journalctl Command - Query and Display Logs from systemd Journal

The journalctl command is used to query and display logs collected by systemd's journal service. It provides powerful filtering and formatting options for system logs.

Syntax

journalctl [options]

Examples

journalctl -b

journalctl -u sshd

journalctl --since "2024-01-01" --until "2024-01-31"

Notes

• Requires root privileges for some logs.
• Use -f to follow logs in real time (like tail -f).
• For persistent logs, ensure /var/log/journal/ exists.