journalctl Filtering Step by Step: A Beginner's Guide to Linux Log Analysis

Linux systems generate logs constantly. Every login attempt, service start, shutdown event, and system error leaves behind information that can help you understand what is happening on your machine.

The challenge is that there can be thousands of log entries. Finding the information you need quickly can feel overwhelming when you’re new to Linux.

That’s where journalctl filtering becomes useful.

In this guide, you’ll learn how to filter Linux logs step by step using practical examples that you can immediately use in real-world troubleshooting situations.

What Is journalctl?

journalctl is the command used to view logs stored in the systemd journal.

Think of the journal as a central database that collects system logs from services, applications, and the operating system itself.

Before learning filtering, let’s first look at the journal.

journalctl

Example output:

May 29 09:15:01 server1 systemd[1]: Started Daily Cleanup Service. 
May 29 09:16:11 sshd[1212]: Accepted password for bob 
May 29 09:18:44 NetworkManager[804]: device connected 
May 29 09:20:01 cron[1455]: Job completed

This command displays all available journal entries.

On many systems, this could be thousands or even millions of lines.

When you’re troubleshooting a server or workstation, this provides a complete history of system activity.

To exit the journal view, press:

View Only Recent Log Entries

Most of the time, you don’t need every log entry ever created.

You usually want recent activity.

journalctl -n 20

Example output:

May 29 10:01:01 sshd[2221]: Accepted password for admin 
May 29 10:02:14 sudo[2240]: bob executed apt update 
May 29 10:03:22 systemd[1]: Backup service completed

The -n option tells journalctl how many lines to display.

In this example, only the most recent 20 log entries are shown.

Practical Use

If a user reports a problem that occurred a few minutes ago, this is often the quickest place to start.

Watch Logs in Real Time

Sometimes you need to monitor logs as events happen.

journalctl -f

Example output:

May 29 10:10:01 sshd[3001]: Accepted password for bob 
May 29 10:10:15 sudo[3010]: bob executed reboot

New entries will continue appearing automatically.

The -f option means “follow” and behaves similarly to tail -f.

Practical Use

This is useful when restarting services or troubleshooting issues while they occur.

Press:

Ctrl+C

to stop following the logs.

Filter Logs by Service

One of the most useful filters is filtering by service.

To view only SSH-related logs:

journalctl -u ssh

Example output:

May 29 09:15:01 ssh.service Started OpenSSH Server 
May 29 09:20:12 sshd[2011]: Accepted password for bob 
May 29 09:22:14 sshd[2040]: Connection closed

The -u option stands for unit, which refers to a systemd service.

Practical Use

If users cannot connect through SSH, this filter helps you focus only on SSH activity without unrelated log messages.

Combine Service Filtering with Recent Entries

You can combine filters together.

journalctl -u ssh -n 20

Example output:

May 29 10:02:15 sshd[2210]: Accepted password 
May 29 10:03:01 sshd[2245]: Connection closed

This displays only SSH logs and only the most recent 20 entries.

Practical Use

Quickly verify whether users are currently connecting successfully.

Filter Logs by Date

You can limit output to logs generated today.

journalctl --since today

Example output:

May 29 08:01:00 systemd[1]: Started backup service 
May 29 08:15:22 sshd[2000]: Login successful

Practical Use

When investigating an issue that happened earlier in the day, you can ignore older log entries.

View Logs from the Last Hour

To view logs generated within the past hour:

journalctl --since "1 hour ago"

Example output:

May 29 09:45:22 sshd[2001]: Accepted password 
May 29 09:50:10 sudo[2050]: User executed command

Practical Use

This is useful during outages or recent incidents where only recent activity matters.

Filter Between Specific Times

You can define both a start and end time.

journalctl --since "09:00" --until "10:00"

Example output:

May 29 09:05:00 sshd[1111]: Login successful 
May 29 09:45:10 sudo[1122]: User executed command

Practical Use

When you know exactly when an issue occurred, you can isolate the logs from that specific period.

Filter by Priority Level

Linux logs have different severity levels.

To display only errors:

journalctl -p err

Example output:

May 29 09:55:10 sshd[1111]: Failed authentication 
May 29 10:00:01 backup.service: Job failed

Practical Use

When troubleshooting, error messages are often the fastest way to identify the root cause.

View Warnings and Higher

To display warnings, errors, and more severe messages:

journalctl -p warning

Example output:

May 29 09:50:00 kernel: Disk usage high 
May 29 09:55:00 backup.service: Job failed

Practical Use

This provides a quick overview of potential system health concerns.

View Logs from the Current Boot

To display logs since the system was started:

journalctl -b

Example output:

May 29 08:00:01 kernel: Linux version loaded 
May 29 08:00:12 systemd: Starting services

Practical Use

Useful when troubleshooting issues that started after a reboot.

View Logs from the Previous Boot

To examine the logs from the previous startup:

journalctl -b -1

Example output:

May 28 21:10:01 kernel: Shutdown initiated 
May 28 21:12:00 systemd: System halted

Practical Use

Helpful when investigating unexpected reboots or crashes.

Search for Specific Text

You can combine journalctl with grep.

journalctl | grep ssh

Example output:

May 29 09:20:12 sshd[2011]: Accepted password 
May 29 09:22:14 sshd[2040]: Connection closed

Practical Use

Quickly locate all entries related to a specific service or keyword.

Combine Multiple Filters

One of the most powerful features of journalctl is combining filters.

journalctl -u ssh --since today -p warning

Example output:

May 29 09:55:10 sshd[2222]: Failed authentication

This command displays:

Only SSH logs
Only today’s logs
Only warning-level messages and above

Practical Use

Finding authentication problems quickly during troubleshooting.

Common Beginner Mistakes

Forgetting sudo

Some logs require elevated privileges.

If output seems incomplete, try:

sudo journalctl

Using the Wrong Service Name

Verify available services with:

systemctl list-units --type=service

Forgetting Quotes Around Time Filters

Correct:

journalctl --since "1 hour ago"

Incorrect:

journalctl --since 1 hour ago

Time expressions should be enclosed in quotation marks.

Real-World Troubleshooting Example

Imagine a user reports that they cannot log in through SSH.

Instead of searching through thousands of log entries, you could run:

sudo journalctl -u ssh --since "30 minutes ago"

Example output:

May 29 10:15:22 sshd[5000]: Failed password for bob 
May 29 10:16:05 sshd[5001]: Failed password for bob 
May 29 10:18:20 sshd[5002]: Accepted password for bob

From just a few lines, you can see:

The user attempted to log in
The first two password attempts failed
The third attempt succeeded

This is exactly why filtering matters. Instead of searching through thousands of log entries, you can find the answer in seconds.

Next Steps

Once you’re comfortable with journalctl filtering, try combining it with grep for even more targeted searches.

journalctl -u ssh --since today | grep Failed

This helps narrow down large amounts of log data into exactly the information you need.

Start with a few filters, practice them regularly, and you’ll quickly become much more comfortable troubleshooting Linux systems.

Conclusion

The biggest mistake beginners make with journalctl is trying to read everything.

The real power of the command comes from filtering.

Whether you’re filtering by service, time, priority level, boot session, or specific text, these simple techniques can dramatically reduce the amount of information you need to review.

As you continue learning Linux, journalctl will become one of the most valuable troubleshooting tools in your toolkit.