Efficiently Managing Linux System Logs with Journalctl

In modern systemd-based Linux distributions, journald captures logs from the kernel, services, and system processes into structured, binary-encoded files. The journalctl utility is the powerful interface for querying, filtering, and analyzing these logs, replacing text-based log parsing with high-performance indexed queries.

1. Real-time Log Monitoring

To follow logs as they occur, mirroring the classic tail -f functionality, use the -f flag. Combining this with -u allows for service-specific monitoring:

# Follow logs for a specific service
journalctl -u nginx.service -f

2. Filtering by Time and Severity

Instead of manual line-by-line inspection, utilize time-based filters. You can specify relative offsets or exact timestamps:

# Logs since the last 30 minutes
journalctl --since "30 minutes ago"

# Errors only
journalctl -p err -b

3. Log Rotation and Disk Usage

To prevent logs from consuming excessive storage, manage rotation policies via journalctl's vacuuming capabilities rather than manually deleting files:

# Check current disk usage
journalctl --disk-usage

# Keep only the last 500MB
journalctl --vacuum-size=500M