When a service fails, an unfiltered journal can bury the useful error among thousands of unrelated events. Start with a specific unit and a bounded time window.

What you will build

Filter a systemd service journal by unit, time range and priority without dumping the entire server log.

Before you start

A Linux machine using systemd and journal access. Replace the example unit with a service that exists on your machine.

1. Create journal_commands.sh

# Discover the unit name before choosing a service.
systemctl list-units --type=service --all

# Example for an Ubuntu Apache service; change the unit as needed.
journalctl --unit=apache2.service --since="30 minutes ago" \
  --priority=warning --no-pager --lines=100

# Include surrounding informational messages in the same time window.
journalctl --unit=apache2.service --since="30 minutes ago" \
  --no-pager --lines=150

# Watch new entries; Ctrl+C stops watching.
journalctl --unit=apache2.service --follow --lines=20

2. Run the example

Run the commands individually after choosing the correct service unit.

Expected result

The first journal command shows up to 100 recent entries at warning priority or more severe. An empty result can mean there are no matching entries or that your account lacks access.

How it works

The unit filter limits the investigation to one service. --since bounds the time window, while --lines caps the displayed entries. These options make a first investigation easier to review and share.

The warning threshold includes more severe levels, rather than only exact warning entries. If the filtered view is empty, remove the priority filter to see startup and shutdown context before assuming the service was healthy.

The follow view continues running until interrupted. It is useful while reproducing one request, but service logs may omit application-specific errors written to separate files. For example, Apache can have a dedicated virtual-host error log.

Journal access depends on local permissions and retention settings. Logs may contain personal data or tokens; redact those values before posting an excerpt publicly. These commands inspect logs and do not restart services.

Test the edge cases

  • Choose a nonexistent unit and compare the empty result.
  • Check a known restart time with a narrower absolute time range.
  • Compare journal results with the application’s own configured error log.

Keep learning

Browse related tutorials. Reference: official documentation.

Reviewed 7 November 2026. AI-dependent examples require your own local model; generated text varies.