linux / logs

updated July 19, 2026

My services on Linux VMs run under systemd. systemd captures each service's stdout and stderr into its journal, so I read logs with journalctl instead of hunting for files.

A service's logs

Every unit's output is addressable by name:

journalctl -u cibot-farmer         # everything for the unit
journalctl -u cibot-farmer -n 50   # last 50 lines
journalctl -u cibot-farmer -f      # follow live, like tail -f
journalctl -u cibot-farmer -e      # jump to the end

Template units are addressed by instance:

journalctl -u 'cibot-worker@1'
journalctl -u 'cibot-worker@*'     # all instances

By time

journalctl -u cibot-farmer --since "10 min ago"
journalctl -u cibot-farmer --since today
journalctl -u cibot-farmer --since "2026-07-19 17:00" --until "18:00"

Boot and severity

journalctl -b        # since the current boot
journalctl -b -1     # the previous boot
journalctl -p err    # errors and worse, any unit

Filtering

Pipe to grep, or use the journal's own matching:

journalctl -u cibot-farmer | grep error
journalctl -u cibot-farmer -g connect   # journal-native regex

Why the journal

The service prints plain text and systemd stores it. There are no log-file paths to remember and no logrotate to configure, and journalctl reads the same way for every service on the box.

To check health without reading logs:

systemctl is-active cibot-farmer
systemctl status cibot-farmer

← All articles