How to Use journalctl to Analyse System Logs

Linux services leave a detailed trail of events in the systemd journal. Learning how to query that trail with journalctl makes it easier to investigate failed services, slow boots, authentication problems, and unexpected restarts without searching through many separate log files. Learn more about Reading And Writing Complex Objects With Sharedpreferences And Gson 206013.

The journal collects messages from the kernel, system services, scheduled jobs, and applications that use the systemd logging interface. On Fedora, RHEL, and modern CentOS systems, it is often the first place to look when a daemon behaves differently from its configuration.

Good log analysis starts with a narrow time range and a clear question. Rather than dumping thousands of lines to the terminal, filter by boot, unit, priority, or timestamp, then inspect surrounding events for context.

This approach is useful on a workstation in Melbourne, a web server in Sydney, or a remote host in Perth. Australian administrators should also check timezone settings carefully, especially when comparing systems across states or reviewing events around daylight-saving changes.

Understand The Systemd Journal

A basic command displays recent journal entries:

journalctl

The output normally opens in a pager such as less. Use the arrow keys to move through it, press Space to continue, and press q to exit. To view the newest messages first, run:

journalctl -r

The journal may be stored only in memory unless persistent storage has been enabled. With volatile storage, entries disappear after a reboot, which makes investigating an earlier failure difficult. Persistent logs are commonly stored under /var/log/journal.

Check the current configuration with:

grep -E '^\s*Storage=' /etc/systemd/journald.conf

After changing journald settings, reload the service:

sudo systemctl restart systemd-journald

Review retention limits before enabling long-term storage on a small virtual machine or a metered Australian cloud instance.

Start With The Current Boot

To see messages from the current boot only, use:

journalctl -b

A previous boot can be selected with a negative offset:

journalctl -b -1

List recorded boots and their identifiers with:

journalctl --list-boots

This is particularly helpful after a failed kernel update or an unexpected restart. If the server rebooted overnight, compare the final entries from the previous boot with the early messages from the current one.

Follow new messages in real time with:

journalctl -f

This behaves like tail -f and is useful while restarting Nginx, testing a firewall rule, or reproducing a login failure. Stop the live view with Ctrl+C.

Filter By Service Time And Priority

Service-specific filtering reduces noise. To inspect Nginx events, run:

journalctl -u nginx.service

Add -f while restarting the service, or restrict the output to the current boot:

journalctl -u nginx.service -b

Time filters accept readable values:

journalctl --since "2026-09-24 09:00" --until "2026-09-24 10:00"
journalctl --since today
journalctl --since yesterday

Use the correct timezone when correlating entries with monitoring alerts. A log recorded in UTC may appear several hours away from an incident shown in AEST or AWST.

Priority filtering is useful when an outage generates too much routine information:

journalctl -p warning..alert

The levels range from emerg through debug. A command such as journalctl -p err -b shows errors from the current boot, but warnings immediately before an error may explain the underlying cause.

Inspect Kernel And Authentication Events

Kernel messages often reveal disk errors, driver problems, memory pressure, and network changes:

journalctl -k

For a compact view of the current kernel session, combine it with the boot filter:

journalctl -k -b --no-pager

Authentication records can be searched by service name or keyword:

journalctl -u sshd
journalctl --grep='Failed password'

The --grep option searches rendered message text and is case-sensitive on many systems. Use a broader expression when necessary:

journalctl --grep='failed|denied|timeout'

Be careful when sharing output. Logs may contain usernames, IP addresses, email addresses, or request data covered by the Australian Privacy Act 1988. Redact personal information before posting entries in a support ticket or public forum.

Useful Filters For Faster Triage

A small set of commands covers many first checks:

journalctl -b — messages from the current boot
journalctl -u name.service — entries for one systemd unit
journalctl -p err..alert — serious problems
journalctl --since "1 hour ago" — recent activity

When a service fails, pair the journal with systemd’s status information:

systemctl status nginx
systemctl is-active sshd
systemctl list-units --failed
systemctl show nginx -p ExecMainStatus

The status command usually includes a few recent journal lines, while journalctl provides the broader timeline. For a LAMP host, reviewing Fedora LAMP setup alongside Apache, PHP-FPM, and database entries can separate an application error from a service-start problem.

Export And Interpret Evidence

For readable output without terminal control characters, use:

journalctl -u nginx --since today --no-pager -o short-iso

The short-iso format makes timestamps easier to sort and compare. Other useful formats include json, cat, and verbose. Export a focused incident record to a file:

journalctl -b -u nginx --since "2026-09-24 08:00" > nginx-incident.log

Use --disk-usage to see how much space the journal consumes:

journalctl --disk-usage

If an application reports invalid settings rather than a systemd failure, inspect its own logs and configuration files as well. For software that stores structured preferences, a Gson persistence guide can help explain how malformed serialised data may surface as application-level errors rather than clear daemon messages.

The most reliable workflow is to identify the affected unit, select the relevant boot and time window, filter by severity, and then read several lines before and after the visible error. Remember that journalctl is most valuable when its output is treated as a timeline: the first message may describe the symptom, but the earlier warning often reveals the cause.