Lesson 2.14: journalctl in depth: filtering the journal
systemd's journal collects messages from the kernel, every service and system tools in one indexed store. Its strength is filtering: by unit, priority, time window, kernel only, a text pattern, and structured output that tools like jq can read. In the lab you reconstruct last night's checkout outage on web02: the window of shop API messages, every warning on the machine at that time, the kernel killing the API for running out of memory, the most frequent errors, and how much history the journal keeps.
16 min
You will learn to
- Filter the journal by unit and time window
- Filter by priority across all units
- Read kernel messages such as the OOM killer
- Use JSON output with jq
- Check journal size and retention
Key terms
- systemd-journald
- The service that collects log messages from the kernel, services and syslog into an indexed binary store.
- Priority
- Syslog severity from 0 (emerg) to 7 (debug); -p X shows X and more severe.
- OOM killer
- The kernel's last resort when memory runs out: it kills the process using the most.
- Structured fields
- Each entry carries named fields: MESSAGE, PRIORITY, _PID, _SYSTEMD_UNIT…
- Retention
- How much or how long logs are kept before the oldest are removed.
← Introduction to the command line · All lessons · Secrets in process memory and ptrace →