linux system-management

journald

journald journalctl logging systemd linux
Plain English

journald is the logbook of a modern Linux system. It collects messages from the kernel, from background services, and from programs, and stores them in one place with timestamps. Instead of hunting through many separate log files, you ask one tool, journalctl, to show you what happened, filtered by service, time, or severity.

Technical Definition

systemd-journald receives log data from the kernel (/dev/kmsg), the syslog socket, the native journal API, and the stdout and stderr of every systemd service. It stores structured binary entries with fields like _SYSTEMD_UNIT, _PID, PRIORITY, and _BOOT_ID.

Storage:

  • Persistent: /var/log/journal/ (default on Ubuntu)
  • Volatile: /run/log/journal/, lost at reboot
  • Configured in /etc/systemd/journald.conf (Storage=, SystemMaxUse=)

Priorities follow syslog: 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug.

journalctl essentials:

  • -u nginx: one unit
  • -b / -b -1: this boot / previous boot
  • -p err: priority err and worse
  • --since "1 hour ago", --until
  • -f: follow live
  • -k: kernel messages (like dmesg)
  • -e: jump to the end; -x: add explanations
  • -o json: structured output

Relation to syslog files: Ubuntu Server also installs rsyslog, which writes classic text files like /var/log/syslog. Desktop installs may rely on the journal alone.

Source: journalctl(1) Linux manual page

Reading the journal 

# Errors from this boot
$ journalctl -b -p err --no-pager

# Why did the last boot fail? (previous boot)
$ journalctl -b -1 -e

# One service, last hour, live
$ journalctl -u ssh --since "1 hour ago" -f

# List boots
$ journalctl --list-boots | tail -3

# Disk usage, and trim it to 500 MB
$ journalctl --disk-usage
Archived and active journals take up 1.2G in the file system.
$ sudo journalctl --vacuum-size=500M
In the Wild

The journal is the first stop for nearly every Linux troubleshooting session: a service that will not start, a crash after reboot, a disk error from the kernel. systemctl status shows the last few lines; journalctl -u <unit> -e shows the rest. Make sure storage is persistent, or you lose the evidence from the boot that failed. Production setups also forward logs off the box to a central system or SIEM.

← Back to Dictionary