Utility for viewing and querying system logs managed by systemd
Updated at: March 10, 2025
Basic Usage
Journalctl is a utility for querying and displaying logs from the systemd journal. The journal is a centralized system logging service that collects and stores logging data from various system components, services, and applications.
Output Formatting
journalctl offers various output formatting options to customize how log entries are displayed. You can change timestamps, output fields, verbosity level, and even get structured data formats like JSON for easier parsing and analysis.
Log Filtering
journalctl provides powerful filtering capabilities to narrow down log entries based on various criteria. You can filter by priority level, service unit, user, process ID, message content, and more. Multiple filters can be combined to create precise queries.
Advanced Filtering
Advanced filtering in journalctl allows you to perform complex searches using regular expressions, specific journal fields, and system-specific attributes. These techniques help extract precisely the information you need from large log datasets.
Log Management
SystemD's journalctl provides tools to manage journal files, control disk usage, and maintain journal integrity. These commands help administrators efficiently manage system logs, prevent disk space issues, and ensure logs are properly maintained.
Related Cheatsheets