journalctl
queries and dumps logs from the systemd journal. This is where logs from daemons, apps, the kernel, etc. get stored.
- The systemd journal is stored at
/var/log/journal
.
By default it shows the earliest logs first, then the latest logs at the bottom.
Here are some useful journalctl commands:
journalctl -p err
shows error logs.journalctl --follow
shows the most recent logs, real-time.