What you will achieve
Find relevant error lines in systemd journals without drowning in unrelated log noise.
1) Basic journalctl usage
journalctl -e
journalctl -f
journalctl -b-e— jump to end of logs.-f— follow live (like tail -f).-b— current boot only.
2) Filter by systemd unit
journalctl -u nginx.service -b
journalctl -u ssh.service --since "1 hour ago"Replace unit name with your service (apache2, mariadb, docker, etc.).
3) Time windows and priority
journalctl --since "2026-06-09 09:00" --until "2026-06-09 10:00"
journalctl -p err -b-p err shows error level and worse (emerg, alert, crit, err).
4) Kernel messages
journalctl -k -bUseful for driver, disk, and hardware issues at boot.
5) Export for tickets
journalctl -u myapp.service -b --no-pager > ~/myapp-journal.txtRedact secrets before sending logs to third parties.
Verify
You can reproduce an issue, run the failing service, and locate the exact error line with unit + time filters in under a minute.