journalctl: filters and follow

Systemd’s journal is the first place to look when a service crashes or a node starts burning CPU. journalctl does far more than dump the entire log in sequence: it can filter by units, priorities, time windows, and stream in real time. Below is the working set I use daily.

Follow in real time

Behavior similar to tail -f, but aware of journald’s structured format:

journalctl -f

The -f flag (short for --follow) streams new entries as they appear. By default it shows all units — handy when you don’t know where the fire is.

journalctl -f --no-pager

Filter by unit

The unit is the most common filter. One -u key and the specific service name:

journalctl -u nginx.service
journalctl -u docker.service

Multiple units can be passed — journalctl will show entries from all specified ones:

journalctl -u nginx.service -u postgresql.service

Priority and time filters

Priority filtering is set via -p (or --priority). Levels range from 0 to 7:

Show only errors and critical:

journalctl -p err

Time windows use --since and --until. Both absolute dates and relative expressions are supported:

journalctl --since "1 hour ago"
journalctl --since today --until "2 hours ago"
journalctl --since "2025-01-15 08:00:00" --until "2025-01-15 12:00:00"

Combining flags

In practice, filters are combined. A typical request: watch errors from a specific service over the last hour in real time:

journalctl -u nginx.service -p err --since "1 hour ago" -f --no-pager

Another common pattern — show the last N lines for a unit with a priority filter:

journalctl -u postgresql.service -p warning -n 100 --no-pager

Here -n 100 limits output to the last 100 entries.

Quick reference for everyday flags: