I've been using journalctl for years and I still see people typing journalctl and scrolling through thousands of lines like animals. Stop. There's a better way.

Terminal screen showing command line
The terminal. Where all the answers live ( if you know the right flags ).

1. Filter by Service, Not by Grepping

The number one mistake. People run journalctl and pipe to grep. Just don't.

journalctl -u nginx.service
journalctl -u docker

This gives you only the logs for that unit. No noise. The -u flag is short for --unit and it's the thing I use more than anything else in journalctl.

You can also combine it:

journalctl -u nginx.service -u php-fpm.service

Multiple units, same output. Try doing that cleanly with grep.

2. Time Ranges That Actually Make Sense

I never remember the exact syntax. So here it is, written down once and for all.

Code on screen
Logs have timestamps. Use them.

# Last hour
journalctl --since "1 hour ago"

# Since yesterday
journalctl --since yesterday

# A specific window
journalctl --since "2026-08-17 09:00" --until "2026-08-17 12:00"

The --since and --until flags take human-readable strings. "1 hour ago", "yesterday", "2026-08-17". All valid. No need to convert to epoch.

Combine with -u for surgical precision:

journalctl -u postgresql --since "2 hours ago"

3. Follow Mode ( Like tail -f )

You know tail -f. journalctl has the same thing.

journalctl -u myapp.service -f

-f means follow. New lines show up as they arrive. I keep this in a tmux pane when I'm debugging something live. Way better than refreshing a log file.

Pro tip: combine with priority filtering:

journalctl -u myapp.service -f -p err

-p err means only errors and above. Because you don't need 400 info lines scrolling past while you're looking for the one thing that broke.

4. Output Formats for Scripting

This is the one nobody talks about. journalctl can output JSON. Actual, parseable JSON.

journalctl -u nginx -o json-pretty --since today | head -20

Laptop with code
JSON output. Because sometimes you need to pipe logs into something smarter than your eyeballs.

Useful output formats:

-o short        # default, syslog-like
-o json-pretty  # JSON with indentation
-o json         # compact JSON ( for scripts )
-o cat          # just the message, no metadata
-o verbose      # everything, structured

-o cat is my favorite for quick reading. No hostname, no timestamp, no PID. Just the message. Clean.

journalctl -u myapp -o cat --since "10 min ago"

5. Disk Usage and Cleanup

Journald will eat your disk. Silently. Until one day your root partition is full and everything breaks.

journalctl --disk-usage

Check this. On a server that's been running a while, I've seen 2-3GB of logs easy.

Desk with laptop
Disk full. The worst kind of surprise.

Vacuum it:

# Keep only the last 3 days
journalctl --vacuum-time=3d

# Keep only 500MB
journalctl --vacuum-size=500M

And if you want this to never happen again, set a limit in /etc/systemd/journald.conf:

SystemMaxUse=500M
MaxRetentionSec=7day

Then:

systemctl restart systemd-journald

Done. Your logs stay bounded. You're welcome.

Bonus: The One-Liner I Use Weekly

When something crashed and I need to see what happened right before it died:

journalctl -u SERVICE --since "1 hour ago" -o cat -p warning

Service name, last hour, messages only, warnings and above. Takes two seconds to type and gives you exactly what you need.

That's it. Five tricks and a bonus. journalctl is not scary, it's just that nobody bothers learning the flags. Now you know them.

:)