Read the systemd Journal Without Guessing

journalctl is most useful when every command answers one narrow question. Start with the boot, then add a unit, time range, or priority filter. Avoid dumping the entire journal and searching by eye: the journal already has structured fields.

Start with the boot

List boots before choosing one:

journalctl --list-boots
journalctl -b 0

The current boot is 0; older boots have negative offsets. Pinning a boot keeps an investigation from mixing a current failure with a previous recovery.

Narrow to a unit and a window

Combine the unit name with an explicit time range:

journalctl -u ssh.service --since "30 minutes ago"
journalctl -u systemd-logind.service -b -1 -p warning..alert

Use --output=short-precise when event order matters and --output=json when a script needs stable fields rather than presentation text.

Check persistence before you rely on history

If /var/log/journal is absent, logs may only live in volatile memory. Confirm the storage mode and retention policy before treating an older boot as evidence.