Linux Guides
Journalctl Command Cheat Sheet
Analyze logs, filter errors, and debug services efficiently.
Basic Log View
journalctlService Logs
journalctl -u nginxReal-time Logs
journalctl -u nginx -fError Details
journalctl -xeTime Filter
journalctl --since "1 hour ago"Boot Logs
journalctl -bReal Use Cases
- Service failed → journalctl -u
- Live debug → -f
- Error analysis → -xe
Common Mistakes
- Checking full logs without filtering
- Ignoring time range
- Not using -u for services
About this guide
This is a complete journalctl reference for real-world troubleshooting. It focuses on reading logs efficiently, filtering relevant entries, and identifying root causes of service failures.
How to follow this guide
- Use journalctl -u to check specific service logs first.
- Use -f to follow logs in real time.
- Use time filters to narrow down issues.
- Use -xe for detailed error context.
- Combine filters to reduce noise.
Why use this method?
Logs are the most important source of truth when diagnosing server issues. journalctl allows you to inspect systemd logs quickly and precisely.
Frequently Asked Questions
What is journalctl?
journalctl is a command-line tool used to query and display logs from systemd journal.
Why are logs important?
Logs show what actually happened in the system, including errors, warnings, and service events.
Why is my log empty?
You may need root privileges or the service may not have produced logs yet.
What does -xe mean?
It shows recent logs with detailed explanations and error context.