journalctl

-u filters to entries from that unit, across all boots still in the journal, oldest first, in the pager. Repeat -u to interleave several units in time order.

-f prints the last ten entries and then waits for new ones, like tail -f. Press Ctrl-C to stop. Useful in a second terminal while you restart the service.

-n 50 keeps the 50 most recent entries and --no-pager prints them straight to the terminal, which is what you want in scripts and when pasting into a ticket.

-b limits output to the current boot; -b -1 is the previous one, the place to look after an unexpected reboot, and -e jumps to its end. --list-boots shows which boots the journal still holds. Previous boots are only kept if the journal is persistent (/var/log/journal exists).

-p err shows priority err and everything more severe (crit, alert, emerg). Levels can be names or numbers 0 to 7; a range such as -p warning..err is also accepted.

--since and --until take absolute times, today, yesterday, or relative forms like 1 hour ago and -30min. Narrowing by time first is much faster than paging through everything.

-k shows only kernel messages from the current boot, the same content as dmesg but with wall-clock timestamps. Add -b -1 for the previous boot, which dmesg cannot show, as long as the journal is persistent.

-g (--grep) filters on the message with a regular expression; it is case-insensitive unless the pattern contains uppercase. Combining it with -u and --since keeps the search fast.

-o json prints one JSON object per entry with every field (MESSAGE, _PID, PRIORITY, _SYSTEMD_UNIT and more), ready for jq. -o json-pretty is the readable version of the same.

-o cat drops the timestamp, host and unit prefix and prints only the message, which is handy when the application already writes its own timestamps or JSON lines.

Prints one line with the total size of active and archived journal files.

Vacuuming deletes archived journal files older than the given age or until the total fits the size. The active file is not touched, so run journalctl --rotate first if you need to reclaim everything. For a permanent cap, set SystemMaxUse= in /etc/systemd/journald.conf.

Units started with systemctl --user log to your user journal, read with --user.

This one did run, inside the build container. There are no journal files because no journald is running, so journalctl reports that and exits successfully with nothing to show. Logs of containerized programs go to the container runtime instead (docker logs).