Skip to main content
To view logs with journalctl, run sudo journalctl -u nginx for one service, add -f to follow new lines live, -b to see only the current boot, -p err for errors only, and --since "1 hour ago" for a time range. For example, sudo journalctl -u ssh -n 50 shows the last 50 SSH log lines. journalctl reads the systemd journal on Ubuntu, Debian, AlmaLinux and Rocky Linux.

​
Before you start

  • Connect with SSH.
  • Normal users only see their own logs. Use sudo (root can leave it out) to see system and service logs.
  • The journal is systemd’s central log. It collects the output of every service, the kernel and login events, with a time stamp and the source of each line.

​
journalctl commands at a glance

journalctl opens in a pager like less: use the arrow keys, / to search, G to jump to the end and q to quit.

​
How to view logs for a service

1

Find the service name

For example ssh on Ubuntu/Debian and sshd on AlmaLinux/Rocky.
2

Show its recent log

Example output:
3

Watch it live while you test

​
How to filter by time

Times are in the server’s time zone. Add --utc to show UTC.

​
How to show only errors

Priorities go from 0 (emerg) to 7 (debug). -p err shows err and everything more serious (crit, alert, emerg).

​
How to see logs from before the last reboot

-b -1 is the previous boot, -b -2 the one before; -e jumps to the end. This is how you find out why a server restarted or crashed. If --list-boots shows only the current boot, the journal is only kept in memory. systemd keeps logs on disk when the directory /var/log/journal exists. Create it and restart the journal service:

​
Where are the classic log files?

Many services also write text files in /var/log: Read them with sudo tail -f /var/log/nginx/error.log or sudo less /var/log/auth.log.

​
How to limit how much disk the journal uses

Vacuuming deletes the oldest archived journal files until the limit is met. To set a permanent limit, create /etc/systemd/journald.conf.d/size.conf:
Then run sudo systemctl restart systemd-journald. By default the journal uses at most 10% of the file system, capped at 4 GB.

​
How to check it worked

Write a test message to the journal and find it again:
You see your message with the current time.

​
Frequently asked questions

​
How do I export logs to send to support?

Save them to a file: sudo journalctl -u nginx --since today --no-pager > nginx-log.txt. Remove passwords, tokens and other private data before you share it.

​
Why do I see “No journal files were found”?

You don’t have permission. Use sudo, or add your user to the systemd-journal group (sudo usermod -aG systemd-journal alex) and log in again.

​
How do I see the log in JSON?

Use -o json-pretty for readable JSON or -o json for one entry per line, for example sudo journalctl -u nginx -n 5 -o json-pretty.

​
How do I see failed SSH logins?

Run sudo journalctl -u ssh -g "Failed password|Invalid user" (use sshd on AlmaLinux/Rocky). See who is logged in and login history.

VPS and dedicated server guides

Every server guide in one place.

Manage services with systemctl

Restart what the logs point to.

Check disk space

When logs fill your disk.

Who is logged in

Login history and sessions.

Server won't boot

Read logs from rescue mode.
Checked against the official journalctl and journald.conf manuals on 4 November 2026; options confirmed with journalctl --help (systemd 255) on Ubuntu 24.04 LTS. Reading a live journal was not tested because our test container doesn’t run systemd as its init system. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026