How to view system logs using journalctl

Reading the systemd journal is one of the fastest ways to confirm what happened during boot, service startup, hardware detection, and scheduled background work on a Linux host. It exposes the messages behind failed startups, repeated warnings, and sudden restarts without searching through multiple text log files first.

The systemd-journald service stores log events in a structured binary journal, and journalctl can filter that data by boot, time window, priority, unit, and transport. Using journalctl with --system keeps the view centered on the host-wide system journal instead of mixing in readable per-user entries.

Reading the system journal usually requires sudo unless the current account already has journal-read access through a distribution-specific admin group. journalctl opens output in a pager by default, so --no-pager is useful for direct terminal viewing, copy-paste, and shell redirection, and older boots appear only when the host keeps journal files across reboots.

1. Show the newest system log entries from the current boot.

   $ sudo journalctl --system --boot --lines=20 --no-pager
   Apr 13 16:35:53 host systemd[1]: Started getty@tty1.service - Getty on tty1.
   Apr 13 16:35:53 host systemd[1]: Reached target getty.target - Login Prompts.
   Apr 13 16:35:53 host systemd[1]: Reached target multi-user.target - Multi-User System.
   Apr 13 16:35:53 host systemd[1]: Reached target graphical.target - Graphical Interface.
   Apr 13 16:35:53 host systemd[1]: Startup finished in 4.785s (kernel) + 2.656s (userspace) = 7.441s.

   --system keeps the view on the host journal, and --no-pager prints directly to the terminal instead of opening less.

2. Limit the results to the current day when the issue happened recently.

   $ sudo journalctl --system --since=today --lines=20 --no-pager
   Apr 13 16:35:53 host systemd[1]: Started getty@tty1.service - Getty on tty1.
   Apr 13 16:35:53 host systemd[1]: Reached target multi-user.target - Multi-User System.
   Apr 13 16:35:53 host systemd[1]: Reached target graphical.target - Graphical Interface.
   Apr 13 16:35:58 host snapd[697]: daemon.go:556: gracefully waiting for running hooks
   Apr 13 16:36:01 host systemd[1]: snapd.service: Deactivated successfully.

   --since also accepts exact YYYY-MM-DD HH:MM:SS timestamps and keywords such as yesterday, today, and now.

3. Reduce the output to warning-level events and above when the goal is to find failures faster.

   $ sudo journalctl --system --boot --priority=warning..alert --lines=20 --no-pager
   Apr 13 16:35:51 host kernel: KASLR disabled due to lack of seed
   Apr 13 16:35:51 host kernel: Invalid PCCT: 0 PCC subspaces
   Apr 13 16:35:53 host (cron)[1093]: cron.service: Referenced but unset environment variable evaluates to an empty string: EXTRA_OPTS

   The range warning..alert includes priorities 4 through 1 and leaves out notice, info, and debug messages.

4. Show only kernel messages when the problem looks like a boot, driver, storage, or hardware issue.

   $ sudo journalctl -k --boot --lines=20 --no-pager
   Apr 13 16:35:51 host kernel: KASLR disabled due to lack of seed
   Apr 13 16:35:51 host kernel: secureboot: Secure boot disabled
   Apr 13 16:35:52 host kernel: NET: Registered PF_QIPCRTR protocol family
   Apr 13 16:35:52 host kernel: loop0: detected capacity change from 0 to 8

   -k is the short form of --dmesg, and it implies the current boot unless another boot is specified.

5. Follow new system log entries live while reproducing the problem.

   $ sudo journalctl --system --follow --lines=5 --no-pager
   Apr 13 16:35:58 host snapd[697]: daemon.go:556: gracefully waiting for running hooks
   Apr 13 16:35:58 host snapd[697]: daemon.go:558: done waiting for running hooks
   Apr 13 16:36:01 host systemd[1]: snapd.service: Deactivated successfully.
   ##### waits for new entries until Ctrl-C #####

   Press Ctrl-C to stop the live stream, or add --no-tail when older stored lines should remain visible before new entries arrive.

6. List recorded boots before checking logs from a previous startup.

   $ sudo journalctl --system --list-boots --no-pager
   IDX BOOT ID                          FIRST ENTRY                 LAST ENTRY
     0 c47ac9b8e76c4cdda03e2a5df46d7782 Mon 2026-04-13 16:35:51 +08 Mon 2026-04-13 16:39:12 +08

   When the list shows a -1 entry, journalctl -b -1 opens the previous boot directly.

   Related: How to enable persistent journal storage in systemd