journalctl and boot logs

1. Some journalctl flags

It shows only kernel messages:

$ journalctl -k

(or --dmesg)

Or you can just use the dmesg command. dmesg shows the Kernel Ring Buffer logs.

Boot messages:

$ sudo journalctl -b

(boot)

$ sudo journalctl -p 2

(showing critical errors and above)

(sudo journalctl -p [level])

You can combine both flags:

$ sudo journalctl -b -p 2

2. journalctl levels of priority

Lower numbers = Higher danger (0 is the worst).Filtering by priority also shows all levels above that priority.

Level Name Description

0 emerg System is unusable (panic).

1 alert Action must be taken immediately.

2 crit Critical conditions (hardware/disk failure).

3 err Non-critical error messages.

4 warning Warning messages (deprecated features, etc.).

5 notice Normal but significant conditions.

6 info Informational messages.

7 debug Debug-level messages (very wordy).

3. Checking boot messages in log files

In older systems (before Systemd) checking boot messages was done by looking at boot messages stored in:

• /var/log/boot (some Debian-based distros and older Ubuntu versions)

• /var/log/boot.log (Red Hat-based distros and more recent Ubuntu versions)

It usually stores only the current system boot (it doesn't log previous boots).

To properly see the boot logs, use less -R, so you can actually see the lines with colours.

Pros: A quick glance at the service start/stop status (the "OK" or "FAILED" messages you see during startup).

Cons: the information may be incomplete.

4. Advanced journalctl configurations

With Systemd, it is possible to save previous boots. To save previous logs, we need to tell systemd that we would like to have persistent logs. On many distributions, journal logs are not saved, so we can't analyse past boots logs.

$ sudo mkdir -p /var/log/journal

$ sudo systemd-tmpfiles --create --prefix /var/log/journal

$ sudo systemctl restart systemd-journald

Another useful command where we can keep a record of our boots (notice we have to use sudo to see our logs):

$ sudo journalctl --list-boots

Similarly, we have:

$ last reboot

to list any time your system was booted.

Another configuration we must do so we see all our logs without root permission:

$ whoami

$ sudo usermod -aG systemd-journal [my_user]

$ id

$ groups

We can see that the groups have not updated although we can see the user was successfully added to the group:

$ sudo cat /etc/group | grep journal

systemd-journal:x:...:[my_user]

We can use a command that is not included for the LPIC-1 first exam, so we do not have to wait to reboot the system to update the groups:

$ newgrp systemd-journal

$ id

$ groups

Now that our group is updated, we can run journalctl without sudo:

$ journalctl -b -1 -n 50

and we are telling journal to look into the logs from our past boot.

5. Real case scenario

My laptop took longer than usual to shutdown so next time I started the system, I searched for clues in my logs with journalctl. After some searches, I finally found the line where it was the solution to the mystery.

$ journalctl -b -1 --since "2026-04-02 21:34:00" -p 4

[...]

Apr 02 21:36:58 pc01 systemd[2496]: xdg-document-portal.service: State 'stop-sigterm' timed out. Killing.

[...]

This line is telling that systemd SIGTERM timed out so it sent a SIGKILL to force ending the process with PID 2496.