How to view Linux service logs with journalctl

Service log review on Linux exposes start failures, crashes, and dependency errors that are not visible in status summaries. Reading the journal around the time of an incident helps isolate whether the failure is internal to the service or triggered by a dependency or environment change.

On systemd systems, systemd-journald collects logs from services and stores them in the journal. journalctl queries that journal, and filtering by unit with --unit (or -u) shows messages for a single service while keeping timestamps, priorities, and process context.

Access to complete logs often requires sudo, and older entries may only be available when persistent storage is enabled under /var/log/journal. Noisy units can produce a lot of output, so prefer a line limit, a time window, or a priority filter to focus on the most relevant messages.

1. Show the most recent log lines for the service unit.

   $ sudo journalctl -u ssh.service --no-pager --lines=10
   Jan 11 21:17:34 5fbe1fd9880b systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
   Jan 11 21:17:34 5fbe1fd9880b sshd[1351]: Server listening on 0.0.0.0 port 22.
   Jan 11 21:17:34 5fbe1fd9880b sshd[1351]: Server listening on :: port 22.
   Jan 11 21:17:34 5fbe1fd9880b systemd[1]: Started ssh.service - OpenBSD Secure Shell server.

   Replace ssh.service with the systemd unit name, with or without the .service suffix.

2. Show recent log entries for the service unit.

   $ sudo journalctl -u ssh.service --since "10 minutes ago" --no-pager
   Jan 11 21:17:34 5fbe1fd9880b systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
   Jan 11 21:17:34 5fbe1fd9880b sshd[1351]: Server listening on 0.0.0.0 port 22.
   Jan 11 21:17:34 5fbe1fd9880b sshd[1351]: Server listening on :: port 22.
   Jan 11 21:17:34 5fbe1fd9880b systemd[1]: Started ssh.service - OpenBSD Secure Shell server.

   Increase the time range or use an absolute timestamp when older entries are needed.

3. Stream the service log while reproducing the issue.

   $ timeout 2 sudo journalctl -u ssh.service --follow
   Jan 11 21:17:34 5fbe1fd9880b systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
   Jan 11 21:17:34 5fbe1fd9880b sshd[1351]: Server listening on 0.0.0.0 port 22.
   Jan 11 21:17:34 5fbe1fd9880b sshd[1351]: Server listening on :: port 22.
   Jan 11 21:17:34 5fbe1fd9880b systemd[1]: Started ssh.service - OpenBSD Secure Shell server.

   Stop streaming with Ctrl+C.

4. Filter to error-level messages for quick triage.

   $ sudo journalctl -u ssh.service --priority=err..alert
   -- No entries --

   Priority filtering reduces noise by showing only high-severity entries.

5. Show service log entries from the previous boot.

   $ sudo journalctl -u ssh.service --boot=-1
   -- No entries --

   Previous-boot logs require a persistent journal under /var/log/journal.