journalctl

journalctl is a command-line utility provided by systemd for querying and displaying entries from the systemd journal. The journal aggregates log messages from the kernel, system services, and user applications into a centralized, structured log store. journalctl is designed to present both human-readable output and machine-readable data, with support for filtering and formatting.

The journal stores data in files under /var/log/journal when persistent logging is enabled, or in memory under /run/log/journal for volatile logging. Access to the journal typically requires root privileges or membership in the systemd-journal group. journalctl can read from local journals as well as from remote hosts using options that connect to a remote journal on another machine.

Key features and options include filtering by time, boot, unit, syslog identifier, or priority. Common filters are --since/--until for time ranges, -b to show the current boot, -u for a specific systemd unit, -t for a SYSLOG_IDENTIFIER, and -p to filter by priority. The tool also supports -k for kernel messages and -D to specify an alternate journal directory. Output formats can be customized with -o, including json, json-pretty, json-sse, cat, and export. Other useful options include -f to follow new entries, -n for the number of lines, -a to show all fields, and -x to add explanatory help text. Remote access is facilitated by -M, which allows querying the journal on a different machine.

Typical usage includes viewing recent messages, tailing logs, inspecting a service’s logs, or exporting data for analysis. journalctl is a core utility for Linux systems employing systemd, providing flexible, structured access to centralized logging.