System and processes

The journalctl command

Reads the system log, where the messages from services and the kernel end up.

Syntax

journalctl [-u UNIDAD] [-n N] [--since FECHA] [-f]

Most useful options

-u UNIDADOnly that service's log
-n NThe last N lines
--sinceSince a date: today, yesterday, '10 min ago'
-fKeeps following the log live

Copy-ready examples

$ journalctl -u sshWhat happened with ssh
$ journalctl -n 20The last 20 lines
$ journalctl --since todayToday's entries
$ journalctl -fWatch what comes in

You can try them in the browser terminal: it does not touch your computer.

Typical mistakes

  • Without -u it shows the whole system: filter so you do not drown.
  • On a real machine some logs need permissions or membership of the systemd-journal group.

Related commands

systemctldmesggreptail

FAQ

Where are these messages?

In systemd's journal; before they were stored in /var/log/syslog.

Learn to actually use it

The basic Linux course takes you from zero to console fluency with 24 self-grading lessons.

Start the free course