Journalctl

lastmod 2026-03-13created 2019-07-2520 edits

Lets you view systemd logs.

logrotate with systemd

How to logrotate with systemd?

Increasing Storage

If you are storing to disk you can increase the amount of space used by changing SystemMaxUse and/or SystemKeepFree. Having more space would allow more entries to be stored.

By default the maximum use limit (SystemMaxUse) is 10% of the filesystem, and the minimum free space (SystemKeepFree) value is 15% - though they are both capped at 4G.

Journal Rotation

The journals should be rotated automatically when they reach the SystemMaxFileSize value, and the number of journals is controlled by SystemMaxFiles. If you prefer time based rotation you can set a MaxFileSec to set the maximum time entries are stored in a single journal.

Note on Storage Location/Type

With journald you can choose to store the journal entries either in memory (Storage=volatile) or on disk (Storage=persistent). The above assumes you are storing journals on disk - if this is not the case "System" will need to be replaced by "Runtime" in the above variables.

Further details are available in man journald.conf.

Alternative - Passing on the journal entries

If you are already familiar with the traditional SYSLOG daemon you can pass the journal events on by setting the ForwardToSyslog option (which forwards the messages immediately) or have the syslog daemon behave like a journal client and fetch the logs itself.

LogNamespace

If the namespace is ssh, add LogNamespace=ssh to the [Service] section in systemd and create the file /etc/systemd/[email protected].

After restarting the service, you can view the logs with the journalctl --namespace ssh command.

Cleaning up journal files manually

Clear systemd journal

Journal files are stored in the /var/log/journal folder, so you can go there and delete them directly, or

you can trim them by various criteria:

Remove archived journal files until the disk space they use falls below 100M.

journalctl --vacuum-size=100M

Make sure no journal file contains data older than 2 weeks.

journalctl --vacuum-time=2weeks

Clear journal Logs

How To Clear The systemd journal Logs

Check usage:

journalctl --disk-usage

sudo journalctl --rotate
sudo journalctl --vacuum-time=1s

sudo journalctl --rotate --vacuum-size=500M

Example

journalctl -xe

View the very end of the log along with additional messages (errors or events)

-x, --catalog - This option provides additional information about log entries. For example, when an error occurs, it can include hints about possible causes or fixes.
-e, --pager-end - This option starts output from the end of the log file, showing the latest logs first. This lets you check recent logs quickly, which is useful when a problem occurs.

journalctl -u [systemd unit name]: View logs of a specific unit

journalctl -f: Continuously follow the log

journalctl -f -u [systemd unit name]: Continuously follow the logs of a specific unit

journalctl -b: View logs since the last boot

journalctl --since=today: View today's logs

journalctl --since "2017-05-25 00:00:00" --until "2017-05-30 10:30:00": View logs for a specific period (outputs logs from 00:00 on May 25, 2017 to 10:30 AM on May 30, 2017)

journalctl -u sshd: View logs of a specific service daemon

journalctl -p crit: Query by event priority (outputs only events with critical priority)

journalctl -u libvirtd --since=yesterday -p err: View logs by service daemon, priority, and date (outputs only errors from the libvirtd daemon's logs since yesterday)

journalctl -p err -o verbose: Verbose output of the error log

journalctl /sbin/crond: Query specific events

Favorite site

author Zer0 sitemap