Linux · Systems fluency
How do you read system logs and use journalctl?
Short answer
journalctl queries the systemd journal by unit, priority, boot, or time range. Traditional text logs may still exist under /var/log, especially when rsyslog or an application writes its own files.
The journal stores structured records with metadata such as unit, PID, priority, and boot ID. By default it may be volatile and kept only in memory, so enable persistent storage if logs must survive a reboot.
journalctl -u nginx --since "1 hour ago"
journalctl -p err -b
journalctl -f -u sshUseful filters
- -u selects a unit, and multiple -u flags combine units
- -b limits to the current or a previous boot
- -p filters by priority such as err or warning
- --since and --until bound a time window
- -f follows new entries like tail -f
Correlate timestamps across the journal, application logs, and monitoring. A service may log a clean error while the kernel logs an OOM kill or filesystem error at the same moment. Check dmesg for kernel messages.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1How do you make the journal persistent across reboots?
- 2How would you find logs from the previous boot?
- 3When would you look at dmesg instead of journalctl?
- 4How do you keep journal disk usage under control?
Say it in the interview
journalctl queries structured journal records. I filter by unit, boot, priority, and time range, and follow with -f during an incident. I also check dmesg for kernel-level errors such as OOM kills. On busy hosts I bound journal disk usage and enable persistent storage only when the retention requirement justifies it.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Linux mock interview and get scored feedback on depth, clarity and confidence.