Journalctl — Debugging and Log Analysis

Systemd journal captures logs from services, kernel and other sources. Journalctl offers powerful filtering better than grep in /var/log.

Basics¶

journalctl -u nginx journalctl -fu nginx journalctl -n 50 -u myapp

Filtering¶

journalctl –since ‘1 hour ago’ journalctl –since today journalctl -b journalctl -p err journalctl -k

Formats and grep¶

journalctl -u nginx -o json-pretty journalctl -u nginx -o cat journalctl -u myapp –grep ‘error’

Management¶

journalctl –disk-usage journalctl –vacuum-size=500M journalctl –vacuum-time=30d

Journal is your friend¶

Powerful log filtering. For centralized logging consider Elasticsearch or Loki.