journalctl Recipes You'll Actually Use

journalctl -u nginx.service                 # everything from this unit
journalctl -u nginx -u php-fpm              # merge two units, time-ordered
journalctl -u 'ssh*'                         # glob
journalctl _SYSTEMD_UNIT=nginx.service      # exact, includes stderr the unit wrote

journalctl --since "2026-08-27 09:00" --until "2026-08-27 09:15"
journalctl --since "1 hour ago"
journalctl --since yesterday
journalctl -u nginx --since "10 min ago"

journalctl --list-boots            # index, boot ID, first/last timestamp
journalctl -b                      # current boot only
journalctl -b -1                   # the previous boot (post-crash forensics)
journalctl -k -b -1                # kernel messages from the previous boot

journalctl -p err                  # err and worse (crit, alert, emerg)
journalctl -p warning..err         # a range
journalctl -b -p 3                  # numeric: 0 emerg ... 7 debug

journalctl -u myapp -f             # tail -f equivalent
journalctl -u myapp -f -o cat      # just the message, no timestamp/host prefix
journalctl -fn 50 -u myapp         # start with the last 50 lines, then follow

journalctl _PID=12345
journalctl _UID=1000
journalctl /usr/sbin/sshd          # by executable path — great for auth logs
journalctl _COMM=sudo              # by command name

journalctl -u myapp --since today -o json-pretty
journalctl -u myapp -o json | jq -r 'select(.PRIORITY <= "3") | .MESSAGE'
journalctl -u myapp --output=export      # for shipping elsewhere

journalctl --disk-usage
journalctl --vacuum-time=14d       # delete entries older than 14 days
journalctl --vacuum-size=500M      # cap total size
journalctl --verify                # check for corruption

sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald

[Journal]
Storage=persistent
SystemMaxUse=1G
SystemKeepFree=2G
MaxRetentionSec=1month