journalctl Cheat Sheet

Query the systemd journal — filter by unit, boot, time, priority, and follow live output.

Troubleshooting3 sections · 21 commands

⌘K

journalctl

All logs, oldest first

journalctl -n 50

Last 50 lines

journalctl -f

Follow live output

journalctl -r

Newest first

journalctl --no-pager

Print without a pager

journalctl -k

Kernel messages only

journalctl -u nginx.service

One unit's logs

journalctl -u a -u b

Multiple units

journalctl -b

Current boot only

journalctl -b -1

Previous boot

journalctl --since '1 hour ago'

Relative time window

journalctl --until yesterday

Until a date/time

journalctl -p err

Priority err and above

journalctl _PID=123

Logs from one PID

journalctl _SYSTEMD_UNIT=nginx.service

Filter by internal field

journalctl --disk-usage

Journal size on disk

journalctl --vacuum-size=500M

Trim journal to 500 MB

journalctl --vacuum-time=7d

Keep only 7 days

journalctl --verify

Check journal integrity

journalctl -o json

Export entries as JSON

journalctl --output=short-precise

With microsecond timestamps