journalctl — The systemd Log Viewer

journalctl reads the systemd journal — a centralized log of everything: kernel messages, service output, boot events.

View all logs

journalctl
journalctl -r          # Reverse order (newest first)

Follow logs live (like tail -f)

journalctl -f

Logs for one service

journalctl -u nginx
journalctl -u nginx -f            # Follow live
journalctl -u nginx --since today

Filter by time

journalctl --since "2024-01-15"
journalctl --since "1 hour ago"
journalctl --since "09:00" --until "10:00"

Filter by priority (errors only)

journalctl -p err
journalctl -p err -u nginx

Logs since last boot

journalctl -b            # Current boot
journalctl -b -1         # Previous boot

Limit output

journalctl -n 50         # Last 50 lines
journalctl -u nginx -n 20 --no-pager