How to Check Logs or Journal of a Specific Service on Linux

Monitoring logs is an essential part of system administration. On Linux, logs help diagnose issues and track service behavior. This guide covers various ways to check logs for a specific service.

Using journalctl for Systemd Services

Most modern Linux distributions use systemd, and logs are stored in the journal. To view logs for a specific service, use:

journalctl -u service-name.service

Example for Nginx:

journalctl -u nginx.service

Viewing Real-Time Logs

To follow logs in real time, use:

journalctl -u service-name.service -f

This is similar to tail -f for traditional log files.

Checking Logs with a Time Filter

To see logs from the last 1 hour:

journalctl -u service-name.service --since "1 hour ago"

For logs between two timestamps:

journalctl -u service-name.service --since "2024-02-01 10:00" --until "2024-02-01 12:00"

Using Traditional Log Files

Some services log to files in /var/log/. Check:

ls /var/log/

For example, Nginx logs are usually found at:

/var/log/nginx/access.log
/var/log/nginx/error.log

To view logs with tail:

tail -f /var/log/nginx/error.log

Conclusion

Using journalctl is the preferred way to check logs for systemd-managed services, while traditional logs can be found in /var/log/. Mastering these commands will help you efficiently troubleshoot and monitor Linux services.