> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to View Logs with journalctl on Linux

> View logs with journalctl: journalctl -u nginx for one service, -f to follow live, -b for this boot, -p err for errors and --since for a time range. With examples.

To view logs with journalctl, run `sudo journalctl -u nginx` for one service, add `-f` to follow new lines live, `-b` to see only the current boot, `-p err` for errors only, and `--since "1 hour ago"` for a time range. For example, `sudo journalctl -u ssh -n 50` shows the last 50 SSH log lines. journalctl reads the systemd journal on Ubuntu, Debian, AlmaLinux and Rocky Linux.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux / Rocky 9 / 10 and other systemd distributions | sudo, or membership of the `systemd-journal` or `adm` group |

## Before you start

* [Connect with SSH](https://help.freakhosting.com/portals/other/how-to-connect-to-a-linux-server-with-ssh.md).
* Normal users only see their own logs. Use `sudo` (root can leave it out) to see system and service logs.
* The **journal** is systemd's central log. It collects the output of every service, the kernel and login events, with a time stamp and the source of each line.

## journalctl commands at a glance

| Task | Command |
| - | - |
| Everything, oldest first | `sudo journalctl` |
| Newest first | `sudo journalctl -r` |
| Last 100 lines | `sudo journalctl -n 100` |
| Follow live (`Ctrl+C` to stop) | `sudo journalctl -f` |
| One service | `sudo journalctl -u nginx` |
| Several services | `sudo journalctl -u nginx -u php8.3-fpm` |
| Current boot only | `sudo journalctl -b` |
| Previous boot | `sudo journalctl -b -1` |
| Errors and worse | `sudo journalctl -p err` |
| Kernel messages | `sudo journalctl -k` |
| Search text | `sudo journalctl -u ssh -g "Failed password"` |
| Plain output for scripts or `grep` | `sudo journalctl -u nginx --no-pager` |

journalctl opens in a pager like `less`: use the arrow keys, `/` to search, `G` to jump to the end and `q` to quit.

## How to view logs for a service

**1. Find the service name**

```bash theme={null}
systemctl list-units --type=service
```

For example `ssh` on Ubuntu/Debian and `sshd` on AlmaLinux/Rocky.

**2. Show its recent log**

```bash theme={null}
sudo journalctl -u ssh -n 50 --no-pager
```

Example output:

```text theme={null}
Nov 04 10:12:45 web1 sshd[1532]: Accepted publickey for alex from 198.51.100.24 port 51234 ssh2: ED25519 SHA256:...
Nov 04 10:12:45 web1 sshd[1532]: pam_unix(sshd:session): session opened for user alex(uid=1001) by alex(uid=0)
```

**3. Watch it live while you test**

```bash theme={null}
sudo journalctl -u ssh -f
```

## How to filter by time

```bash theme={null}
sudo journalctl --since "1 hour ago"
sudo journalctl --since today
sudo journalctl --since "2026-11-04 08:00" --until "2026-11-04 09:30"
sudo journalctl -u nginx --since yesterday --until today
```

Times are in the server's time zone. Add `--utc` to show UTC.

## How to show only errors

Priorities go from `0` (emerg) to `7` (debug). `-p err` shows `err` and everything more serious (`crit`, `alert`, `emerg`).

```bash theme={null}
sudo journalctl -p err -b
sudo journalctl -p warning..err --since today
```

## How to see logs from before the last reboot

```bash theme={null}
sudo journalctl --list-boots
sudo journalctl -b -1 -e
```

`-b -1` is the previous boot, `-b -2` the one before; `-e` jumps to the end. This is how you find out why a server restarted or crashed.

If `--list-boots` shows only the current boot, the journal is only kept in memory. systemd keeps logs on disk when the directory `/var/log/journal` exists. Create it and restart the journal service:

```bash theme={null}
sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald
```

## Where are the classic log files?

Many services also write text files in `/var/log`:

| Log | Ubuntu / Debian | AlmaLinux / Rocky |
| - | - | - |
| General system log | `/var/log/syslog` (with `rsyslog`) | `/var/log/messages` |
| Logins and sudo | `/var/log/auth.log` (with `rsyslog`) | `/var/log/secure` |
| nginx | `/var/log/nginx/access.log`, `error.log` | same |
| Apache | `/var/log/apache2/` | `/var/log/httpd/` |
| Package updates | `/var/log/apt/history.log` | `/var/log/dnf.log` |

Read them with `sudo tail -f /var/log/nginx/error.log` or `sudo less /var/log/auth.log`.

## How to limit how much disk the journal uses

```bash theme={null}
sudo journalctl --disk-usage
sudo journalctl --vacuum-size=500M
sudo journalctl --vacuum-time=14d
```

Vacuuming deletes the oldest archived journal files until the limit is met. To set a permanent limit, create `/etc/systemd/journald.conf.d/size.conf`:

```ini theme={null}
[Journal]
SystemMaxUse=500M
```

Then run `sudo systemctl restart systemd-journald`. By default the journal uses at most 10% of the file system, capped at 4 GB.

## How to check it worked

Write a test message to the journal and find it again:

```bash theme={null}
logger "journal test from alex"
sudo journalctl --since "1 minute ago" -g "journal test"
```

You see your message with the current time.

## Frequently asked questions

### How do I export logs to send to support?

Save them to a file: `sudo journalctl -u nginx --since today --no-pager > nginx-log.txt`. Remove passwords, tokens and other private data before you share it.

### Why do I see "No journal files were found"?

You don't have permission. Use `sudo`, or add your user to the `systemd-journal` group (`sudo usermod -aG systemd-journal alex`) and log in again.

### How do I see the log in JSON?

Use `-o json-pretty` for readable JSON or `-o json` for one entry per line, for example `sudo journalctl -u nginx -n 5 -o json-pretty`.

### How do I see failed SSH logins?

Run `sudo journalctl -u ssh -g "Failed password|Invalid user"` (use `sshd` on AlmaLinux/Rocky). See [who is logged in and login history](https://help.freakhosting.com/portals/other/how-to-check-who-is-logged-in-and-login-history.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every server guide in one place.

> [card] [Manage services with systemctl](https://help.freakhosting.com/portals/other/how-to-manage-services-with-systemctl.md)
>
> Restart what the logs point to.

> [card] [Check disk space](https://help.freakhosting.com/portals/other/how-to-check-disk-space-on-linux.md)
>
> When logs fill your disk.

> [card] [Who is logged in](https://help.freakhosting.com/portals/other/how-to-check-who-is-logged-in-and-login-history.md)
>
> Login history and sessions.

> [card] [Server won't boot](https://help.freakhosting.com/portals/other/how-to-fix-a-linux-server-that-wont-boot.md)
>
> Read logs from rescue mode.

***

> [!NOTE]
>
> **Checked against the official [journalctl](https://www.freedesktop.org/software/systemd/man/latest/journalctl.html) and [journald.conf](https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html) manuals** on 4 November 2026; options confirmed with `journalctl --help` (systemd 255) on Ubuntu 24.04 LTS. Reading a live journal was not tested because our test container doesn't run systemd as its init system. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.