Querying the systemd journal with journalctl: unit, boot, priority, time range and JSON output

Goal

Pull exactly the log lines needed from the systemd journal — by unit, boot, priority and time — in a format a script can parse, and confirm the journal is stored persistently with bounded size.

Prerequisites

A systemd-based distribution with systemd-journald running (systemctl status systemd-journald). Reading most logs needs root or membership of the systemd-journal group; some distributions restrict further.

Steps

1. Filter by unit across all boots: journalctl -u nginx.service --no-pager. --no-pager prevents journalctl from invoking less and blocking a non-interactive session.
2. Restrict to the current boot, or an earlier one: journalctl -u nginx.service -b (current boot) or -b -1 (previous boot).
3. Filter by priority: journalctl -p err shows priority err and higher (more urgent); journalctl -p warning..err selects a range.
4. Filter by absolute or relative time: journalctl --since "2026-09-20 00:00:00" --until "2026-09-21 00:00:00" or journalctl --since -2h for the last two hours.
5. Combine filters freely: journalctl -u nginx.service -b -p err --since -1d --no-pager.
6. Emit machine-readable output for a script: journalctl -u nginx.service -o json --no-pager (one JSON object per line) or -o json-pretty for human review; -o cat prints only the message text.
7. Check whether the journal persists across reboots: read Storage= in /etc/systemd/journald.conf (and /etc/systemd/journald.conf.d/*.conf). persistent writes to /var/log/journal/ (creating it if needed); auto writes there only if the directory /var/log/journal/ already exists, otherwise it behaves like volatile, which keeps the journal in /run/log/journal/ and loses it at reboot. journalctl --list-boots showing only one boot is the quick symptom of a non-persistent journal.
8. Bound the on-disk size: set SystemMaxUse=, RuntimeMaxUse= and SystemKeepFree= in a drop-in under /etc/systemd/journald.conf.d/, then systemctl restart systemd-journald.

Expected result

Filtered output limited to the requested unit, boot, priority and time window; journalctl --disk-usage reports the current journal size, which should stay under the configured SystemMaxUse=.

Limits and test basis

Based on journalctl(1) and journald.conf(5). Restarting systemd-journald briefly interrupts logging but does not discard the on-disk journal; to undo a journald.conf.d change, delete the drop-in file and restart the service again. If a distribution also runs rsyslog in parallel, journalctl only reflects what journald captured.