October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk10 min

How to Use journalctl to Read Logs on a Linux VPS

A practical journalctl guide for Linux VPS users. Learn the commands for service, boot, time, priority, and field filters, real-time following, troubleshooting, and safe journal cleanup.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use journalctl to read the systemd journal on your VPS. After connecting over SSH, start with sudo journalctl -e -n 100 for the last 100 entries, then narrow the result with -u (service), -b (boot), --since/--until (time), priority filters, or structured fields. Add -f to watch new entries as they arrive and press Ctrl-C to stop.

What journalctl reads

journalctl prints entries stored in the journal by systemd-journald.service and systemd-journal-remote.service. The journal is structured: in addition to the message text, entries can be matched by fields such as _SYSTEMD_UNIT and _PID. This is different from opening an ordinary text log with cat or an editor. With no parameters, journalctl displays the journal entries available to the calling user, beginning with the oldest entry.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

“journalctl is used to print the log entries stored in the journal by systemd-journald.service and systemd-journal-remote.service.” — systemd project manual

On a VPS, the journal commonly contains messages from the operating system and systemd-managed services such as a web server or SSH daemon. What you can see depends on your account’s permissions and on which journal files the server still retains.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Permissions on a VPS

Connect to the server over SSH, then use sudo for system-wide inspection when your account cannot read the journal directly. The systemd manual says that root and members of the systemd-journal, adm, and wheel groups can read all journal files, although the exact group privilege depends on the distribution. An ordinary user can read only the journal data that the system permits that user to see.

ssh user@your-server

If a command without sudo returns a permission error or appears to show only a narrow set of entries, retry it with sudo rather than assuming the journal is empty.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Start with a useful snapshot

The following sequence gives you a readable baseline before you begin filtering:

  1. Open the newest entries in a pager: sudo journalctl -e -n 100. The -n 100 limit requests the last 100 entries, while -e moves the pager to the end so you begin with the most recent part of that result.
  2. Produce copyable output: sudo journalctl --no-pager -n 100. This suppresses the default less pager, which is convenient interactively but can be awkward when you need to paste output into a ticket or save it from an SSH session.
  3. Identify the failing unit: use sudo systemctl status name.service when you know a service is failing. The status view helps you confirm the exact unit name to pass to journalctl.

These commands are read-only inspections. They do not change service state or delete journal data.

Choose the right scope

Most log investigations become manageable when you define one scope first: a service, a boot, a time window, or a combination. The options below cover the core cases.

Need Option or command What it selects
All accessible entries sudo journalctl The journal data visible to your account, oldest entry first.
One systemd service sudo journalctl -u nginx.service Entries associated with the specified unit; -u also accepts a unit pattern.
Current boot sudo journalctl -b Entries from the boot that is currently running.
Previous boot sudo journalctl -b -1 Entries from the boot immediately before the current one, if retained.
Time interval sudo journalctl --since "today" --until "now" Entries between the two parsed calendar or relative times.
Warnings and more severe messages sudo journalctl -u nginx.service -p warning Messages at warning priority and higher for the selected service.

Filters can be combined. For example, a unit, boot, time range, and priority can all be applied to the same query so that you are not scrolling through unrelated system activity.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Read output without losing important context

Pager, line count, and order

By default, journalctl sends output through less. Use the arrow keys, Page Up, and Page Down to inspect a long result; press q to leave the pager. Add --no-pager whenever another command, a support ticket, or a script must receive plain output.

-n N limits the result to N entries. A small value such as -n 20 is useful for a quick health check; a larger value gives more context around a failure. -r reverses the display order, placing the newest matching entries first. This is useful when you want the latest event immediately without moving to the end of a long result.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Use a stable timestamp format

The -o short-full output mode prints timestamps in the documented full date-and-time format. It is a practical choice when you are comparing entries from different commands or recording an incident timeline, because the date and time remain explicit instead of relying on a shortened display.

sudo journalctl -u nginx.service -o short-full --no-pager -n 50

Keep the original message text and timestamp together when copying output. A line that looks suspicious in isolation may be normal once you see the preceding restart, dependency, or authentication event.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Read logs for nginx, SSH, or another service

Filter by a systemd unit

Use -u (the long form is --unit) with the exact systemd unit name:

sudo journalctl -u nginx.service

The option selects a systemd unit or a unit pattern. If the command returns nothing, verify the unit name with systemctl status; a package may use a different name, or the application may not be managed by systemd at all. You can add a count and disable the pager for a compact report:

sudo journalctl -u nginx.service -n 100 --no-pager

The same form works for an SSH daemon when its unit is named sshd.service:

sudo journalctl -u sshd.service -n 100 --no-pager

Use the unit-specific query before searching all system logs. It removes unrelated kernel, timer, and other-service messages while preserving the service’s own startup, stop, error, and informational entries.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Add a priority filter

When a unit is noisy, add -p warning to keep warning-priority and higher messages:

sudo journalctl -u nginx.service -p warning --no-pager

This is a filter, not a claim that lower-priority messages are unimportant. If the warning-only view omits the event you need, rerun the unit query without -p and inspect the surrounding entries.

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

View the current or previous boot

Boot filters are useful after a reboot, crash, or service failure that may have started before the current session:

sudo journalctl -b

-b selects the current boot. A negative offset selects an earlier boot; -b -1 means the boot immediately before the current one:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo journalctl -b -1

You can combine a boot with a unit or priority filter:

sudo journalctl -b -1 -u nginx.service -p warning --no-pager

Earlier boots must still exist in the journal. If retention has removed them, no command option can reconstruct those entries; investigate the boots that remain and review the server’s retention policy.

Limit the search to a time window

--since and --until accept calendar times such as 2012-10-30 18:17:16, as well as words including today, yesterday, tomorrow, and now. Relative forms such as -1h are also accepted by systemd’s time parser.

sudo journalctl --since "today" --until "now"

For a narrowly defined incident, use explicit boundaries and preserve them in your notes:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo journalctl -u nginx.service --since "2026-10-14 09:00:00" --until "2026-10-14 09:30:00" --no-pager

The date in this example is illustrative; replace it with the actual incident interval and the server’s relevant time interpretation. A relative query is convenient for a live investigation:

sudo journalctl -u nginx.service --since "-1h" --no-pager

Time filters reduce noise and make repeated checks comparable. If the first window is too narrow, widen one boundary rather than jumping immediately to the entire journal.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Search structured fields

Because the journal is structured, you can pass matches in FIELD=VALUE form. For example:

sudo journalctl _SYSTEMD_UNIT=sshd.service --no-pager
sudo journalctl _PID=1234 --no-pager

Matches on different fields are combined as a logical AND. A query that includes both _SYSTEMD_UNIT=sshd.service and _PID=1234 therefore asks for entries satisfying both conditions. Repeating a match for the same field creates alternatives for that field.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo journalctl _SYSTEMD_UNIT=sshd.service _PID=1234 --since "-30m" --no-pager

Structured matches can be used alongside -u, -b, --since, --until, and priority filters. This layered approach is valuable during incident response: start with the service, add the time window, then add a field when the result still contains too much activity.

Follow logs in real time

The --follow (or -f) option prints recent matching entries and then waits for newly appended entries. Use it when restarting a service, reproducing a request, or watching an authentication attempt:

sudo journalctl -u nginx.service -f

Press Ctrl-C to stop following. The command remains attached to the SSH session while it is running, so keep the terminal open or use an appropriate session manager if you need the observation to survive a disconnected connection.

Limit the initial history so the live stream starts close to the event you are testing:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo journalctl -u nginx.service -n 50 -f

You can also add a priority or field filter to reduce the live stream’s noise. If no new matching entries appear, that may simply mean the service has not emitted a message matching your filters yet; remove one filter temporarily before concluding that logging is broken.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

A repeatable VPS troubleshooting workflow

Use this order when a service is failing or a request produces an unexpected result:

  1. Check the unit state. Run sudo systemctl status name.service and note the exact unit name, active state, and any immediate error text.
  2. Read the latest unit entries. Run sudo journalctl -u name.service -n 100 --no-pager so the result is short enough to inspect and copy.
  3. Define the incident window. Add --since and --until around the time of the failure. A precise interval often separates the triggering event from routine background messages.
  4. Watch a reproduction or restart. Add -f to the unit query, then reproduce the request or restart the service in a second terminal. Stop the follower with Ctrl-C when the event is complete.
  5. Compare with the prior boot. If the problem appeared after a reboot, run the same unit query with -b -1 to see whether the earlier boot recorded a different startup sequence.
  6. Use priority and fields when output is noisy. Try -p warning, then structured matches such as _SYSTEMD_UNIT=... or _PID=.... Combine conditions rather than dumping the whole journal repeatedly.
  7. Check storage before changing retention. Run sudo journalctl --disk-usage and record the result before deciding whether cleanup is necessary.

Keep the exact commands, time boundaries, and unit name in your incident notes. That makes a second investigation reproducible and prevents a broad query from being mistaken for a service-specific result.

Measure journal disk usage and clean up retention

Measure before deleting

sudo journalctl --disk-usage reports the combined size of active and archived journal files. It is a measurement command; it does not remove entries.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo journalctl --disk-usage

Vacuum archived files by age, size, or count

Vacuum operations remove eligible older archived files according to the policy you choose:

sudo journalctl --vacuum-time=14d
sudo journalctl --vacuum-size=500M
sudo journalctl --vacuum-files=10
  • --vacuum-time=14d keeps the policy based on age.
  • --vacuum-size=500M targets a size limit.
  • --vacuum-files=10 limits the number of archived files retained.

Choose a policy that fits the server’s troubleshooting and compliance needs; the examples are mechanisms, not universal recommendations. If you need active files archived before cleanup, combine rotation with the vacuum operation:

sudo journalctl --rotate --vacuum-time=14d

The systemd manual warns that vacuuming acts on archived files. Active files remain, so the total reported by --disk-usage may not fall by the exact amount you expected after a vacuum command. Run --disk-usage again and interpret the new figure with that active-versus-archived distinction in mind.

Common problems and precise fixes

Permission denied or incomplete results

Retry with sudo. If you want non-root access, use a distribution-supported journal-reading group such as systemd-journal, adm, or wheel, remembering that group privileges vary by distribution. Do not assume that a partial result represents the entire server.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The service query is empty

Confirm the unit spelling with sudo systemctl status name.service. A missing result can mean the unit name is different, the service has not written entries in the selected interval, or the service is not managed by systemd. Remove the time and priority filters temporarily to distinguish an incorrect filter from a quiet service.

The output is difficult to copy

Add --no-pager and a bounded -n value. Use -o short-full when exact timestamps matter. Avoid pasting an unbounded all-journal query into a ticket; capture the narrowest interval that demonstrates the issue.

Following appears to hang

-f is supposed to wait for new entries. It prints the recent matching history and then blocks while listening for additions. Generate the event you are testing, or press Ctrl-C to return to the shell. If events are missing, relax one filter and verify that the service actually emits journal entries.

Vacuum did not free the expected amount

Check --disk-usage again and remember that active journal files are not removed by vacuum. Use --rotate with the vacuum policy when archiving active files first is appropriate, then measure again.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Compact command reference

Command Best use
sudo journalctl -e -n 100 Open the newest 100 entries in the pager.
sudo journalctl --no-pager -n 100 Copy the newest 100 entries without interactive paging.
sudo journalctl -u nginx.service Read one service’s journal entries.
sudo journalctl -u nginx.service -f Follow that service as new entries arrive; stop with Ctrl-C.
sudo journalctl -b Inspect the current boot.
sudo journalctl -b -1 Inspect the previous retained boot.
sudo journalctl --since "today" --until "now" Limit output to a parsed time window.
sudo journalctl -u nginx.service -p warning Show warning-priority and higher messages for a unit.
sudo journalctl _SYSTEMD_UNIT=sshd.service Match a structured systemd-unit field.
sudo journalctl --disk-usage Measure active plus archived journal storage.

For most VPS incidents, begin with a bounded, unit-specific query and add one filter at a time. That keeps the scope clear, preserves the timestamps you need, and avoids changing retention settings merely to find a single log entry.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.