You can use journalctl to analyse logs from systemd services by using a wide variety of filters. In order to access all logs, you need to be a root user or have superuser privileges.

These are some of the most useful parameters you can use with journalctl:

  • -n: shows the ten most recent logs. You can add a number after the parameter to specify a different amount.
  • -u <unit>: filter by a systemd unit. 
    journalctl -u cronie
  • -p <priority>: filters by priority. Shows logs with that priority or higher (which corresponds to a lower number): “emerg” (0), “alert” (1), “crit” (2), “err” (3), “warning” (4), “notice” (5), “info” (6), “debug” (7). 
    journalctl -p err
  • -S <date>: shows logs since <date>. Date format: 2021-01-01 12:00:00 (use double quotes, time part can be ommitted). 
    journalctl -S "2021-10-01 12:00:00"
  • -U <date>: shows logs until <date>.
  • -f: shows most recent logs and updates the list in real time.

More parameters on the man page (man journalctl).

If you have any suggestion, feel free to contact me via social media or email.