What Is the journalctl Command in Linux?¶

Introduction¶

The journalctl command queries logs from the systemd journal. It is useful for beginners, Linux administrators, DevOps engineers, and RHCSA students because it solves practical terminal tasks.

What the Command Does¶

Use journalctl to work with the specific Linux object it manages. Before changing anything, identify the target and run a read-only check when possible.

Basic Syntax¶

journalctl OPTIONS

The syntax includes the command, any options, and the target object.

Common Options¶

• -u: filter by systemd unit.
• -f: follow new log entries.
• --since: filter by time.

Practical Examples¶

journalctl -n 50
journalctl -u sshd
journalctl -u sshd -f
journalctl --since "1 hour ago"

Verification command:

journalctl --disk-usage

Example output:

Archived and active journals take up 256.0M in the file system.

When to Use This Command¶

Use journalctl when troubleshooting services, boot problems, authentication issues, or kernel messages on systems using systemd.

Common Mistakes¶

• Reading the entire journal when a unit or time filter would be clearer.
• Forgetting -b when you only care about the current boot.
• Assuming persistent journals are enabled on every minimal installation.

Quick Reference¶

journalctl -n 50
journalctl -u sshd
journalctl --disk-usage

Related Guides¶

• journalctl examples
• journalctl follow logs explained
• journalctl Filter by Service and Time
• journalctl interview questions

Summary¶

The journalctl command is safest when you understand the target, choose the right option, and verify the result with a separate command.