Viewing System Logs with journalctl on Ubuntu

System logs are an invaluable resource for diagnosing and troubleshooting issues on a Linux system. On Ubuntu, the journalctl command is a powerful tool for viewing and managing logs produced by the systemd system and service manager. This guide will help you understand how to use journalctl effectively to monitor and analyze your system's behavior.

---

1. What is journalctl?

journalctl is a command-line utility that queries and displays logs from the systemd journal. Unlike traditional log files located in /var/log, journalctl provides a unified interface for accessing system logs, application logs, and kernel messages.

---

2. Basic Usage

To view logs using journalctl, open a terminal and run:

journalctl

This command displays all logs in chronological order, starting with the oldest entries.

---

3. Viewing Recent Logs

To display the most recent logs:

journalctl -e

This command shows the latest logs and automatically scrolls to the end.

To follow logs in real-time (similar to tail -f):

journalctl -f

---

4. Filtering Logs

By Time

To view logs from a specific time period, use the --since and --until options:

journalctl --since "2025-01-01 12:00:00" --until "2025-01-01 18:00:00"

You can also use relative times:

journalctl --since "2 hours ago"

By Unit

To view logs for a specific systemd service, use the -u option:

journalctl -u nginx.service

To view logs for a service since the last boot:

journalctl -u nginx.service --since "today"

By Priority

Log messages have priority levels, ranging from 0 (emergency) to 7 (debug). To filter by priority, use the -p option:

journalctl -p warning

This displays logs with priority levels of warning and higher.

By Keywords

To search for logs containing specific keywords, use the grep command:

journalctl | grep "error"

---

5. Managing Journal Size

The systemd journal can consume significant disk space. You can check the current size of the journal using:

journalctl --disk-usage

To limit the size of the journal, edit the /etc/systemd/journald.conf file and set the SystemMaxUse parameter:

sudo nano /etc/systemd/journald.conf

Example:

SystemMaxUse=500M

After making changes, restart the journal service:

sudo systemctl restart systemd-journald

---

6. Persistent Journals

By default, logs are stored in memory and are cleared after a reboot. To enable persistent logging, create the following directory:

sudo mkdir -p /var/log/journal

Then restart the journal service:

sudo systemctl restart systemd-journald

Logs will now be stored persistently in /var/log/journal.

---

7. Exporting Logs

To save logs to a file for analysis or sharing:

journalctl > logs.txt

You can combine this with filtering options to export specific logs:

journalctl -u nginx.service --since "yesterday" > nginx-logs.txt

---

8. Best Practices for Using journalctl

• Use Filters Wisely: Filtering by time, unit, or priority makes it easier to find relevant logs.

• Monitor in Real-Time: Use journalctl -f to monitor logs as issues occur.

• Enable Persistent Journals: Persistent logging ensures that logs are not lost after a reboot.

• Regularly Manage Log Size: Set a reasonable size limit for the journal to prevent disk space issues.

---

Conclusion

The journalctl command is an essential tool for Ubuntu users who want to monitor and analyze system logs effectively. By mastering its features, you can troubleshoot issues, monitor system performance, and ensure your system operates smoothly. Experiment with the various options and make journalctl a regular part of your system administration toolkit.