Filter the journal

The journal stores structured fields alongside each message: the unit, the boot, the priority, the PID. Filters turn that structure into focused evidence, which beats scrolling through a mixed stream of everything the server logged.

Narrow by unit, boot, and time

journalctl -u demo-api.service -b

-u selects one unit’s messages — both what the application printed and what systemd said about it. -b restricts to the current boot, which removes last week’s noise from today’s investigation.

Time windows stack on top:

journalctl -u demo-api.service --since "14:00" --until "14:30"
journalctl -u demo-api.service --since "10 min ago"

--since and --until accept timestamps and human phrases. Combine them with -u and you can isolate one incident on one service in seconds.

Narrow by priority, then follow

-p filters by syslog priority. -p err shows errors and worse; -p warning includes warnings:

journalctl -u demo-api.service -p err -b

An empty result here is meaningful: the service logged no errors this boot, so look elsewhere.

-f follows new entries, like tail -f for one unit:

journalctl -u demo-api.service -f

Keep that running while you restart a service or send a test request. Watching cause and log effect together is the fastest way to connect them.

Previous boots need persistent storage

Previous-boot logs require persistent journal storage and can be read with -b -1. If you instead see this, the journal lives in memory and died with the reboot:

Specifying boot ID or boot offset has no effect, no persistent journal was found.

The fix on Ubuntu is creating the on-disk directory and restarting journald:

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

Do this before you need it. The most interesting boot is usually the one that just crashed.

Choose a recent service event — a restart, an error, a deploy. Produce the smallest journal query that includes the event and enough surrounding context to explain it. If your query returns more than a screen or two, add another filter.