The systemd journal

When a system uses systemd, journald takes over the logging side. When you’re troubleshooting a Linux machine running systemd, this is the first place you should be looking for logs. By default, journald captures all output from supervised processes. Anything emitted on stderr is treated as an error. So, unless the software is configured or hardcoded to log to a location that’s not stderr/stdout, you will find the logs in the systemd journal.

Logs logged to journald can be queried via the journalctl command. It provides a means to query based on individual services, time, and system restarts and allows one to use options similar to the tail command. Let’s jump in and get some practice using journalctl.