How to Monitor Logs in Real Time with journalctl

In this tutorial, you'll learn about How to Monitor Logs in Real Time with journalctl. We cover key concepts, practical examples, and best practices.

The Problem

Your service is failing and you need to see what's happening in real time. systemd's journalctl gives you structured, searchable logs. Instead of hunting through scattered log files in /var/log/, journalctl centralizes everything from all system services into a single, indexed journal. You can filter by service, priority, time range, and more — making it the go-to tool for debugging Linux systems.

Quick Fix

1. Follow logs in real time

The -f flag (short for --follow) keeps the log stream open so new entries appear as they are written. This is useful when you are actively debugging a running service and want to see errors as they happen.

sudo journalctl -f

Press Ctrl+C to stop.

2. Watch a specific service

Use the -u flag to filter logs to a single systemd unit. Replace nginx with the name of any service — sshd, docker, <a href="/databases/postgresql/">postgresql</a>, or your own application service.

sudo journalctl -u nginx -f

This shows only log entries from the specified unit, cutting through the noise of other system messages.

3. See last N lines

The -n flag controls how many recent lines to show. This is handy when you want to check the most recent log entries without scrolling through thousands of lines.

sudo journalctl -u nginx -n 50

# Without the -f (follow), this shows the last 50 lines and exits

Combine -n with -f to see the last N lines and then continue following new entries.

4. Filter by time

The --since and --until flags accept flexible time expressions — relative phrases like "1 hour ago" or "yesterday", as well as absolute timestamps. This is one of journalctl's most powerful features because you can jump directly to the relevant time window.

# Last hour
sudo journalctl -u nginx --since "1 hour ago"

# Since yesterday
sudo journalctl -u nginx --since yesterday

# Date range
sudo journalctl -u nginx --since "2025-01-01" --until "2025-01-02"

Time-based filtering is essential when investigating an incident that occurred at a specific moment.

5. Filter by priority

The -p flag filters by log priority level. Only entries at or above the specified severity are shown. This helps you focus on critical issues while ignoring informational messages.

# Errors and worse
sudo journalctl -u nginx -p err

# Warnings and worse
sudo journalctl -u nginx -p warning

Priority levels: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), debug (7)

Useful Combinations

Chain multiple flags to narrow down exactly what you need. Combining unit, follow, and priority filters gives you a targeted view of your most important services.

# Follow errors for a specific service
sudo journalctl -u nginx -f -p err

# Export logs to a file
sudo journalctl -u nginx --since today > nginx-log.txt

# Show logs with human-readable timestamps
sudo journalctl -u nginx --output=short-iso

The --output=short-iso flag gives you ISO 8601 timestamps that sort correctly and are machine-readable.

Disk Usage

Journal logs can grow quickly, especially on busy servers. A single service writing verbose logs can consume gigabytes over time. Use these commands to check current usage and reclaim disk space.

journalctl --disk-usage

# Clear old logs (keep only last 2 days)
sudo journalctl --vacuum-time=2d

Prevention

To prevent logs from filling your disk, configure journald limits in /etc/systemd/journald.conf. The key settings to adjust are:

• SystemMaxUse=500M — caps the journal size at 500 MB
• MaxRetentionSec=7day — keeps logs for up to 7 days
• RuntimeMaxUse=100M — limits the runtime journal size (used before /var/log is mounted)

After making changes, restart journald with sudo systemctl restart systemd-journald. This ensures your logging stays useful without consuming all available disk space. Combine these limits with journalctl --vacuum-time=2d for ad-hoc cleanup between reboots.