Reading VPS Service Logs with journalctl

Use journalctl to inspect systemd-managed service logs by unit and time window. Start with the application's first relevant error and correlate it with the failure time instead of collecting an unbounded log dump.

Useful read-only commands

sudo journalctl -u example -n 100 --no-pager
sudo journalctl -u example --since "30 minutes ago" --no-pager
sudo journalctl -u example -f
sudo journalctl --disk-usage

Replace example with the actual unit name. The follow command continues until interrupted. Check the server timezone when matching logs with a customer's report. Permissions may limit what a nonprivileged user can read.

Interpret context

An application exit can be caused by missing files, permission errors, unavailable dependencies or memory pressure. A systemd message saying the unit failed is often the result, not the root cause. Read the lines immediately before it.

Logs inside Docker containers may use a different logging path. docker logs --tail 100 CONTAINER is useful when the configured log driver supports it. Not all applications write to standard output or the system journal.

Keep logs useful and safe

Do not place passwords, authorization headers, tokens or private keys in log messages. Redact sensitive fields before sharing a snippet. Include the timestamp, unit and error text needed to diagnose the issue.

Set retention appropriate to the available disk and your operational requirements. Avoid deleting all logs to hide a disk-space problem before identifying the source of growth.

See disk usage, out-of-memory diagnosis and support reports.

Reference: journalctl manual.