Show logs since a specific time

journalctl --since yesterday
journalctl --since "1 hour ago"
journalctl --since "2020-09-03 12:34"

Show logs for a specific systemd unit

journalctl -u haproxy.service

Show logs for several units together

journalctl -u varnish.service -u hitch.service --since today

Show logs by executable

journalctl /usr/bin/bash

Display kernel messages

journalctl -k

Output journal entires as JSON

journalctl -b -u nobody -o json

or formatted JSON

journalctl -b -u nobody -o json-pretty

Supported output formats:

  • cat: Only the message field
  • export: Binary format for backup or transfer
  • json: One-line per entry standard JSON
  • json-pretty: Human readable JSON
  • json-sse: Server-sent event compatible JSON
  • short: Default syslog style output
  • short-iso: Default with ISO 8601 timestamps (YYYY-MM-DDTHH:mm:SS+TZ)
  • short-monotonic: Default with monotonic timestamps since boot ([    1.817288])
  • short-precise: Default with microsecond precision timestamps (Aug 24 18:49:58.244998)
  • verbose: Include every available field in each journal entry

Show the n most recent entries (defaults to 10)

journalctl -n n

Follow logs

journalctl -f

Show current journal disk consumption

journalctl --disk-usage

Delete old journal entries

journalctl --vacuum-size=1G
journalctl --vacuum-time=1years