How to Read Linux Logs with journalctl
Linux logs are most useful when you ask a narrow question: which boot, which service, which time window and which error priority?
journalctl answers “what did systemd record?”
On systemd-based distributions, journalctl reads the system journal. It is most useful when you narrow the query by boot, service, time or priority rather than dumping everything.
journalctl -b
journalctl -b -p err
journalctl -b -1
systemctl --failedFollow one service
systemctl status NetworkManager
journalctl -u NetworkManager -bService names vary. A server using systemd-networkd or a distribution with a differently named daemon needs a different unit. Use systemctl list-unit-files or distribution documentation rather than assuming a service name.
Read logs before clearing or rotating them
A useful troubleshooting pattern
- Reproduce or note the time of the problem.
- Check failed units.
- Filter the current boot by error priority.
- Inspect the specific service around the failure time.
- Compare with the previous boot if the problem began after a restart or update.
- Change one thing, then re-check the same evidence source.
Which journalctl filter answers your question?
| Question | Example | Scope |
|---|---|---|
| What happened this boot? | journalctl -b | All journal entries associated with the current boot. |
| What errors were recorded this boot? | journalctl -b -p err | Error-priority entries from the current boot. |
| What happened on the previous boot? | journalctl -b -1 | Journal entries associated with the previous boot, if retained. |
| What did one service record? | journalctl -u UNIT -b | Current-boot entries for the exact systemd unit name. |
Useful gear for this task
Official references
For current behavior and version-specific details, use the relevant upstream documentation alongside this guide.
Frequently asked questions
How do I see errors from the current Linux boot?
On a systemd-based distribution, journalctl -b -p err shows error-priority journal entries from the current boot. An error line is evidence to investigate, not proof that the named component caused the original symptom.
How do I read logs for one systemd service?
Use journalctl -u UNIT to filter the journal for a particular unit, and add -b when you want only the current boot. Replace UNIT with the exact service unit name on the system.