Viewing logs in Linux (systemctl and journalctl)

You will learn how to view process logs. You will learn how to display the full log for a process, how to use the systemctl status command, and how to use the journalctl command. You will need administrator privileges.

Viewing logs using the systemctl status command

The simplest (but definitely not the best) way is to use the systemctl status command. The advantage of this method is its simplicity, while the downside is its limited functionality. The syntax is shown below.

sudo systemctl status <service_name>

Example:

sudo systemctl status docker

It is easy to see that the command displays only the last few log lines by default. If you want to display more, use the -n <no_lines> parameter. The example below displays the last 50 lines and lets you scroll through them.

sudo systemctl status -n 50 docker

Viewing logs using the journalctl command

A much better way to view logs is to use the journalctl command. The general syntax is shown below.

sudo journalctl -u <service_name>

Example:

sudo journalctl -u docker

If you want to display the entire log without pagination, use the --no-pager parameter.

sudo journalctl -u docker --no-pager

If you want to display the log starting from the latest entries, use the -e parameter. You will then see the newest entries first.

sudo journalctl -u docker -e

If you want to see only entries from the current system boot, use the -b flag.

sudo journalctl -u docker -b

If you want to see logs updated in real time, use the -f flag.

sudo journalctl -u docker -b