"}],"version-history":[{"count":8,"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/posts\/130774\/revisions"}],"predecessor-version":[{"id":136940,"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/posts\/130774\/revisions\/136940"}],"wp:attachment":[{"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/media?parent=130774"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/categories?post=130774"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostinger.com\/ca\/tutorials\/wp-json\/wp\/v2\/tags?post=130774"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}