View logs in journalctl

We can monitor logs of a specific service using journalctl in real time, filter by time, or check past logs. Here are some useful commands:

1. View logs of a specific service

journalctl -u <service-name>

Example for nginx:

journalctl -u nginx

2. Monitor logs in real-time (follow mode)

journalctl -u <service-name> -f

Example:

journalctl -u nginx -f

This is similar to tail -f and will continuously display new log entries as they appear.

3. View logs since a specific time

journalctl -u <service-name> --since "2024-02-01 12:00:00"

Or for a relative time (e.g., last 2 hours):

journalctl -u <service-name> --since "2 hours ago"

4. View logs until a specific time

journalctl -u <service-name> --until "2024-02-07 18:00:00"

5. Filter logs between a time range

journalctl -u <service-name> --since "2024-02-01" --until "2024-02-07"

6. Show the most recent logs (e.g., last 50 entries)

journalctl -u <service-name> -n 50

7. View logs for the current boot

journalctl -u <service-name> -b

Or for the previous boot:

journalctl -u <service-name> -b -1

8. Filter logs by priority level

journalctl -u <service-name> -p <priority>

Priority levels:

• 0 (emerg)

• 1 (alert)

• 2 (crit)

• 3 (err)

• 4 (warning)

• 5 (notice)

• 6 (info)

• 7 (debug)

Example to view only errors and critical issues:

journalctl -u nginx -p err

9. Search for a specific keyword in logs

journalctl -u <service-name> | grep "ERROR"

10. Show logs in JSON format (for structured logging)

journalctl -u <service-name> -o json-pretty