Use journalctl -n 50 -f to show the 50 newest journal entries and keep displaying new ones; add -u SERVICE.service to watch one systemd service. For a saved time range, use --since and --until. The commands below cover the common ways to inspect Linux logs stored in the systemd journal.
Tail the newest journal entries
journalctl prints entries stored by systemd-journald and systemd-journal-remote. With no arguments, it displays accessible entries from the oldest collected entry onward. Use -n or --lines to limit output to recent entries; the documented default is 10.
As an Amazon Associate I earn from qualifying purchases.
journalctl -n 10
journalctl -n 50To keep watching for new entries, add -f (or --follow). Follow mode starts with recent output and continues printing appended entries. Specify the initial number of lines explicitly when you want a predictable starting view:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →journalctl -n 50 -fThe manual says --lines is implied when following. --no-tail changes follow mode to display all stored output lines instead of just the recent tail.
#1 Best Overall
Filter logs by service, time, or message
Show a service’s entries
Use -u or --unit with a unit name or pattern. The unit must exist on the machine; service names vary with installed software and distribution.
journalctl -u nginx.service
journalctl -u nginx.service -fFor a service problem that began recently, combine the unit filter with a time boundary:
journalctl -u my-service.service --since '30 minutes ago'Set a time range
--since selects entries on or newer than the specified time, while --until selects entries on or older. The manual accepts date-time strings, dates, relative times, and terms such as today and yesterday. Quote relative phrases so the shell passes them as one argument.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
journalctl -u nginx.service --since today
journalctl --since '-1 hour'
journalctl --since '2025-04-18 09:00:00' --until '2025-04-18 10:00:00'Search message text
-g or --grep filters the MESSAGE= field with a Perl-compatible regular expression. By default, a lowercase-only pattern is case-insensitive; a pattern containing uppercase is case-sensitive. Use --case-sensitive to override the default.
journalctl --grep='timeout'Match structured fields
Pass a journal field as FIELD=VALUE to narrow results. Matches on different fields combine with AND, so both conditions must match. Repeated matches for the same field act as alternatives.
journalctl _PID=1234 PRIORITY=3For a unit-specific field inspection, use -o verbose to see the structured fields recorded with entries.
Rank #4
Choose a boot to inspect
-b or --boot selects entries from a boot. With no offset, it selects the current boot; -1 selects the previous boot. Add -k to restrict the output to kernel messages.
journalctl -b
journalctl -b -1
journalctl -k -b -1Choose a readable or machine-friendly output format
| Option | What it shows | Useful when |
|---|---|---|
short |
Concise, one-entry-per-line output; this is the default. | Reading logs interactively. |
short-iso |
Entries with ISO 8601 profile timestamps. | You want timestamps in an explicit ISO-style format. |
short-iso-precise |
ISO-style timestamps with microsecond precision. | Events need finer timestamp detail. |
verbose |
All structured entry fields. | Inspecting metadata or finding field names. |
json |
Newline-separated JSON objects. | Processing entries in a script or another tool. |
cat |
Message text without metadata such as timestamps. | Reading message text when event-time correlation is not needed. |
journalctl -o short-iso
journalctl -u nginx.service -o verboseUse --utc when you need timestamps expressed in Coordinated Universal Time. Output formats differ in the timestamp and metadata they present, so select a format suited to the task rather than assuming every mode shows the same details.
Best Value
Handle paging and access problems
Disable the pager when needed
journalctl uses less by default. Add --no-pager for scripts or when you want output returned directly to the terminal. In the pager, long lines may extend beyond the screen width; navigate horizontally to inspect the hidden portion.
journalctl -n 50 --no-pagerCheck journal permissions
If entries are missing or access is denied, check whether your account can read the system journal. Under the manual’s documented defaults, root and users in groups such as systemd-journal, adm, or wheel commonly have access. Actual permissions depend on local configuration and distribution policy. journalctl --user works only when persistent logging is enabled.
Do not start troubleshooting with --quiet: it suppresses informational messages and some warnings about inaccessible journals, which can conceal useful clues.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Check option support on your Linux system
The options and behavior here follow the systemd 255 manual. Linux hosts may have other systemd versions, and some switches are version-dependent. If an option is rejected or behaves differently, consult the systemd 255 journalctl manual and the manual installed on the target host.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
