journalctl

journalctl is a command for viewing logs collected by systemd. The systemd-journald service is responsible for systemd’s log collection, and it retrieves messages from the kernel, systemd services, and other sources.

Chapter 23. Viewing and Managing Log Files Red Hat Enterprise Linux 7 | Red Hat Customer Portal

Document

journalctl linux command man page

Example

sudo journalctl --since YYYY-MM-DD | grep orphaned

sudo journalctl -fu sshd

sudo journalctl -p warning -u sshd

Cheat Sheet

Journalctl Cheat Sheet