Journalctl

How to use journalctl to view systemd logs?

One of the impetuses behind the systemd journal is to centralize the management of logs regardless of where the messages are originating. Since much of the boot process and service management is handled by the systemd process, it makes sense to standardize the way that logs are collected and accessed. The journald daemon collects data from all available sources and stores them in a binary format for easy and dynamic manipulation.

View logs by unit

journalctl -u nginx.service

Filter logs by time/date

journalctl -u nginx.service --since today

or

journalctl -u nginx.service --until "2012-10-30 18:17:16"

Follow logs

To actively follow the logs as they are being written, you can use the -f flag. Again, this works as you might expect if you have experience using tail -f

journalctl -f

Reverse logs

To see the latest logs first

journalctl -r -u nginx.service

Find disk used by logs

journalctl --disk-usage

Delete logs

By Size

This will remove old entries until the total journal space taken up on disk is at the requested size:

journalctl --vacuum-size=1G

By date

Keep the entries that have been created after a specific time:

journalctl --vacuum-time=1years