journalctl queries and displays logs stored by the systemd journal. Unlike traditional text logs, the journal uses a binary format that makes access faster and storage more compact, but prevents tools such as tail from reading it directly. section 3.2.1
Use its query interface to narrow operational logs by:
- priority, such as --priority=3 to show Error-level messages and more severe entries. section 3.2.1
Querying a service
journalctl --since "12 hours ago" -u example.service retrieves recent entries for one systemd service, supporting both interactive investigation and one-shot queries.
