The command journalctl -u shows the systemd journal for one named service unit. You pick the unit, bound the time if you need to, and print the lines without a pager. That habit ends tickets that start with “sshd is weird” or a screenshot of less with no way out. The unit name is the one systemctl list-units lists, not a guess at a path under /var/log.
Use -u name every time. Add -S today or --since to cut older noise. Prefer -p err when you only want errors and worse. Flag -b limits output to this boot; -b -1 is the previous boot, which you want after a panic or unexpected reboot. Persistent journals need Storage=persistent in journald.conf, or the last boot’s crash lines may already be gone.
journalctl -u ssh -S today –no-pager | tailOn Debian the unit is often ssh; on RHEL it is usually sshd. If this prints nothing, you have the wrong unit name. Run systemctl list-units --type=service | grep -i ssh before you invent a path. The --no-pager flag makes the output a paste, not a pager a colleague does not know how to quit. The key q also works, but screenshots of a colon prompt waste everyone’s time.
Boots, priority, and time windows
After an unexpected reboot, start with -b -1, not plain -b. This boot’s log often begins at “started” and misses the crash that caused the reboot. Priority err is a filter, not a promise that useful notices live only at error level. If you need the warning that came right before the failure, drop -p and keep the since window tight instead.
On a cPanel VPS you still have Apache or LiteSpeed request logs in the account. Those show hits and status codes. The unit log is why the daemon itself did not start or stay running. Once you can pull a unit’s day without thinking, the failed unit workflow is the same habit plus reset-failed.
Filters that actually cut noise
Extra matchers such as _PID= and SYSLOG_IDENTIFIER= help when one unit wraps several binaries. Grepping the unit log for error is fine. Piping the whole system journal through grep is how you miss a line that sat at notice. If the service writes to both syslog and the journal, you may see duplicates. Prefer the unit filter and ignore the duplicate rather than grepping both places “to be sure.”
When the log is empty
Empty output almost always means the wrong unit name or a time window that excludes the event. Confirm the unit with systemctl, widen --since briefly, then tighten it again once you see the lines you need. That short loop is the whole skill behind journalctl -u.
Tagged
Was this article helpful?
Be the first to rate this article.
