Skip to content
RunEntLinux
RunEntLinux
Docs networkNetwork
Search RunEntLinux

Searches general documentation on RunEntLinux. Each distribution has its own documentation search.

    Browse this documentation

    Journal Logs

    systemd’s built-in logging system journald collects and stores all system logs, including kernel messages, service output, and system events. journalctl is the command-line tool for querying these logs, offering more powerful filtering and search capabilities than the traditional /var/log/messages.

    Basic journalctl Usage

    Section titled “Basic journalctl Usage”

    View All Logs

    Section titled “View All Logs”
    View all system logs (from oldest to newest)
    sudo journalctl

    Logs are displayed through a pager by default. You can scroll with the arrow keys and press q to exit.

    View Recent Logs

    Section titled “View Recent Logs”
    View the 20 most recent log entries
    sudo journalctl -n 20

    Follow Logs in Real Time

    Section titled “Follow Logs in Real Time”

    Similar to tail -f, this displays new log entries as they are produced:

    Follow system log output in real time
    sudo journalctl -f

    View Logs in Reverse Order (Newest First)

    Section titled “View Logs in Reverse Order (Newest First)”
    View logs starting from the newest
    sudo journalctl -r

    Output Without a Pager

    Section titled “Output Without a Pager”

    When you need to pipe logs to other tools:

    Output logs to stdout (no paging)
    sudo journalctl --no-pager -n 100

    Output in Other Formats

    Section titled “Output in Other Formats”
    Output logs in JSON format
    sudo journalctl -o json-pretty -n 5

    Common output formats:

    FormatDescription
    short (default)Similar to traditional syslog format
    short-isoUses ISO 8601 timestamps
    verboseDisplays all fields
    jsonJSON format (one entry per line)
    json-prettyFormatted JSON
    catShows only the message content, without timestamps or other metadata

    Filtering by Service

    Section titled “Filtering by Service”

    View Logs for a Specific Service

    Section titled “View Logs for a Specific Service”
    View Nginx service logs
    sudo journalctl -u nginx.service

    The -u parameter allows omitting the .service suffix:

    Shorthand form
    sudo journalctl -u nginx

    View Multiple Services Simultaneously

    Section titled “View Multiple Services Simultaneously”
    View logs for both Nginx and PHP-FPM
    sudo journalctl -u nginx -u php-fpm

    Follow a Specific Service in Real Time

    Section titled “Follow a Specific Service in Real Time”
    Follow sshd service logs in real time
    sudo journalctl -u sshd -f

    Filtering by Time

    Section titled “Filtering by Time”

    View Logs for a Specific Time Period

    Section titled “View Logs for a Specific Time Period”
    View today's logs
    sudo journalctl --since today
    View yesterday's logs
    sudo journalctl --since yesterday --until today
    View logs for a specific time range
    sudo journalctl --since "2026-03-24 08:00:00" --until "2026-03-24 12:00:00"

    Using Relative Time

    Section titled “Using Relative Time”
    View logs from the last hour
    sudo journalctl --since "1 hour ago"
    View logs from the last 30 minutes
    sudo journalctl --since "30 min ago"

    View Logs from the Current Boot

    Section titled “View Logs from the Current Boot”
    View only logs since the current boot
    sudo journalctl -b
    View logs from the previous boot (troubleshoot pre-reboot issues)
    sudo journalctl -b -1
    List all recorded boot sessions
    journalctl --list-boots

    Filtering by Priority

    Section titled “Filtering by Priority”

    journald log priorities are consistent with syslog:

    PriorityValueDescription
    emerg0System is unusable
    alert1Immediate action required
    crit2Critical error
    err3General error
    warning4Warning
    notice5Normal but noteworthy
    info6Informational
    debug7Debug information
    View only error-level and above logs
    sudo journalctl -p err
    View logs from warning to error level
    sudo journalctl -p warning..err

    Combining Filter Conditions

    Section titled “Combining Filter Conditions”

    Multiple filter conditions can be freely combined:

    View today's sshd error logs
    sudo journalctl -u sshd -p err --since today

    Filtering by Other Criteria

    Section titled “Filtering by Other Criteria”

    Filter by Process PID

    Section titled “Filter by Process PID”
    View logs for a specific PID
    sudo journalctl _PID=1234

    Filter by User

    Section titled “Filter by User”
    View logs generated by a specific user
    sudo journalctl _UID=1000

    Filter by Executable Path

    Section titled “Filter by Executable Path”
    View logs generated by a specific program
    sudo journalctl _EXE=/usr/sbin/sshd

    View Kernel Logs

    Section titled “View Kernel Logs”
    View only kernel messages (similar to dmesg)
    sudo journalctl -k

    Configuring Persistent Storage

    Section titled “Configuring Persistent Storage”

    By default, some EL systems store journald logs in memory (/run/log/journal/), which are lost after a reboot. To enable persistent storage, follow these steps:

    Create the Persistent Storage Directory

    Section titled “Create the Persistent Storage Directory”
    Create the journal persistent storage directory
    sudo mkdir -p /var/log/journal

    Modify the journald Configuration

    Section titled “Modify the journald Configuration”
    Edit the journald configuration file
    sudo vim /etc/systemd/journald.conf

    Find the [Journal] section and modify or add the following:

    /etc/systemd/journald.conf key configuration
    [Journal]
    Storage=persistent

    Storage= options:

    ValueDescription
    auto (default)Persist if /var/log/journal/ exists, otherwise store in memory
    persistentAlways persist, automatically creates the directory
    volatileStore only in memory
    noneDo not store logs

    Restart journald for the Configuration to Take Effect

    Section titled “Restart journald for the Configuration to Take Effect”
    Restart the systemd-journald service
    sudo systemctl restart systemd-journald

    Verify Persistence is Working

    Section titled “Verify Persistence is Working”
    Confirm log files are being written to disk
    ls -la /var/log/journal/

    Managing Log Disk Usage

    Section titled “Managing Log Disk Usage”

    Over time, logs can consume significant disk space. journald provides several ways to control log size.

    Check Current Log Disk Usage

    Section titled “Check Current Log Disk Usage”
    View the disk space used by journal logs
    sudo journalctl --disk-usage

    Clean Up by Size

    Section titled “Clean Up by Size”
    Reduce log files to under 500MB
    sudo journalctl --vacuum-size=500M

    Clean Up by Time

    Section titled “Clean Up by Time”
    Delete logs older than 30 days
    sudo journalctl --vacuum-time=30d

    Clean Up by File Count

    Section titled “Clean Up by File Count”
    Keep only the 5 most recent log files
    sudo journalctl --vacuum-files=5

    Configure Automatic Limits

    Section titled “Configure Automatic Limits”

    Edit /etc/systemd/journald.conf to set long-term limits:

    /etc/systemd/journald.conf space limit configuration
    [Journal]
    Storage=persistent
    # Maximum disk space for persistent logs
    SystemMaxUse=1G
    # Minimum free disk space to reserve for persistent logs
    SystemKeepFree=2G
    # Maximum size of a single log file
    SystemMaxFileSize=100M
    # Maximum memory used by runtime logs
    RuntimeMaxUse=200M

    Restart journald after making changes:

    Restart journald for limit configuration to take effect
    sudo systemctl restart systemd-journald

    Practical Tips

    Section titled “Practical Tips”

    Search for Keywords in Logs

    Section titled “Search for Keywords in Logs”
    Search for 502 errors in Nginx logs
    sudo journalctl -u nginx --no-pager | grep "502"

    View the Last Failure Log of a Service

    Section titled “View the Last Failure Log of a Service”
    View the full log from a service's most recent startup failure
    sudo journalctl -u myapp.service -b --no-pager -n 50

    Export Logs to a File

    Section titled “Export Logs to a File”
    Export today's system logs to a file
    sudo journalctl --since today --no-pager > /tmp/today-logs.txt

    View Log Fields (for Precise Filtering)

    Section titled “View Log Fields (for Precise Filtering)”
    List all available filter fields in the logs
    sudo journalctl -o verbose -n 1