How to View Systemctl Logs

The systemd is one of the widely adopted init systems on Linux. The key advantage of systemd is its ability to manage the system logs. It collects all the kernel messages and user processes into a log called Journal. The journald is the daemon that captures and manages the logs in a binary file. This daemon has the key benefit of storing data in structured and indexed form, making it easy to access and analyze through the journalctl utility.

In this guide, I will be covering how to view systemd logs on Linux using different command line utilities.

Note: The commands mentioned in this guide are performed on Ubuntu. They will work without errors on all Linux distributions that come with the systemd init system.

Methods to View systemctl Logs

There are two approaches to viewing systemd logs on Linux:

• Through systemctl Command
• Through journalctl Command

The systemctl gives the most recent service-specific logs, while journalctl gives in-depth system-wide logs of all services and the specific service.

I will explore both utilities to view systemd logs. But first, let’s understand the key difference between systemctl and journalctl commands.

What is systemctl

Systemctl is a command line utility that manages systemd services, such as enabling or disabling the service and viewing the status. The systemctl status command also prints a few log lines of the service at the bottom of the output, and this log is after the recent boot. However, these log lines of the service are from after the current boot only.

What is journalctl

The journalctl is a command line utility used to print the logs collected by systemd. Compared to systemctl, it provides detailed output with filtering options. This utility is designed to:

• Read logs (Oldest log comes first)
• Monitor logs
• Filter logs based on time, service, or user

The systemd collects logs from kernel, services, and daemons and stores them in a centralized place.

How to View Log of a Service using systemctl

The general syntax to find the log of a service using the systemctl utility is mentioned below.

For example, to view the log information of the smbd.service use the command given below.

To get output without pagination, add the –no-pager option in the command.

How to View Log of a Service using journalctl

To view the log of a specific service of systemd, use journalctl with the -u command and service or unit name.

In the above command, the -u flag, short for –unit is used to filter the journalctl output by a unit name.

For example, to print the log of the smbd daemon, I will replace the [unit-name] with smbd.service.

In the output, it can be seen that the oldest entry comes first and then logs after each boot is listed.

To get the latest entry first use -e short for –pager-end.

If you want to omit the pagination from the output, simply append the –no-pager in the above-mentioned commands.

To continuously print the log entries in real-time use -f short for –follow.

The filtering can further be expanded by using the -b flag short for –boot, which prints the logs based on the current boot.

Let’s print logs of the smbd.service from the recent boot.

The above output resembles the output we get using the systemctl status command.

To get a detailed log overview, use the -x short for –catalog option.

This will append a short description of the log.

Now, to print logs based on time using journalctl there are two options, -S short for –since and -U short for –until.

For example, to view the logs of unit smbd from 2024:01:30 12:05:00.

Conclusion

To view the systemd logs of a service, there are two main utilities, journalctl and systemctl. The journalctl is specifically designed for viewing the logs of systemd. However, the systemctl also has an option of printing the log of the service. To print the log of a service use, journalctl -u [unit-name] and systemctl [unit-name].