How to Master Linux System Log Management with Journalctl and Systemd-journald on Ubuntu Server

How to Master Linux System Log Management with Journalctl and Systemd-journald on Ubuntu Server is an essential skill for anyone running production workloads on Ubuntu. System logs tell you exactly what your server is doing at any given moment. They help you catch errors, diagnose crashes, and track security events before they become serious problems. Without proper log management, troubleshooting becomes guesswork. This tutorial walks you through everything you need to know. You’ll learn how journald collects logs, how to query them with journalctl, how to set storage limits, and how to make logs persist across reboots. By the end, you’ll have a solid, working log management setup on your Ubuntu server.

Prerequisites and Requirements for Linux Log Management

Before you start, make sure you have the following in place.

Required access and software:

• An Ubuntu Server (20.04, 22.04, or 24.04)
• A non-root user with sudo privileges
• SSH access to your server
• Basic familiarity with the Linux terminal

Systemd-journald comes pre-installed on all modern Ubuntu versions. You don’t need to install anything extra to get started. The journalctl command is your main tool for reading and filtering logs collected by journald.

Estimated time: 30–45 minutes

Assumed knowledge: You should be comfortable running commands in a terminal. You don’t need to be a Linux expert. This guide explains each step clearly, including what the command does and why you’re running it.

Check your Ubuntu version before you begin:

lsb_release -a

This confirms you’re on a supported release. For more background on systemd, visit the official journalctl documentation.

Step-by-Step Guide to Mastering Journalctl and Systemd-journald

See also: How to Create and Register Custom Post Types in WordPress with the Register_post_type() Function

Step 1: Verify that systemd-journald is running

First, confirm the journald service is active on your server.

sudo systemctl status systemd-journald

You should see active (running) in the output. If it’s not running, start it with sudo systemctl start systemd-journald.

Step 2: View all system logs

The most basic journalctl command shows you every log entry on the system.

sudo journalctl

This opens a paginated view. Use the arrow keys to scroll. Press q to quit. The output can be very long on active servers, so you’ll want to filter it.

Step 3: Filter logs by time

Filtering by time is one of the most useful things you can do. It narrows down logs to a specific window.

sudo journalctl --since "2024-01-01 00:00:00" --until "2024-01-01 23:59:59"

You can also use relative time shortcuts:

sudo journalctl --since "1 hour ago"
sudo journalctl --since yesterday

These shortcuts save a lot of time during incident response.

Step 4: Filter logs by service unit

You’ll often need logs from one specific service. Use the -u flag to filter by unit name.

sudo journalctl -u nginx.service
sudo journalctl -u ssh.service --since "2 hours ago"

Replace nginx.service with any service running on your server. This is far faster than grepping through raw log files.

Step 5: Follow logs in real time

When you’re actively debugging, you want to watch logs as they arrive. The -f flag does exactly that.

sudo journalctl -f

You can combine this with a unit filter:

sudo journalctl -f -u apache2.service

Press Ctrl+C to stop the live feed.

Step 6: Filter by log priority level

Journald uses standard syslog priority levels. You can filter by severity to cut through noise.

sudo journalctl -p err
sudo journalctl -p warning..err

Priority levels range from 0 (emergency) to 7 (debug). Using -p err shows only errors and above. This is very useful when scanning for problems quickly.

Step 7: Configure persistent log storage

By default, Ubuntu may store logs only in memory. This means logs disappear after a reboot. You need to enable persistent storage.

Open the journald configuration file:

sudo nano /etc/systemd/journald.conf

Find the [Journal] section. Set the following options:

[Journal]
Storage=persistent
Compress=yes
SystemMaxUse=500M
SystemKeepFree=100M
MaxRetentionSec=1month

Here’s what each setting does:

• Storage=persistent , saves logs to disk at /var/log/journal/
• Compress=yes , compresses older log entries to save space
• SystemMaxUse=500M , caps total log disk usage at 500MB
• SystemKeepFree=100M , always keeps 100MB free on the partition
• MaxRetentionSec=1month , automatically deletes logs older than one month

Save the file and restart journald:

sudo systemctl restart systemd-journald

Step 8: Verify persistent log storage is active

Confirm logs are now being written to disk:

sudo ls /var/log/journal/

You should see a directory with a machine ID as its name. That confirms persistence is working.

Check how much disk space your logs are currently using:

sudo journalctl --disk-usage

This gives you a quick summary. You can also manually vacuum old logs right now:

sudo journalctl --vacuum-time=2weeks
sudo journalctl --vacuum-size=200M

The first command removes logs older than two weeks. The second removes logs until total usage drops below 200MB. Use whichever fits your situation.

Step 9: Export logs for external review

Sometimes you need to share logs with a teammate or save them to a file. Journalctl makes this straightforward.

sudo journalctl -u nginx.service --since "24 hours ago" > /tmp/nginx-logs.txt

You can also export in JSON format for log analysis tools:

sudo journalctl -o json-pretty --since "1 hour ago" > /tmp/logs.json

For more details on Ubuntu’s logging system, check the Ubuntu Server documentation.

Troubleshooting Common Journalctl Issues

Problem: Logs don’t persist after reboot

If /var/log/journal/ doesn’t exist, journald won’t save logs to disk even with Storage=persistent. Create the directory manually:

sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald

Problem: Disk space filling up fast

If logs are consuming too much space, run a vacuum immediately:

sudo journalctl --vacuum-size=100M

Then lower SystemMaxUse in /etc/systemd/journald.conf and restart the service.

Problem: Permission denied when reading logs

Regular users can’t read all logs by default. Add your user to the systemd-journal group:

sudo usermod -aG systemd-journal your-username

Log out and back in for the change to take effect.

Problem: journalctl output looks garbled

This sometimes happens with older terminal emulators. Disable color output with:

sudo journalctl --no-pager --output=short-precise

Tip: Always check journald’s own logs if something seems off:

sudo journalctl -u systemd-journald --since "1 hour ago"

Conclusion: Taking Control of Linux System Log Management

You now know how to master Linux system log management with journalctl and systemd-journald on Ubuntu Server. You’ve set up persistent storage, learned to filter logs by time, service, and priority, and configured disk usage limits to keep your server healthy. These skills apply directly to real-world troubleshooting and server maintenance.

From here, you can go further. Consider setting up log forwarding to a centralized system like Elasticsearch or Graylog. You might also explore logrotate for managing traditional text-based log files alongside journald. Pairing both tools gives you complete coverage of your server’s logging needs. Good log management