fren
Log In

Read logs with journalctl

2 min read07 November 2026

Systemd collects kernel, service and authentication messages in a binary journal. journalctl queries it far more precisely than grep in /var/log/syslog. It is the first tool to open when a service refuses to start or stops without explanation.

Useful filters

Bash
journalctl -u nginx
journalctl -u nginx -f
journalctl -u nginx --since "1 hour ago"
journalctl -u nginx --since today --until "12:00"
journalctl -p err -b
journalctl -n 100 --no-pager
  • -u targets a systemd unit.
  • -f follows the journal live, like tail -f.
  • --since and --until accept a date, a time or a relative expression.
  • -p err keeps priority err and above (warning, err, crit, alert, emerg).
  • -b limits to the current boot, -b -1 to the previous one.
  • --no-pager avoids opening less, which is useful in a script.

Filters combine:

Bash
journalctl -u my-app -b -p err --no-pager

Find a boot error

Bash
systemctl status my-app -l --no-pager
journalctl -u my-app -b -p err
journalctl -b -p err

status shows the exit code and last lines. Typical messages are "Failed to start", "address already in use", a missing path or a permission denial. journalctl -b -p err lists every error from the current boot, including units you have not identified yet.

For a service that failed before the current boot:

Bash
journalctl -u my-app -b -1

Since systemd 240, -g filters content: journalctl -u nginx -g 'error'. Otherwise pipe to grep, but remember the output is paginated by default.

Control storage and rotation

Bash
journalctl --disk-usage

By default Debian may keep the journal in memory (/run/log/journal), so it is lost on reboot. For persistent history:

Bash
sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald

Then cap the size in /etc/systemd/journald.conf:

INI
[Journal]
SystemMaxUse=500M
SystemMaxFileSize=50M

Then sudo systemctl restart systemd-journald. To shrink immediately:

Bash
sudo journalctl --vacuum-size=200M
sudo journalctl --vacuum-time=14d

These delete the oldest entries. Keep enough history to diagnose an incident that started days ago.

Access and privacy

A regular user only sees their own messages. To read the whole journal, add them to the systemd-journal or adm group, then log in again:

Bash
sudo usermod -aG systemd-journal utilisateur

Logs can contain tokens, URLs with parameters or email addresses. Never paste raw output on a public forum without reviewing it and masking secrets. Restricting read access is also a security measure.

Verify

After fixing a service, filter the last five minutes and confirm there is no error:

Bash
journalctl -u my-app --since "5 min ago" -p warning
journalctl --disk-usage

If the journal grows abnormally, look for a service writing in a loop before raising the limit.

Advertisement

Was this article helpful?

Read next