journalctl cheat sheet

Filter systemd logs precisely instead of scrolling forever – everyday journalctl commands, searchable and copyable in one click.

31 commands

Basics

Show the last 100 lines
journalctl -n 100
Follow new entries live (like tail -f)
journalctl -f
Show newest entries first
journalctl -r
Jump to the end with explanations (after failures)
journalctl -xe
Write output to a file without pager
journalctl --no-pager -n 500 > journal.txt

Show logs of a systemd unit
journalctl -u nginx
Follow a unit's logs live
journalctl -u nginx -f
Show several units interleaved
journalctl -u nginx -u php8.3-fpm --since "10 min ago"
Entries from a specific process (PID)
journalctl _PID=1234
Entries from a user (UID 33 = www-data)
journalctl _UID=33
Filter by syslog identifier
journalctl -t sshd
List all units present in the journal
journalctl -F _SYSTEMD_UNIT

List all stored boots with index
journalctl --list-boots
Logs since the current boot
journalctl -b
Errors from the previous boot (after a crash)
journalctl -b -1 -p err
Kernel messages only (like dmesg)
journalctl -k
Look for OOM killer events in the last boot
journalctl -k -b -1 | grep -i -E 'oom|killed process'

Entries from the last hour
journalctl --since "1 hour ago"
Narrow down an exact time window
journalctl --since "2026-10-01 08:00" --until "2026-10-01 12:00"
A unit's logs from yesterday
journalctl -u nginx --since yesterday --until today
Only errors and worse since boot
journalctl -p err -b
Priority range warning to error
journalctl -p warning..err --since today
Search by pattern (regex, case-insensitive)
journalctl -u sshd -g "Failed password"

Show journal disk usage
journalctl --disk-usage
Delete archived logs older than 2 weeks
sudo journalctl --vacuum-time=2weeks
⚠ Careful: changes or deletes data
Shrink archived logs to 500 MB
sudo journalctl --vacuum-size=500M
⚠ Careful: changes or deletes data
Rotate active journal files (before vacuum)
sudo journalctl --rotate
Check journal files for corruption
sudo journalctl --verify