How to view logs for a specific service with journalctl

How to view logs for a specific service with journalctl

Filter and display systemd journal entries for a specific service using journalctl.

Prerequisites

• A Linux system running systemd with the systemd journal enabled.
• The name of the systemd service to inspect.

Step-by-Step: View Service Logs with journalctl

1. Display all journal entries for a specific service using the -u flag. journalctl filters entries by the unit name:

   journalctl -u nginx.service

2. Limit output to a specific time range using --since and --until. journalctl accepts human-readable timestamps:

   journalctl -u nginx.service --since "2026-03-30 08:00" --until "2026-03-30 12:00"
   journalctl -u nginx.service --since "1 hour ago"
   journalctl -u nginx.service --since today

3. Follow live log output in real time using the -f flag. journalctl streams new entries as the service writes them:

   journalctl -u nginx.service -f

4. Show only error-level messages using the -p (priority) flag. journalctl supports priority levels from emerg (0) to debug (7):

   journalctl -u nginx.service -p err

5. Display logs from the current boot only using the -b flag. This excludes entries from previous boot sessions:

   journalctl -u nginx.service -b

How to Verify the Logs Are Complete

journalctl shows the time range of available journal entries. Check the oldest entry with --no-pager and head:

journalctl -u nginx.service --no-pager | head -3

If the journal is configured with Storage=volatile in /etc/systemd/journald.conf, logs do not persist across reboots. Change to Storage=persistent and restart systemd-journald to retain logs.

Common Issues When Viewing Logs with journalctl

journalctl may show no output for a service if the service logs to a file instead of stdout/stderr. systemd captures only stdout and stderr from the ExecStart process. Check the application's own log configuration.

Running journalctl without sudo may hide entries from system services. Use sudo journalctl or add the user to the systemd-journal group.