Is journalctl dangerous?

LOW risk. Read-only log viewer. Logs may contain secrets and personal data; `--vacuum-size/--vacuum-time` permanently deletes old journals.

journalctl

Q: What does journalctl do?

Query and display systemd journal logs. journalctl is the primary tool for accessing systemd's structured binary journal. It supports filtering by unit, time range, priority, and boot. Unlike tail on flat log files, it understands log metadata and allows complex structured queries.

Query and display systemd journal logs.

low risk

interactive breakdown — edit the command and press Explain

⚠ Risks & cautions

Logs may contain secrets and personal data; `--vacuum-size/--vacuum-time` permanently deletes old journals.

What it does

journalctl is the primary tool for accessing systemd's structured binary journal. It supports filtering by unit, time range, priority, and boot. Unlike tail on flat log files, it understands log metadata and allows complex structured queries.

Common flags

Flag	Meaning
`-u` `--unit`	Filter by systemd service unit
`-f` `--follow`	Follow journal in real time
`-n` `--lines`	Show last N lines
`-p` `--priority`	Filter by priority (0=emerg to 7=debug)
`--since`	Show logs since a timestamp
`--until`	Show logs until a timestamp
`-b` `--boot`	Show logs from current boot (-1 for previous)
`-o` `--output`	Output format: json, json-pretty, short, verbose

Examples

journalctl -u nginx -fFollow nginx service logs · explain & risk-check →

journalctl -p err -bShow errors from current boot only · explain & risk-check →

journalctl --since '2024-01-15 10:00' --until '2024-01-15 11:00'Logs in a specific time window · explain & risk-check →

journalctl -u kubelet -n 100 --no-pagerLast 100 kubelet log lines · explain & risk-check →

journalctl -o json-pretty -u sshd | jq '.MESSAGE'Structured log output for parsing · explain & risk-check →

Pro tip

Use `journalctl -b -1 -p err` to review errors from the previous boot after a crash — far faster than reconstructing the timeline from multiple log files.

systemctl dmesg tail

Open the full explainer →More in System & Processes

Reference text is hand-written and may be incomplete — check man journalctl for your version. Test destructive commands on a non-production system first.