How to Filter System Logs Using journalctl in Linux

The journalctl utility queries and analyzes logs collected by systemd-journald, the centralized logging service in modern Linux distributions. Because systemd stores log data in a structured, indexed binary format rather than plain text, journalctl can filter events with high precision. This guide explains how to filter system logs using parameters such as time ranges, systemd units, process identifiers, log severity levels, and kernel messages.

Filtering by Time Ranges

You can restrict log output to specific time windows using the --since and --until flags. These accept absolute timestamps (YYYY-MM-DD HH:MM:SS) or relative references.

• View logs from the past hour:

  journalctl --since "1 hour ago"

• View logs within a specific date and time window:

  journalctl --since "2023-10-01 00:00:00" --until "2023-10-02 12:00:00"

• View logs generated today:

  journalctl --since today

Filtering by Systemd Unit

To troubleshoot a specific background service, use the -u flag followed by the systemd unit name.

• View logs for the SSH daemon:

  journalctl -u sshd.service

• View logs for multiple services at once:

  journalctl -u nginx.service -u php-fpm.service

Filtering by Priority and Severity

The systemd journal uses standard syslog priority levels ranging from 0 (emerg) to 7 (debug). The -p flag displays messages matching the specified priority or higher.

The available priority levels are:

• 0: emerg
• 1: alert
• 2: crit
• 3: err
• 4: warning
• 5: notice
• 6: info
• 7: debug

To show only errors and critical issues:

journalctl -p err

You can also specify ranges, such as journalctl -p warning..err, to view only warnings and errors while excluding critical system crashes.

Filtering Kernel Messages

To isolate kernel-level logs, similar to the traditional dmesg command, use the -k (or --dmesg) option:

journalctl -k

This is useful for debugging hardware detection issues, driver failures, or memory allocation faults.

Filtering by Boot Session

By default, journalctl displays records across multiple reboots if persistent logging is enabled. The -b flag isolates logs by boot session.

• View logs from the current boot:

  journalctl -b

• View logs from the previous boot:

  journalctl -b -1

• List all recorded boots with their index numbers and boot IDs:

  journalctl --list-boots

Filtering by Process, User, or Executable

Because journal logs store metadata alongside message bodies, you can filter directly by system attributes:

• By Process ID (PID):

  journalctl _PID=1234

• By User ID (UID):

  journalctl _UID=1000

• By Executable Path:

  journalctl /usr/bin/dockerd

Combining Multiple Filters

You can combine multiple criteria to isolate specific issues quickly. For example, to find all error-level logs for the Apache web server recorded since yesterday during the current boot:

journalctl -u apache2.service -b -p err --since yesterday