Linux Command #28 covers journalctl, the command-line interface for reading and filtering logs collected by systemd-journald. For technicians and administrators, it is one of the fastest ways to investigate failed services, boot problems, authentication events, and other system behavior.

Start With the Journal

journalctl

Running the command without filters displays journal entries available to your account. Because a busy system can produce a large amount of output, practical troubleshooting usually starts by narrowing the results.

Current Boot

journalctl -b

The -b option limits output to the current boot. This is useful when a server, workstation, or data-center system developed a problem after its most recent restart.

Inspect One Service

journalctl -u ssh
journalctl -u nginx
journalctl -u docker

The -u option filters by a systemd unit. Substitute the actual service name on your system. This is especially useful after systemctl status reports that a service failed.

Watch Logs Live

journalctl -u ssh -f

The -f option follows new journal entries as they arrive. A technician can keep this running while reproducing a fault in another terminal.

Filter by Time

journalctl --since "1 hour ago"
journalctl --since "today"
journalctl -u ssh --since "yesterday"

Time filtering reduces noise when you know approximately when an incident occurred.

Show Errors

journalctl -p err
journalctl -b -p err

The priority filter can isolate higher-severity messages. Combining it with -b is a useful first check after a problematic boot.

Kernel Messages

journalctl -k
journalctl -k -b

Kernel messages can reveal hardware detection, storage, driver, networking, and other low-level problems. In data-center troubleshooting, these entries can help distinguish an application failure from an operating-system or hardware issue.

A Practical Troubleshooting Pattern

systemctl status ssh
journalctl -u ssh -b
journalctl -u ssh --since "30 minutes ago"
journalctl -u ssh -f

First check service status. Then inspect that service’s current-boot history, narrow the time window, and finally follow the log while reproducing the problem. This workflow turns a large journal into a focused diagnostic trail.

Be Careful With Log Cleanup

journalctl also supports journal maintenance and vacuum operations. Do not remove logs casually. Production environments may have operational, security, audit, or retention requirements. Preserve evidence before deleting historical records.

Video Reference

Learn Linux TV demonstrates the command directly, including service filtering, live follow mode, SSH troubleshooting, time filters, user filtering, and journal maintenance.

Practice

On a systemd-based Linux test machine, identify one running service with systemctl. Use journalctl -u to inspect its logs, restrict the results to the current boot, then follow new entries live. The goal is to become comfortable moving from a broad system view to a precise service and time window.

Reference: systemd journal documentation and Learn Linux TV’s Linux Crash Course lesson on journalctl.