How do I read recent logs for one Linux service?
journalctl can filter the system journal to one service and a relevant time window. This is usually more useful than dumping every server log. The journal contains only messages that were actually recorded and retained, so an empty result is not evidence that no problem occurred.
Before you start
- Permission to read the selected service’s journal.
Instructions
1. Choose the exact service and time window
Replace example.service with the installed unit. Use the period surrounding the reported incident rather than a broad, unbounded log export.
sudo journalctl -u example.service --since "1 hour ago" -n 100 --no-pagerThe unit filter restricts the scope and -n bounds output to the most recent 100 matching entries. sudo requires authorised journal access.
2. Connect the message to the current state
Check whether the service failed, restarted or is still responding. Preserve the error and a few surrounding lines, while redacting tokens and personal information before sharing.
systemctl show example.service -p ActiveState -p SubState -p ResultThese properties help relate a log message to the current unit state, but application health still needs its own check.
Check the result
- The excerpt contains the relevant service, timestamps and error context. Verify the reported operation itself after any repair.
Troubleshooting
- No entries are found
- Check unit spelling, user-versus-system journal, retention, permissions and whether the application logs to files instead.
- Only the last part of the incident appears
- Widen the time window or output count deliberately; do not assume a bounded excerpt contains the whole timeline.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.