journalctl: Filtering systemd Logs by Service, Time, and Priority to Troubleshoot Failures

# All logs (newest first)
journalctl -r

# Last 100 lines
journalctl -n 100

# Live stream (like tail -f)
journalctl -f

# Logs since boot
journalctl -b

# Previous boot logs (-1 = last boot)
journalctl -b -1

# Logs for a specific unit
journalctl -u nginx
journalctl -u nginx -f  # live

# Multiple units
journalctl -u nginx -u php-fpm

# Specific PID
journalctl _PID=1234

# Today's logs
journalctl --since today

# Specific time range
journalctl --since "2024-01-15 10:00:00" --until "2024-01-15 12:00:00"

# Since 1 hour ago
journalctl --since "1 hour ago"

# error and above
journalctl -p err

# warning through error
journalctl -p warning..err

# Levels: 0=emerg, 1=alert, 2=crit, 3=err, 4=warning, 5=notice, 6=info, 7=debug

# JSON output (useful for log pipelines)
journalctl -u nginx -o json | jq '.MESSAGE'

# Messages only (cat format)
journalctl -o cat -u myapp

# Kernel messages only (dmesg alternative)
journalctl -k

# Find the cause of a service crash
journalctl -u myapp -p err --since "1 hour ago"

# Cause of a boot failure
journalctl -b -1 -p err

# Check whether the OOM killer ran
journalctl -k | grep -i "oom\|killed process"

# Monitor failed SSH logins
journalctl -u sshd | grep "Failed password" | awk '{print $11}' | sort | uniq -c | sort -rn

# Save logs to a file
journalctl -u nginx --since today > /tmp/nginx-today.log

# Current journal disk usage
journalctl --disk-usage

# Delete old logs (older than 2 weeks)
journalctl --vacuum-time=2w

# Size limit (500MB)
journalctl --vacuum-size=500M