journalctl Cheat Sheet: Read and Search Linux Logs

journalctl reads the systemd journal — where most modern Linux systems keep their logs. This cheat sheet is the set of commands you actually reach for: filtering by time, service, program and severity, changing the output format, and the security searches an analyst runs first. Put sudo in front when you need other users’ and system logs; without it you only see your own.

Read the journal

Everything, oldest first, in a pager (press q to quit):

$ journalctl

Newest first:

$ journalctl -r

Just the last 50 lines:

$ journalctl -n 50

Follow new entries live, like tail -f:

$ journalctl -f

Print straight to the terminal without the pager — useful when piping into grep:

$ journalctl --no-pager

Filter by time and boot

Since midnight:

$ journalctl --since today

A relative window:

$ journalctl --since "1 hour ago"

An exact window:

$ journalctl --since "2026-09-24 09:00" --until "2026-09-24 10:00"

This boot only (-b -1 for the previous one):

$ journalctl -b

List every boot the journal remembers:

$ journalctl --list-boots

Filter by service or program

One systemd service (on Debian/Kali/Ubuntu the SSH server is ssh; on RHEL/Fedora it is sshd):

$ journalctl -u ssh

Everything a program logged, by its command name:

$ journalctl _COMM=sudo

By syslog tag — several -t flags are combined with OR:

$ journalctl -t useradd -t userdel

One user’s processes, by numeric user ID:

$ journalctl _UID=1000

Kernel messages only, like dmesg:

$ journalctl -k

List every value a field has — the fastest way to see what programs are logging:

$ journalctl -F _COMM

Filter by severity

Errors and worse (emerg, alert, crit, err):

$ journalctl -p err

Warnings and worse, this boot:

$ journalctl -p warning -b

Change the output

Sortable ISO timestamps — best for timelines and reports:

$ journalctl -o short-iso

Full structured JSON, one entry per object:

$ journalctl -o json-pretty -n 5

Every field of each entry — how you discover what you can filter on:

$ journalctl -o verbose -n 1

Message text only, no timestamps or hostnames:

$ journalctl -o cat

Security searches to run first

Failed SSH password attempts today:

$ sudo journalctl -u ssh --since today | grep -i "failed password"

SSH logins for usernames that don’t exist — a classic sign of guessing:

$ sudo journalctl -u ssh --since today | grep -i "invalid user"

Every command run with sudo:

$ sudo journalctl _COMM=sudo | grep "COMMAND="

Failed sudo attempts:

$ sudo journalctl _COMM=sudo | grep -i "authentication failure"

Accounts created, deleted or changed in the last week:

$ sudo journalctl -t useradd -t userdel -t usermod -t passwd --since "7 days ago"

Services systemd started today:

$ sudo journalctl --since today | grep "Started "

Export the last hour as a timeline file:

$ sudo journalctl --since "1 hour ago" -o short-iso > timeline.txt

Housekeeping

How much disk the journal uses:

$ journalctl --disk-usage

Keep only the last 7 days:

$ sudo journalctl --vacuum-time=7d

Make the journal survive reboots (if --list-boots only ever shows one):

$ sudo mkdir -p /var/log/journal && sudo systemctl restart systemd-journald

Gotchas

• “You are currently not seeing messages from other users and the system” — add sudo.
• Quotes around times with spaces. --since 1 hour ago fails; --since "1 hour ago" works.
• Service names differ by distro — ssh vs sshd, cron vs crond. systemctl list-units --type=service shows the real names.
• No journal on older or minimal systems? The same events live in /var/log/auth.log (Debian family) or /var/log/secure (RHEL family).

Where to go next

• Lab 09 — Read your own logs — these commands, used in order, on your own VM
• Lab 08 — Enroll a Wazuh agent — the same questions, answered by a SIEM
• SPL cheat sheet — searching logs at scale in Splunk
• Linux privilege escalation cheat sheet — what attackers do that these logs catch

Original reference, checked against the systemd journalctl manual. Last verified Sep 2026. Spotted something that no longer matches your system? Tell me and I will fix it.