What is journalctl and what are its most useful options?

Question

Accepted Answer

journalctl is the query tool for the binary systemd journal — filter by unit (-u), priority (-p), time (--since), or follow live (-f).
Because the journal is a structured binary database (not a text file), you can't grep it directly — journalctl is how you read and filter it. Its power is that filters stack: each flag narrows the result set, so you zero in on exactly the events you want instead of scrolling.

Command
What it does

journalctl
All entries, oldest first

journalctl -n 5
Last 5 entries

journalctl -f
Follow live, like tail -f

journalctl -p err
Errors and above (severity ≤ 3)

journalctl --since today
Only today's entries

journalctl --since "1 hour ago"
Last hour

journalctl -o verbose
Show every stored metadata field

journalctl -u sshd.service
Only the sshd unit

journalctl _PID=1234
Only that process's PID

Fields starting with _ (like _PID, _COMM, _UID) are trusted metadata that journald stamps itself — a process can't forge them, which makes them reliable for auditing.
Stacking filters is the everyday workflow:
journalctl -u sshd.service -p err --since today   # sshd's errors, from today only

Tip: Append -f to any of these to watch matching events stream in live.
Go deeper:

journalctl(1) man page (man7.org) — -u, -p, --since, -f, -o verbose and the _PID/_COMM trusted fields.

Command	What it does
`journalctl`	All entries, oldest first
`journalctl -n 5`	Last 5 entries
`journalctl -f`	Follow live, like `tail -f`
`journalctl -p err`	Errors and above (severity ≤ 3)
`journalctl --since today`	Only today's entries
`journalctl --since "1 hour ago"`	Last hour
`journalctl -o verbose`	Show every stored metadata field
`journalctl -u sshd.service`	Only the sshd unit
`journalctl _PID=1234`	Only that process's PID