journalctl recipes I always forget

July 5, 2026

Four flags cover almost everything I do with the journal.

Machine-readable output

-o cat drops the syslog prefix so the line starts with whatever the program actually printed, which makes awk and cut behave:

journalctl -u myservice --since '2 hours ago' --no-pager -q -o cat

-q suppresses the "-- Logs begin at --" header, --no-pager keeps it from opening less when you are piping.

Counting events per hour

Useful for answering "when did this stop working":

journalctl -u myservice --since '24 hours ago' --no-pager -q -o short-iso \
  | awk '{print substr($1, 1, 13)}' \
  | uniq -c

A gap in that output is usually more informative than any single error line. If traffic stops dead at an exact minute and nothing restarted, the problem is upstream of the machine.

Following across a restart

journalctl -u myservice -f -n 50

Unlike tail -f on a logfile, this survives the service restarting and the file being rotated out from under you.

How much disk the journal eats

journalctl --disk-usage
journalctl --vacuum-time=14d

Or set SystemMaxUse=500M in /etc/systemd/journald.conf and stop thinking about it.