📜 Command: journalctl (System Log Viewer)
The journalctl command is your window into the systemd journal. It collects and manages logging data from the kernel, system services, and the boot process. On Arch Linux, if something breaks, this is the first place you look to find out why.
1. The "Why"
As a power user managing a custom Hyprland setup and developing Java/Android apps, logs are your best friend for debugging.
- Debug Crashes: Find out why your display manager or a specific service (like
sshd) failed to start. - Monitor Kernel Events: Watch your CPU or GPU logs for hardware-level errors.
- Security Auditing: See who has been trying to
sshinto your machine. - App Troubleshooting: If your Supabase backend or documentation viewer acts up, check the service logs here.
2. Basic Syntax
journalctl [OPTIONS]
If you run it by itself, it shows every log entry desde the beginning of time (or since your last log rotation), which is overwhelming. You need flags to filter the noise.
3. Essential Filtering Flags
| Flag | Purpose | Example |
|---|---|---|
-b |
Current Boot | Show logs only from the current session. |
-u [unit] |
Specific Service | Show logs for one service (e.g., -u bluetooth). |
-p [level] |
Priority | Filter by importance (e.g., -p err for errors). |
-f |
Follow | Live-stream logs as they happen (great for debugging). |
-n [x] |
Lines | Show only the last x lines. |
4. Practical Examples for Your Workflow
A. "What just happened?" (Latest Errors)
To see the most recent errors from the current boot session:
journalctl -b -p err
B. Debugging a Failing Service
If you tried to start a service with systemctl and it failed, check its specific story:
journalctl -u sshd.service
C. Live Kernel Monitoring
Useful if you are plugging in new hardware or troubleshooting driver issues with your vivo phone or GPU:
journalctl -k -f
D. Logs Within a Time Frame
Check what happened during your last study session or work block:
journalctl --since "2026-04-30 09:00:00" --until "2026-04-30 12:00:00"
5. Managing Log Size
On Arch, logs can grow quite large over time, eating up your disk space (which you checked with df earlier!).
- Check Disk Usage of Logs:
journalctl --disk-usage - Clean Old Logs:
Keep only the last 500MB of logs:
sudo journalctl --vacuum-size=500M
6. Pro-Tips
- No Sudo? By default, users in the
systemd-journaloradmgroups can view logs withoutsudo. On Arch, adding your user to these groups makes debugging much faster. - Search Mode:
journalctluseslessto display logs. Press/while viewing to search for keywords (like "fail" or "nvidia"). - JSON Output: If you are building a tool (like your documentation viewer) and want to parse logs with a script, use
-o json.
7. Summary Reference
| Goal | Command |
|---|---|
| Latest boot logs | journalctl -b |
| Live updates | journalctl -f |
| Filter by service | journalctl -u [name] |
| See only Kernel logs | journalctl -k |
| Clear old logs | sudo journalctl --vacuum-time=7d |