# Journalctl: The Ultimate Tool for System Logging and Analysis"

Today, we will dive deep into one of the most critical Linux utilities for logging errors and debugging messages. For those Linux systems that don't use systemd, the leading utility was rsyslogd daemon. Although you can still use rsyslogd with systemd systems, systemd has its own method of gathering and displaying messages called the systemd journal (journalctl command).

The primary command for viewing the messages from systemd journal is the journalctl command. The boot process, the kernel, and all systemd-managed services direct their status and error messages to the systemd journal.

### Basic commands

```bash
jorunalctl
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694669165028/bc4584d3-430d-4f54-99c3-572e1b2abc25.png align="center")

**To display logs from a specific unit (service):**

syntax: journalctl -u service\_name

```bash
journalctl -u docker
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694669423591/1a042377-bf62-4333-bcdc-5f86debaed41.png align="center")

**To display logs from a specific time range:**

syntax: journalctl -s "YYYY-MM-DD HH:MM:SS"

```bash
journalctl -S -4h # view system logs from the past 4 hours
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694669716167/566ec1c3-1ab5-4bfc-963f-7b20d381de21.png align="center")

**To view the real-time logs**

```bash
journalctl -f
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694669859679/a8f828d3-c30b-4e50-91d9-97d2a8243433.png align="center")

**To view the logs of specific process**

syntax: journalctl \_*PID=process*id

```bash
journalctl _PID=12644 # value is generated using ps command
```

**To** **Clear Logs Older Than a Specific Time:**

syntax: journalctl --vacuum-time=duration

```bash
journalctl --vacuum-time=2d #Retains log only of the past two days
journalctl --vacuum-size=500M #retains only past 500mb
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694670854007/02f0fbe1-39cc-4c3f-bd24-7dcef8f6e610.png align="center")

***Note****: The command is performed successfully but the execution failed as the regular user wasn't allowed to perform those deletions of the logs from the system. Since I don't want to delete any logs I am not performing the root user action. You can simply add sudo before the command and complete the command*

**To view all kernel messages:**

```bash
journalctl -k
```

**To view logs in human-readable-format:**

```bash
journalctl -o verbose
```

To export logs to a file:

```bash
journalctl > file_name.txt
```

For more commands, you can follow the **man** page of journalctl. In this way, we can use the journalctl command to perform normally to view any error message and debug the issues.

Happy Learning!!