journalctl: Show Logs From the Last 5, 10 or 30 Minutes

Updated: 2026-09-24

To see what happened on a Linux server in the last few minutes, use journalctl --since with a relative time:

journalctl --since "5 minutes ago"
journalctl --since "10 minutes ago"
journalctl --since "30 minutes ago"

--since accepts natural expressions ("5 min ago", "1 hour ago", today, yesterday) as well as absolute timestamps ("2026-09-24 14:00"). Add --no-pager when you pipe the output or run it from a script.

For continuous, alert-driven log checks, see Continuous Log Monitoring.

Quick Reference

What you want	Command
Last 5 minutes	`journalctl --since "5 minutes ago"`
Last 10 minutes	`journalctl --since "10 minutes ago"`
Last hour	`journalctl --since "1 hour ago"`
A fixed window	`journalctl --since "14:00" --until "14:15"`
Since the last boot	`journalctl -b`
Follow live (like `tail -f`)	`journalctl -f`
Last 100 lines, newest last	`journalctl -n 100`
Newest first	`journalctl -r --since "10 min ago"`

Ready-made task for Zuzia

Get an alert on new kernel errors from disks, memory or filesystems

Create a free account and connect your server. The Free plan includes 1 monitored task.
In Tasks, create a task, paste the command below, pick the server and run it every 10 minutes.
Turn on “Monitor the result”. Then add a rule: Performance value, label kernel_errors, operator "delta >", value 0, WARNING. You get OK, warning or critical, and an alert when it changes.

z(){ printf '%s - %s' "$1" "$2"; [ -n "$3" ] && printf ' | %s' "$3"; printf '\n'; case $1 in OK|SKIP) exit 0;; WARNING) exit 1;; CRITICAL) exit 2;; *) exit 3;; esac; }; lv(){ if [ "$1" -ge "$3" ]; then echo CRITICAL; elif [ "$1" -ge "$2" ]; then echo WARNING; else echo OK; fi; }; num(){ case $1 in ''|*[!0-9]*) return 1;; esac; }; wr(){ case $1 in CRITICAL) s=CRITICAL;; WARNING) [ "$s" = OK ] && s=WARNING;; esac; }; if command -v journalctl >/dev/null 2>&1; then n=$(journalctl -k -p err -b --no-pager -q 2>/dev/null | grep -c .); elif command -v dmesg >/dev/null 2>&1; then n=$(dmesg -l err,crit,alert,emerg 2>/dev/null | grep -c .); else z SKIP "no journalctl or dmesg"; fi; z OK "kernel errors since boot: $n" "kernel_errors=$n"

The same command is in the panel's public commands as “Check: Kernel error messages”, so you can also add it from there.

Set up this check free Free plan · no credit card

Only Errors: `journalctl -p err..alert`

-p (or --priority) filters by syslog severity. A single value means "this level and everything more severe"; a range FROM..TO limits the output to exactly those levels.

# Errors and worse (err, crit, alert, emerg) from the last 10 minutes
journalctl -p err --since "10 minutes ago"

# Only err, crit and alert - skip emerg
journalctl -p err..alert --since "10 minutes ago"

# Warnings and errors from the last hour, one service
journalctl -u nginx -p warning --since "1 hour ago"

Priority names and numbers are interchangeable:

Number	Name	Typical meaning
0	emerg	System is unusable
1	alert	Act immediately
2	crit	Critical condition
3	err	Error
4	warning	Warning
5	notice	Normal but significant
6	info	Informational
7	debug	Debug output

So journalctl -p 3 equals journalctl -p err, and -p 3..1 equals -p err..alert.

Filter by Service, Process or Kernel

# One systemd unit, last 15 minutes
journalctl -u nginx --since "15 minutes ago"

# Several units at once
journalctl -u nginx -u php8.3-fpm --since "15 minutes ago"

# Kernel messages only (OOM kills, disk and NIC errors)
journalctl -k --since "30 minutes ago"

# Everything logged by one PID
journalctl _PID=1234 --since "10 minutes ago"

# Text search inside the window (journalctl 237+)
journalctl --since "10 minutes ago" -g "timeout|refused"

Output Formats for Scripts

# Short ISO timestamps, easy to grep
journalctl --since "10 min ago" -o short-iso --no-pager

# Only the message text
journalctl --since "10 min ago" -o cat --no-pager

# JSON, one entry per line (for jq or a log shipper)
journalctl --since "10 min ago" -o json --no-pager | jq -r '.MESSAGE'

# Count error lines in the last 5 minutes
journalctl -p err --since "5 min ago" --no-pager -q | wc -l

-q suppresses the "-- No entries --" and boot separator lines, so the count stays accurate.

No systemd Journal? Use syslog

On hosts that log to plain files (older distributions, minimal containers), read the tail of the file instead:

# Debian / Ubuntu
tail -n 200 /var/log/syslog
# RHEL / Rocky / Alma
tail -n 200 /var/log/messages

# Recent errors only
grep -iE "error|fail|crit" /var/log/syslog | tail -n 50

# Follow live
tail -f /var/log/syslog

Plain files have no reliable "last N minutes" filter, because the timestamp format differs between distributions and does not include the year. If you need time windows, journalctl is the right tool; if the journal is not persistent, enable it by creating /var/log/journal and restarting systemd-journald.

Why "No Entries" When You Expect Logs

You are not root or in the systemd-journal group. Unprivileged users only see their own user journal. Use sudo or add the user to systemd-journal (or adm on Debian/Ubuntu).
The journal is volatile. Without /var/log/journal, logs live in /run/log/journal and disappear at reboot - journalctl -b -1 will then be empty.
Clock or time zone mismatch. --since uses the server's local time. Check with timedatectl; add --utc to display UTC.
The service logs to its own file. Nginx, Apache and many databases write to /var/log/<service>/; the journal only sees stdout/stderr of the unit.

Turn It Into an Alert With Zuzia

Checking logs by hand only helps once you already know something is wrong. With the Zuzia agent installed you can run the same command as a scheduled task instead of SSH-ing in:

Add a scheduled task on the server with a command such as:
```
journalctl -p err --since "5 min ago" --no-pager -q
```
Run it every 5 minutes, so the time window matches the schedule and nothing is counted twice.
Review the execution log in the panel - every run's output is kept, with an AI summary that explains what the errors mean.

Because every run is stored, you can see whether error volume is creeping up across days, not just in the last five minutes.

FAQ

How do I show journalctl logs from the last 5 minutes?

Run journalctl --since "5 minutes ago". Add -u <service> to limit it to one unit and -p err to see only errors.

What does `journalctl -p err..alert` do?

It shows entries whose priority is between err (3) and alert (1) inclusive: errors, critical messages and alerts. emerg (0) and everything less severe than err are excluded.

How do I see logs between two times?

Combine --since and --until: journalctl --since "2026-09-24 14:00" --until "2026-09-24 14:15". Both accept the same formats.

How do I see logs from the previous boot?

journalctl -b -1 shows the previous boot, -b -2 the one before. This only works when the journal is persistent (/var/log/journal exists).

journalctl vs tail - which should I use?

Use journalctl for anything managed by systemd: it filters by time, unit and priority without regex tricks. Use tail for applications that write their own log files, such as Nginx access and error logs.