Set of Journalctl commands to use as a cheat sheet.
# Print logs by unit
journalctl -u sshd.service
# Print extended logs
journalctl -u sshd.service -x
# Go to end of log
journalctl -e
# Follow logs
journalctl -e -f
# Print logs since timestamp
journalctl --since today
# By level/priority (emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), debug (7)
journalctl -p 0
journalctl -p 0..4
journalctl -p emerg..err
# Kernel messages only
journalctl -k
# Print logs for a specific executable
journalctl /sbin/sshd
# By user
journalctl _UID=1008
# By PID
journalctl _PID=13524
# Output format: short-precise (microsecond), short (default), short-monotonic (date microsecond), short-iso (ISO date), json, json-pretty, json-sse, export (binary format), verbose, cat
journalctl -o json | jq .MESSAGE
# Disable pager
journalctl --no-pager
# Disk usage
journalctl --disk-usage
# Shrink logs
journalctl --vacuum-size=1G
journalctl --vacuum-time=1days