← All cheat sheets

JOURNALCTL

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

journalctl reads the systemd journal (binary logs managed by
systemd-journald). Central to triage on modern Linux. Read-only inspection
needs root or membership in the systemd-journal group.

BASICS#

journalctl                     all logs, oldest first (paged)
journalctl -e                  jump to the end (newest)
journalctl -r                  reverse (newest first)
journalctl -n 100              last 100 lines
journalctl -f                  follow (live tail, like tail -f)
journalctl --no-pager          dump without the pager (for scripts)

BY UNIT / SERVICE#

journalctl -u sshd             logs for the sshd unit
journalctl -u sshd -u nginx    multiple units
journalctl -u sshd -f          follow a single service
journalctl -u 'ssh*'           glob match on unit name
journalctl --user -u foo       a user-session service

TIME FILTERING#

journalctl --since "2026-10-01 00:00:00" --until "2026-10-02 00:00:00"
journalctl --since today
journalctl --since yesterday
journalctl --since "1 hour ago"
journalctl --since "09:00" --until "10:30"
Accepts absolute timestamps and relative English ("10 min ago").

BY BOOT (crash / reboot triage)#

journalctl --list-boots        list boots with IDs and times
journalctl -b                  current boot only
journalctl -b -1               previous boot
journalctl -b -2               two boots ago
journalctl -k                  kernel (dmesg) messages this boot
journalctl -k -b -1            kernel messages from the previous boot

PRIORITY (severity)#

journalctl -p err              errors and worse
journalctl -p warning          warnings and worse
journalctl -p 0..3             range (emerg..err)
Levels: 0 emerg 1 alert 2 crit 3 err 4 warning 5 notice 6 info 7 debug
journalctl -p err -b           this boot's errors (fast triage)

MATCHING FIELDS#

journalctl _PID=1234           by process ID
journalctl _UID=1000           by user ID
journalctl _COMM=sshd          by command (comm name)
journalctl _SYSTEMD_UNIT=sshd.service
journalctl _TRANSPORT=kernel   only kernel-sourced records
journalctl SYSLOG_FACILITY=10  by syslog facility (10 = authpriv)
journalctl /usr/bin/sshd       by executable path
Combine: journalctl _UID=1000 _COMM=sudo
List field values:  journalctl -F _COMM     (all distinct COMM values)
journalctl -N                  list all available field names
journalctl -g 'failed password'    regex search (PCRE, -g)
journalctl -g 'error' -i           case-insensitive with --case-insensitive
journalctl -u sshd -g 'Accepted'   accepted SSH logins
(-g uses journald's built-in matching; or pipe to grep when combining.)

OUTPUT FORMATS (-o)#

-o short            default
-o short-iso        ISO 8601 timestamps (good for correlating UTC)
-o short-precise    microsecond timestamps
-o verbose          every field for each entry (forensic detail)
-o json             one JSON object per line
-o json-pretty      indented JSON
-o cat              message text only (no metadata)
--utc               render timestamps in UTC (recommended for IR)

journalctl -u sshd -o json --since today | jq .   parse with jq

SESSION / AUTH TRIAGE#

journalctl -u sshd -g 'Failed password' --since today    SSH brute force
journalctl -u sshd -g 'Accepted'                          successful logins
journalctl _COMM=sudo                                     sudo usage
journalctl SYSLOG_FACILITY=10                             auth facility
journalctl -g 'session opened' -u systemd-logind          login sessions

DISK USAGE & INTEGRITY#

journalctl --disk-usage        space used by the journal
journalctl --verify            check journal file integrity
journalctl --vacuum-time=30d   drop entries older than 30 days (admin)
journalctl --vacuum-size=1G    cap journal size (admin)
(Vacuum changes data -- do it only when managing retention, not during IR.)

EXPORT FOR OFFLINE ANALYSIS#

journalctl -b -o export > boot.journal-export       raw export format
journalctl --since today -o json > today.json       JSON for a SIEM/jq
# Read a copied journal directory from another host:
journalctl -D /mnt/evidence/var/log/journal -b

TIPS#

- Use --utc everywhere during incident response for consistent timestamps.
- -b -1 / --list-boots is the fastest way to inspect an unexpected reboot.
- If a service rotated/truncated its own file, the journal may still have it.
- Persistent journal requires /var/log/journal to exist (Storage=persistent
  in /etc/systemd/journald.conf); otherwise logs are volatile (RAM only).

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.