journalctl 사용법, 서비스 로그를 어떻게 필터하나

Short answer: journalctl is the core tool for querying the systemd journal. Use -u (unit) and -b (boot) to narrow the scope, then --since/--until and -p (priority) to filter by time and severity so you can find exactly the logs you need.

This post covers slicing logs by unit and boot, narrowing them by time range and priority, and managing the disk space journals consume. It does not cover a service’s Type= setting or a timer’s OnCalendar= configuration.

How do you slice logs by unit and boot?

Short answer: Use -u to filter a specific service’s logs, and -b to select a boot session; combine both to see one service’s logs from one specific boot.

The -u <unit> option filters logs for a specific unit, such as nginx.service.

journalctl -u nginx.service

The -b option slices logs by boot session. Used with no argument it shows the current boot’s logs; -b -1 is the previous boot, and -b -2 is the boot before that.

journalctl -b
journalctl -b -1

Combining both options extracts exactly one service’s logs from one specific boot.

journalctl -u nginx.service -b

How do you narrow logs by time range and priority?

Short answer: Set a window with --since/--until and filter by severity with -p to quickly surface recent critical errors.

--since and --until accept formats like “yesterday”, “today”, or “2023-10-01 12:00:00” to query logs within a specific time range.

journalctl --since "today"
journalctl --since "2023-10-01 12:00:00" --until "2023-10-01 18:00:00"

-p <priority> specifies a syslog priority level (such as err, warning, or info) and filters for logs at that level or higher.

journalctl -p err

Combining a time range with a priority filter narrows the search considerably.

journalctl -u nginx.service -p err --since "today"

How do you manage the disk space journals consume?

Short answer: Set a cap with SystemMaxUse= in journald.conf, or clean up old logs manually with journalctl --vacuum-time=/--vacuum-size=.

Logs collected by the systemd-journald daemon consume disk space once persistent storage (Storage=persistent) is configured.

The SystemMaxUse= or SystemKeepFree= directives in /etc/systemd/journald.conf set an upper bound on total journal size.

# /etc/systemd/journald.conf
[Journal]
SystemMaxUse=500M

To clean up old logs immediately, use the journalctl --vacuum-time= or --vacuum-size= commands.

journalctl --vacuum-time=1M
journalctl --vacuum-size=1G

What are some common questions?

Question	Answer
How do I follow logs in real time?	Use the journalctl -f (follow) option, which is especially useful when combined with a specific unit (-u).
How do I check several boots at once?	Pass different numbers to -b and check each boot separately.
What if disk space runs low urgently?	Use journalctl --vacuum-size= to shrink the journal immediately.

What is the main takeaway?

Combining journalctl’s -u/-b/--since/-p filters lets you quickly find the exact service logs you need within a vast system log. Adding journald.conf’s size settings and the --vacuum-* commands keeps disk usage under control as well.