Skip to content

journalctl

Synopsis

journalctl [OPTIONS…] [MATCHES…]

Description

journalctl reads the systemd journal, the structured log kept by systemd-journald. Without options it shows every entry the caller may read, oldest first, in a pager. Options and matches narrow the selection, change the output format, or run maintenance commands on the journal files.

Root, and members of the systemd-journal and adm groups, can read the whole system journal; on the RHEL family and Arch, members of wheel can too. Other users see only their own entries, and journalctl prints a hint saying so.

Checked against systemd 257 on Debian 13, AlmaLinux 10 and Rocky Linux 10, systemd 259 on Ubuntu 26.04, and systemd 262 on Arch Linux (November 2026). The options below behave the same in all three versions unless stated otherwise.

Gentoo with OpenRC

Gentoo with OpenRC has no journal and no journalctl: logs go to the syslog daemon the administrator installed (Gentoo has no default; the lab uses sysklogd), which writes text files under /var/log. journalctl exists on Gentoo only with a systemd profile (package sys-apps/systemd; not checked in a lab).

Selecting entries

Source

Option Selects
--system The system journal only
--user The current user's journal only (needs persistent storage)
-m, --merge Entries from all available journals, including remote ones
-D DIR, --directory=DIR Journal files in a directory, for example from another machine
-i FILE, --file=FILE One journal file (glob patterns allowed)
--root=DIR, --image=IMAGE The journal of an operating system tree or disk image, for example from a rescue system
-M NAME, --machine=NAME The journal of a local container
--namespace=NAME A journal namespace other than the default

Filters

Option Selects
-u UNIT, --unit=UNIT Entries from a unit, including systemd's messages about it; the .service suffix may be omitted, glob patterns are allowed, and the option can be repeated
--user-unit=UNIT Entries from a user service manager's unit
-I Entries from the latest invocation (run) of the unit given with -u
--invocation=ID Entries from one invocation of a unit (IDs are listed by --list-invocations)
-t ID, --identifier=ID Entries with this syslog identifier (the program name or the logger -t tag); repeatable
-T ID, --exclude-identifier=ID Hide entries with this syslog identifier
-p PRIO, --priority=PRIO Entries of this priority or more severe; FROM..TO selects a range
--facility=FACILITY Entries with these syslog facilities, by name or number, comma-separated; --facility=help lists them
-k, --dmesg Kernel messages only, from the current boot unless -b says otherwise
-g PATTERN, --grep=PATTERN Entries whose message matches a PCRE2 regular expression
--case-sensitive[=BOOL] Force case-sensitive or case-insensitive matching for -g; by default, matching is case-insensitive if the pattern is all lower case
-S DATE, --since=DATE Entries at or after this time
-U DATE, --until=DATE Entries at or before this time
-b [ID][±OFFSET], --boot[=…] Entries from one boot (see Boot specifications)
-c CURSOR, --cursor=CURSOR Start at the entry with this cursor
--after-cursor=CURSOR Start after the entry with this cursor
--cursor-file=FILE Start after the cursor stored in the file, and store the last cursor shown there

Priorities, from most to least severe: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), debug (7). -p err therefore shows err, crit, alert and emerg entries; -p warning..err shows warning and err only.

Matches

Arguments of the form FIELD=VALUE select entries whose field has exactly that value.

Form Meaning
F=a Field F equals a
F=a F=b The same field twice: F equals a or b
F=a G=b Different fields: F equals a and G equals b
F=a + G=b + separates alternatives: the entries matching either side
/usr/sbin/sshd A path to an executable: shorthand for _EXE=/usr/sbin/sshd
/dev/sda A path to a device node: kernel entries about that device

Commonly used fields (fields whose names begin with _ are set by journald and can't be faked by the sender):

Field Content
MESSAGE The message text
PRIORITY Severity, 0–7
SYSLOG_FACILITY Facility number
SYSLOG_IDENTIFIER Program name or tag
_PID, _UID, _GID Process, user and group of the sender
_COMM, _EXE, _CMDLINE Command name, executable path and command line of the sender
_SYSTEMD_UNIT The unit the sender belongs to
_BOOT_ID The boot the entry belongs to
_HOSTNAME Host name when the entry was written
_TRANSPORT How it arrived: journal, syslog, stdout, kernel, audit, driver

journalctl -N lists the field names in use, and journalctl -F FIELD lists the values a field takes.

Time specifications

--since and --until accept:

Form Example
Date and time "2026-11-07 13:35:00", "2026-11-07 13:35", 2026-11-07 (midnight)
Time only (today) 13:35, "13:35:20"
Words now, today, yesterday, tomorrow
Relative -1h, "-30min", "1 hour ago", "2 days ago"
Epoch seconds @1794058733

Times are local unless followed by a time zone, such as UTC.

Boot specifications

Form Selects
-b or -b 0 The current boot
-b -1, -b -2, … The previous boot, the one before it, …
-b 1, -b 2, … The first boot recorded, the second, …
-b ID The boot with this 128-bit ID (from --list-boots)
-b ID±N N boots after or before that boot
--list-boots List recorded boots with their offset, ID and first and last entry

Earlier boots are available only if the journal is persistent. With a volatile journal, -b -1 prints Specifying boot ID or boot offset has no effect, no persistent journal was found. and shows the current boot; with a persistent journal that has no such boot, it fails with No journal boot entry found for the specified boot (-1).

Output

Option Effect
-o MODE, --output=MODE Output format; see the table below
--output-fields=LIST Fields to show in verbose, export and json modes
-n [N], --lines[=N] Show the last N entries (10 if N is omitted); +N shows the first N
-r, --reverse Newest entries first
-f, --follow Show the last entries, then new entries as they arrive
--no-tail With -f, show all matching entries, not only the last ten
-e, --pager-end Jump to the end in the pager; implies -n1000
--no-pager Write to standard output instead of a pager
-x, --catalog Add explanatory text from the message catalogue where it exists
-a, --all Show all fields in full, including long and unprintable ones
--no-full Shorten fields that don't fit the terminal width
--no-hostname Omit the host name (systemd 259 and later also accept -W)
--utc Show times in UTC
-q, --quiet Suppress informational messages, such as the hint about missing permissions
--show-cursor Print the cursor of the last entry
Mode Format
short Default: syslog-like, Nov 07 13:40:02 host program[PID]: message
short-iso, short-iso-precise As short, with ISO 8601 timestamps (with microseconds)
short-precise, short-full, short-unix As short, with microseconds, with a full date and weekday, or as seconds since the epoch
short-monotonic, short-delta As short, with time since boot (and since the previous entry)
with-unit As short-full, with the unit name instead of the program name
cat The message text only
verbose Every field of every entry
json, json-pretty, json-sse, json-seq JSON: one entry per line, formatted, as server-sent events, or as JSON text sequences
export The binary-safe export format, for systemd-journal-remote and backups

-o help lists the modes the installed version supports.

Maintenance commands

Command Effect
--disk-usage Show the space used by all journal files
--vacuum-size=SIZE Delete the oldest archived files until the journal uses less than SIZE (K, M, G, T)
--vacuum-time=TIME Delete archived files whose entries are all older than TIME (2weeks, 3months)
--vacuum-files=N Keep at most N archived files
--rotate Archive the active journal files and start new ones; combined with a --vacuum-* option, rotation happens first
--flush Move entries from the volatile journal (/run/log/journal) into the persistent one (/var/log/journal)
--relinquish-var Stop writing to /var/log/journal and write to /run/log/journal until the next flush
--sync Write all unwritten entries to disk
--verify Check the journal files for internal consistency
--header Show the header of each journal file, including its path
--list-invocations List the invocation IDs of the unit given with -u
--list-namespaces List journal namespaces
-N, --fields List the field names in use
-F FIELD, --field=FIELD List the values of a field
--list-catalog, --dump-catalog, --update-catalog Show or rebuild the message catalogue
--setup-keys, --verify-key=KEY, --interval=TIME Forward Secure Sealing: create a key pair, verify sealed files, set the key change interval

Vacuuming removes only archived files; active files stay in place, so the journal may still exceed the requested size until they're rotated.

Storage settings

systemd-journald reads its settings from /etc/systemd/journald.conf, or /usr/lib/systemd/journald.conf where the distribution ships it there, and from drop-in files in /etc/systemd/journald.conf.d/*.conf, /run/systemd/journald.conf.d/ and /usr/lib/systemd/journald.conf.d/. systemd-analyze cat-config systemd/journald.conf shows the combined result. Settings go in the [Journal] section; restart systemd-journald to apply them.

Setting Effect Default
Storage= volatile (memory, /run/log/journal), persistent (/var/log/journal, created if needed), auto (persistent only if /var/log/journal exists), none auto in systemd 257; persistent in systemd 259 and 262
SystemMaxUse= Maximum disk space for the persistent journal 10% of the filesystem, at most 4G
SystemKeepFree= Disk space to leave free on the filesystem 15% of the filesystem, at most 4G
SystemMaxFileSize= Maximum size of one journal file, the unit of deletion One eighth of SystemMaxUse=, at most 128M
SystemMaxFiles= Maximum number of archived files 100
RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize=, RuntimeMaxFiles= The same, for the volatile journal in /run/log/journal As above, of the /run filesystem
MaxRetentionSec= Delete entries older than this (3month, 30day); 0 turns this off 0
MaxFileSec= Rotate a journal file after this time 1month
Compress= Compress large entries yes
ForwardToSyslog= Also pass entries to a syslog daemon's socket no upstream; Debian and Ubuntu set yes in /usr/lib/systemd/journald.conf.d/syslog.conf
MaxLevelStore=, MaxLevelSyslog= Least severe priority stored, or forwarded to syslog debug
RateLimitIntervalSec=, RateLimitBurst= Drop a service's messages beyond this many per interval 30s, 10000

Sizes take the suffixes K, M, G, T (powers of 1024). journald respects both SystemMaxUse= and SystemKeepFree=, using whichever leaves the journal smaller. Like vacuuming, the limits delete only archived files.

Examples

journalctl -u ssh.service -b                         # one unit, current boot
journalctl -u nginx -p warning --since today         # warnings and worse from a unit today
journalctl -b -1 -p err                              # errors from the previous boot
journalctl -k -g 'oom|killed process'                # kernel messages about the OOM killer
journalctl -t sudo --since "1 hour ago"              # entries from one program by tag
journalctl _UID=1000 _COMM=bash                      # matches on fields
journalctl -f -u myapp.service                       # follow one unit
journalctl -u myapp -o json --no-pager | head -n 1   # one entry as JSON
journalctl --disk-usage
sudo journalctl --vacuum-time=4weeks

Files

Path Purpose
/var/log/journal/MACHINE-ID/ Persistent journal files (system.journal, user-UID.journal and their archives)
/run/log/journal/MACHINE-ID/ Volatile journal files
/etc/systemd/journald.conf, /etc/systemd/journald.conf.d/*.conf journald configuration
/run/systemd/journal/dev-log The syslog socket journald reads; /dev/log links to it
/run/systemd/journal/syslog Socket to which journald forwards entries for a syslog daemon, with ForwardToSyslog=yes

See also