How to Read Server Logs With journalctl

When a service refuses to start or your server encounters unexpected crashes, logs are the first place to look. Modern Linux distributions consolidate kernel and service logs into a binary log database managed by systemd-journald.

The primary tool used to query this centralized log repository is journalctl. In this guide, we will master its most useful filtering and debugging capabilities on your RivinCloud VPS.

1. Viewing Basic Logs

View All Logs (Paginated)

journalctl

Use arrow keys or Page Up/Page Down to scroll, and press q to exit.

Jump to the Most Recent Logs

journalctl -e

Display Logs Without Pager (Direct Output)

journalctl --no-pager -n 50

2. Filtering Logs by Service

When troubleshooting a specific application (such as Nginx, SSH, or MySQL), filtering by systemd unit saves time:

# View recent logs for Nginx
journalctl -u nginx.service

# View the last 100 lines for a specific unit
journalctl -u nginx.service -n 100 --no-pager

Following Logs Live in Real Time (-f)

Similar to tail -f, this streams new log events as they occur:

journalctl -u nginx.service -f

3. Filtering Logs by Time and Date

journalctl supports natural language and ISO timestamp filters:

Filter Since a Specific Time

# Logs since yesterday
journalctl --since "yesterday"

# Logs from the last 1 hour
journalctl --since "1 hour ago"

# Specific date range
journalctl --since "2026-09-28 10:00:00" --until "2026-09-28 12:30:00"

4. Filtering by Priority and Severity

Systemd logs are categorized by standard syslog priority levels:

• 0: emerg
• 1: alert
• 2: crit
• 3: err
• 4: warning
• 5: notice
• 6: info
• 7: debug

Show Only Errors and Critical Issues

journalctl -p err..emerg

Or view all errors across the current boot:

journalctl -p 3 -b

5. Filtering by Boot Session and Kernel Messages

Show Logs from Current Boot Only

journalctl -b

Show Logs from Previous Boot (Great for Crash Post-Mortems)

journalctl -b -1

View Kernel-Only Messages (dmesg Equivalent)

journalctl -k

6. Managing Journal Storage Space

By default, logs can consume substantial disk space over months of operation.

Check Current Disk Usage of Journal

journalctl --disk-usage

Vacuum (Trim) Old Logs

# Retain only the last 7 days of logs
sudo journalctl --vacuum-time=7d

# Limit total journal size to 500MB
sudo journalctl --vacuum-size=500M

Common Mistakes

• Running journalctl without sudo: Regular users can only see their own application logs. To view system-level daemons like Nginx or SSH, prepend sudo.
• Forgetting --since when analyzing spikes: Searching through gigabytes of logs without a time boundary slows down investigation.

Troubleshooting

• "No journal files were found": Check if systemd-journald is running with systemctl status systemd-journald.
• Logs not persisting across reboots: Ensure /var/log/journal exists and /etc/systemd/journald.conf has Storage=persistent.

Best Practices

• Use journalctl -xeu <service> immediately whenever systemctl start throws a failure exit code.
• Pipe output to grep for quick regex searches:

  journalctl -u ssh.service --since "today" | grep "Failed password"
  

Frequently Asked Questions

What does the -x flag do in journalctl?

The -x (catalog) flag adds explanatory notes from the systemd message catalog to error entries, explaining the error context and providing diagnostic tips.

How do I output logs in JSON format for external analysis?

Use journalctl -u <service> -o json-pretty to export structured JSON logs.

Conclusion

Mastering journalctl provides unmatched visibility into your Linux operating system and background services. Bookmark these flags to debug any issue on your RivinCloud VPS in seconds!