Nodar Chernishev/Getty Images

Something rarely goes wrong with Linux, but that doesn't mean the operating system is immune to problems. Every once in a while, I'll install a new service or app and then go to start it with the command:

sudo systemctl start NAME

Where NAME is the name of the app or service.

Also: Thefirst 5 Linux commands every new user should learn

There have been instances where the service refuses to start or run properly. When that happens, where do you turn? You could always check log files (usually the best place to start) or turn to another command that is a companion tosystemctl. That command isjournalctl. 

The journalctlcommand queries the systemd journal and lists the contents of a journal that could include insights into why a particular app or service isn't running properly. Often, when you attempt to start a service withsystemctl, if the service doesn't start properly (or at all), you'll see a suggestion in the output to use thejournalctlcommand to find out what has happened.

Let me show you how to use this command, so you don't have to be in the dark as to why things aren't going as planned.

How to use journalctl

What you'll need: The only thing you'll need for this task is a Linux distribution that uses systemd, which is most of the major distributions.

1. Basic usage

The first thing you should try is runningjournalctlwithout any options, which is simple:

Show more

journalctl

What you will see is the entire output of the systemd journal. From that output, you might find information to help you troubleshoot your problem. 

When I ran the command, there were only 41 lines of output. I've seen instances where there were hundreds of lines in the output, which made using the command without arguments or options a bit unhelpful.

Also: 10 Linux apps I install on every new machine (and why you should, too)

Fortunately, you can filter out a lot of that noise.

2. Checking a specific service

For instance, SSH is having problems starting. To troubleshoot this issue, you could run the command:

Show more

systemctl -ussh

In this case,-u stands forunit, or a specific systemd unit (think "service").

Also: How to create system restore points on Linux with Timeshift - and why you should

The output of the above command might look something like this:

Jan 12 09:55:42 pop-os systemd[1]: Starting OpenBSD Secure Shell server...
Jan 12 09:55:42 pop-os sshd[3424]: Server listening on 0.0.0.0 port 22.
Jan 12 09:55:42 pop-os sshd[3424]: Server listening on :: port 22.
Jan 12 09:55:42 pop-os systemd[1]: Started OpenBSD Secure Shell server.
Jan 15 09:39:26 pop-os sshd[659190]: Invalid user jackwallen from 192.168.1.77 port 55040
Jan 15 09:39:29 pop-os sshd[659190]: pam_unix(sshd:auth): check pass; user unknown
Jan 15 09:39:29 pop-os sshd[659190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.77
Jan 15 09:39:31 pop-os sshd[659190]: Failed password for invalid user jackwallen from 192.168.1.77 port 55040 ssh2
Jan 15 09:39:33 pop-os sshd[659190]: Connection closed by invalid user jackwallen 192.168.1.77 port 55040 [preauth]
Jan 15 09:39:39 pop-os sshd[659232]: Accepted password for jack from 192.168.1.77 port 55049 ssh2
Jan 15 09:39:39 pop-os sshd[659232]: pam_unix(sshd:session): session opened for user jack(uid=1000) by (uid=0)

As you can see, in my case, SSH is running as expected, but there was a failed attempt at logging in (which was because I forgot to add a valid username when logging in from my iMac).

3. Tailing the output

There's an even better way to troubleshoot a service withjournalctl. Let's say SSH is running but having trouble accepting connections (or just about any other issue that could happen). You can "tail" the output (which prints out real-time information as it happens), like so:

Show more

journaltcl -xefu ssh

This command will not only tell you the startup and running status of the service but will list the most recent entries logged to the journal for that service. To close, use the Ctrl+c keyboard shortcut. For those who want to know, here's an explanation of the options:

• x - add an explanation to the log lines from the message catalog
• e - immediately jump to the end of the journal inside the implied pager tool
• f - follow (continuously print new entries as they are logged)
• u - unit (as explained above)

4. Viewing a time range

It's also possible to view a specific time range withjournalctl. Say you want to view only entries logged starting Jan. 20 at 10:00 AM. The command would be:

Show more

journalctl --since "2025-01-20 10:00:00"

You would see every entry logged from 10:00 AM to the current time.

Also: How to keep Linux optimized (and save time) with Stacer

You could make that range even more specific. Say you want to view entries logged from 10:00 AM to 10:10 AM. The command would be:

journalctl --since "2025-01-20 10:00:00" --until "2025-01-20 10:05:00"

And that, my friends, is how you can usejournalctlto troubleshoot app startup issues on Linux.

Open Source

The open-source tools that could disrupt the entire IT incident management marketThis Linux distro could let your old laptop 'shine on' after Windows 10's sunset6 Linux myths, busted5 lightweight Linux distributions with very low system requirements

• The open-source tools that could disrupt the entire IT incident management market
• This Linux distro could let your old laptop 'shine on' after Windows 10's sunset
• 6 Linux myths, busted
• 5 lightweight Linux distributions with very low system requirements