journalctl --utc
journalctl /usr/bin/bash # by binary
journalctl _UID=1000 -n # by user
journalctl -k # kernel messages
journalctl --no-full # display some information
journalctl -a # display all information
journalclt --no-pager # good for read
journalctl -n # recent logs
journalctl -n 20 # recent 20 logs
systemctl list-units --type=service
journalctl -u nginx -o json-pretty
sudo journalctl --vacuum-size=1G
sudo journalctl --vacuum-time=1yearsjournalctl -u nginx -p 3
0: emergency
1: alerts
2: critical
3: errors
4: warning
5: notice
6: info
7: debugjournalctl --list-boots
journalctl -b # current boot
journalctl -b -1 # previous boot# "yesterday", "today", "tomorrow", or "now"
journalctl --since "2015-01-10" --until "2015-01-11 03:00"
journalctl --since yesterday
journalctl --since 09:00 --until "1 hour ago"sudo journalctl --rotate
sudo journalctl --vacuum-time=1sOne of "volatile", "persistent", "auto" and "none". If "volatile", journal log data will be stored only in memory, i.e. below the /run/log/journal hierarchy (which is created if needed). If "persistent", data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy (which is created if needed), with a fallback to /run/log/journal (which is created if needed), during early boot and if the disk is not writable. "auto" is similar to "persistent" but the directory /var/log/journal is not created if needed, so that its existence controls where log data goes.
/etc/systemd/journald.conf
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald