systemd and journalctl cheatsheet

systemd and journalctl: Logs with journalctl

9 common systemd and journalctl tasks.

Show a service's logs

Show all log entries for a unit.

journalctl -u nginx

Stream new log entries as they arrive.

journalctl -u nginx -f

Show entries from the last hour.

journalctl -u nginx --since "1 hour ago"

Show messages of priority error and worse since the last boot.

journalctl -b -p err

Read logs from the boot before this one, for example after a crash.

journalctl -b -1

Show kernel log entries, like dmesg.

journalctl -k

Show the last 100 lines without paging.

journalctl -n 100 --no-pager

Show the disk space used by the journal.

journalctl --disk-usage

Remove journal entries older than seven days.

sudo journalctl --vacuum-time=7d

Caution: Deleted log entries cannot be recovered.