How to view Linux service logs with journalctl

When a Linux service starts late, exits, or restarts under systemd, the clearest clues usually sit in unit-specific journal entries instead of the broad system log stream. Filtering journalctl by service unit keeps the review focused on that daemon's start, stop, crash, and dependency messages before deeper troubleshooting begins.

journalctl reads the journal maintained by systemd-journald. The --unit filter selects entries tagged to a unit such as ssh.service, and the same query can be narrowed by current boot, time window, severity, or live follow mode without adding shell pipelines.

Full service logs may require sudo or membership in a journal-reading group. Previous-boot checks only work when the host retained older journals, often through persistent storage under /var/log/journal, and shared excerpts should be sanitized because service logs can include hostnames, usernames, IP addresses, paths, and command lines.

1. Show the newest journal entries for the service unit in the current boot.

   $ sudo journalctl --unit=ssh.service --boot --no-pager --lines=5
   Jun 13 20:35:35 server systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
   Jun 13 20:35:35 server sshd[96]: Server listening on 0.0.0.0 port 22.
   Jun 13 20:35:35 server sshd[96]: Server listening on :: port 22.
   Jun 13 20:35:35 server systemd[1]: Started ssh.service - OpenBSD Secure Shell server.

   Replace ssh.service with the actual systemd unit name. Use the .service suffix when the unit type matters, and use systemctl status checks when the name is uncertain.
   Related: How to check Linux service status

2. Narrow the service log to the incident time window.

   $ sudo journalctl --unit=ssh.service --since "10 minutes ago" --until "now" --no-pager
   Jun 13 20:35:35 server systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
   Jun 13 20:35:35 server sshd[96]: Server listening on 0.0.0.0 port 22.
   Jun 13 20:35:35 server sshd[96]: Server listening on :: port 22.
   Jun 13 20:35:35 server systemd[1]: Started ssh.service - OpenBSD Secure Shell server.

   --since and --until accept relative values such as 10 minutes ago and absolute timestamps such as 2026-06-13 20:30:00.

3. Show warning and error messages for the service.

   $ sudo journalctl --unit=ssh.service --boot --priority=warning..alert --no-pager
   -- No entries --

   Use --priority=err..alert when the review should exclude warnings and show only errors or more severe messages.

4. Stream new service entries while reproducing the problem.

   $ sudo journalctl --unit=ssh.service --follow
   Jun 13 20:35:35 server systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
   Jun 13 20:35:35 server sshd[96]: Server listening on 0.0.0.0 port 22.
   Jun 13 20:35:35 server sshd[96]: Server listening on :: port 22.
   Jun 13 20:35:35 server systemd[1]: Started ssh.service - OpenBSD Secure Shell server.

   Press Ctrl+C to stop following after the reproduction attempt captures the needed entries.

5. Check previous-boot service logs when the issue happened before a reboot.

   $ sudo journalctl --unit=ssh.service --boot=-1 --no-pager --lines=5
   No journal boot entry found for the specified boot (-1).

   A missing previous boot entry usually means the journal was not retained for that boot. Persistent journal storage under /var/log/journal is commonly required before older boot logs can be queried.