Definition
journalctl reads entries collected by systemd-journald, including service and kernel messages when journald receives them.
How it works
Use journalctl -u ssh for a unit, -b for the current boot, -p err for priority filtering and -f to follow live entries. Access permissions affect visible logs; persistence depends on journald configuration.
Real-world example
To investigate unexpected restarts, journalctl -b -1 can show a previous boot if persistent logs are available. Correlating timestamps with maintenance and monitoring alerts gives a more reliable incident timeline.
Limits and best practices
Preserve logs before cleanup or rotation. Set disk usage and retention limits, maintain accurate time synchronization and forward important events to secured centralized logging for post-incident analysis.