adminJournalctl Service Log Investigation Checklist
journalctl is the main tool for reading systemd service logs. It helps system admins debug failed services, startup errors, crashes, permission problems, environment issues and reboot-related incidents.
Core principle
Services usually explain why they failed. journalctl lets you read that explanation by service name, time range, boot session and severity.
Checklist
- Identify the affected service name.
- Check systemctl status first.
- Read recent logs for that service.
- Filter logs by time range.
- Check logs from current boot.
- Look for permission, port, config or dependency errors.
- Compare logs before and after restart.
- Save important log excerpts.
- Fix only the confirmed cause.
- Verify service stays healthy after fix.
Reusable lesson
journalctl applies to Nginx, PHP-FPM, MySQL, Docker service, custom workers, AI agents, queue workers and monitoring agents.
When to Use This Checklist
Use this checklist when a Linux service fails, crashes, does not start after reboot or behaves differently after config changes.
Required Tools
SSH access, systemctl, journalctl, service name, incident time, config files
Before You Start
Do not restart a service repeatedly before reading its journal logs. The log usually tells you what failed.
Structured Checklist Steps
- Identify service name.
- Check service status.
- Read recent logs.
- Filter by time.
- Check current boot.
- Identify error type.
- Compare restart logs.
- Save evidence.
- Fix confirmed cause.
- Verify stability.
Verification Steps
- Relevant service logs are found.
- Error type is identified.
- Fix is based on evidence.
- Service restarts cleanly.
- No repeated failure appears after fix.
Rollback Plan
If a config change causes service failure, restore the previous config, run validation if available and restart only the affected service.
Common Mistakes
- Using only systemctl status summary.
- Not filtering by time.
- Ignoring current boot logs.
- Changing config before reading logs.
- Not saving important errors.
Related Commands
systemctl status nginx
journalctl -u nginx --since "30 minutes ago"
journalctl -u nginx -b
journalctl -xe
journalctl -p err --since today
sudo systemctl restart nginx