Part II · Your system
26.1 Reading the journal with journalctl
alsojournalctljournalctl -fjournalctl -bjournalctl -pjournaldsystemd journallog priorityfollow logsprevious boot logsjournalctl -g
TL;DR
- systemd's journal collects everything: the kernel, every service's output, and programs that log through syslog. One command reads it.
- Narrow it down: by boot (
-b), unit (-u), priority (-p), time (--since), text (-g).-ffollows new lines as they come. - Reading other users' and system logs needs
sudo, or membership inadmorsystemd-journal.
journalctl -b -p warning # warnings and worse, this boot
journalctl -u nginx --since "1 hour ago"
journalctl -f -u myapp # follow one service
journalctl -b -1 -e # end of the previous boot
On your machine
$ atfq 26.1 Journal on disk (/var/log/journal): kept across reboots · 300 B in 2 files Settings SystemMaxUse=500M Syslog rsyslog also writes text files in /var/log Rotation 2 rules in /etc/logrotate.d Biggest /var/log/syslog 4.9 KiB · /var/log/nginx/access.log 2.9 KiB · /var/log/auth.log 1.2 KiB
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
-b -1shows nothing: the journal is kept in RAM only, so earlier boots are gone (26.2).- Priorities count down:
-p errmeans error and worse (crit, alert, emerg), not just errors. --sincetakes local time;--utcshows and parses times in UTC.- Output goes through a pager:
--no-pagerfor scripts,-o jsonto parse it.
Deep dive 2 questions
What is stored besides the message?
Each entry carries fields: _SYSTEMD_UNIT, _PID, _UID, _COMM,
PRIORITY, the boot ID and more, set by journald itself so programs
can't fake them. Any field filters: journalctl _UID=1000,
journalctl _COMM=sshd. journalctl -o verbose shows them all.
Why a binary format?
Indexed by field and time, so filtering a month of logs by unit is
instant, and entries can be checked for tampering (--verify). The
cost: you need journalctl to read them, not grep on a file.