VulnTech The systemd Journal | Learn Linux

One place for the logs

When something goes wrong, the logs tell you what happened. On a systemd machine almost everything — the kernel, services, the system itself — logs into one store, the journal, which you read with sudo journalctl. With no arguments it shows everything, oldest first, so you usually jump to the end:

sudo journalctl --no-pager -n 10

In the terminal (-n 10: just the last 10 lines)

student@vulntech:~$ sudo journalctl --no-pager -n 10
[sudo] password for student:
Oct 18 04:45:21 vulntech systemd-journald[182]: Runtime Journal (/run/log/journal/af6a62848ea543edba71b458aa422ff7) is 1.1M, max 4.7M, 3.5M free.
Oct 18 04:45:21 vulntech systemd-journald[182]: Received client request to rotate journal, rotating.
Oct 18 04:45:21 vulntech systemd-journald[182]: Vacuuming done, freed 0B of archived journals from /run/log/journal/af6a62848ea543edba71b458aa422ff7.
Oct 18 08:22:45 vulntech sudo[581]:  student : TTY=ttyS0 ; PWD=/home/student ; USER=root ; COMMAND=/usr/bin/journalctl --no-pager -n 10
Oct 18 08:22:46 vulntech sudo[581]: pam_unix(sudo:session): session opened for user root(uid=0) by student(uid=1000)

-n N shows the last N lines; -e jumps to the newest; -r shows newest first.

Just this boot, just this service

-b limits the journal to the current boot, and -u NAME to one service's messages — the two filters you reach for most:

sudo journalctl -b --no-pager -n 5
journalctl -u vt-agent --no-pager -n 5

In the terminal

student@vulntech:~$ sudo journalctl -b --no-pager -n 5
[sudo] password for student:
Oct 18 04:45:21 vulntech systemd-journald[182]: Runtime Journal (/run/log/journal/af6a62848ea543edba71b458aa422ff7) is 1.1M, max 4.7M, 3.5M free.
Oct 18 04:45:21 vulntech systemd-journald[182]: Received client request to rotate journal, rotating.
Oct 18 04:45:21 vulntech systemd-journald[182]: Vacuuming done, freed 0B of archived journals from /run/log/journal/af6a62848ea543edba71b458aa422ff7.
Oct 18 08:22:46 vulntech sudo[581]:  student : TTY=ttyS0 ; PWD=/home/student ; USER=root ; COMMAND=/usr/bin/journalctl -b --no-pager -n 5
Oct 18 08:22:46 vulntech sudo[581]: pam_unix(sudo:session): session opened for user root(uid=0) by student(uid=1000)
student@vulntech:~$ journalctl -u vt-agent --no-pager -n 5
Hint: You are currently not seeing messages from other users and the system.
      Users in groups 'adm', 'systemd-journal' can see all messages.
      Pass -q to turn off this notice.
No journal files were opened due to insufficient permissions.

Tip: Without --no-pager, sudo journalctl opens the output in less (scroll with the arrows, q to quit), starting at the newest entries. The --no-pager here is just so the page can show the text.

Remember: sudo journalctl reads the systemd journal (oldest first). -n N the last N lines, -e jump to newest, -b this boot, -u NAME one service.