Journalctl Cheatsheet

Utility for viewing and querying system logs managed by systemd

Updated at: March 10, 2025

Basic Usage

Journalctl is a utility for querying and displaying logs from the systemd journal. The journal is a centralized system logging service that collects and stores logging data from various system components, services, and applications.

Output Formatting

journalctl offers various output formatting options to customize how log entries are displayed. You can change timestamps, output fields, verbosity level, and even get structured data formats like JSON for easier parsing and analysis.

Log Filtering

journalctl provides powerful filtering capabilities to narrow down log entries based on various criteria. You can filter by priority level, service unit, user, process ID, message content, and more. Multiple filters can be combined to create precise queries.

Advanced Filtering

Advanced filtering in journalctl allows you to perform complex searches using regular expressions, specific journal fields, and system-specific attributes. These techniques help extract precisely the information you need from large log datasets.

Log Management

SystemD's journalctl provides tools to manage journal files, control disk usage, and maintain journal integrity. These commands help administrators efficiently manage system logs, prevent disk space issues, and ensure logs are properly maintained.