journalctl -u nginx -f: follow the logs of one systemd service

journalctl -u nginx -f prints the most recent log lines of the nginx.service unit and keeps following new ones, like tail -f; stop with Ctrl+C. -u selects a unit (the .service suffix is optional) and can be repeated, -f follows, and -n 100 sets how many past lines to show first. Reading the system journal of other users' services needs root or membership in the systemd-journal or adm group.

Common forms

journalctl -u nginx -f                       # follow, starting with the last 10 lines
journalctl -u nginx -n 100 --no-pager        # last 100 lines, print and exit
journalctl -u nginx -b                       # since the current boot
journalctl -u nginx --since "1 hour ago"
journalctl -u nginx --since "2026-10-21 09:00" --until "2026-10-21 10:00"
journalctl -u nginx -u php-fpm -f            # two units interleaved
journalctl -u nginx -p err -b                # priority err and worse
journalctl --user -u myapp -f                # a user service (systemctl --user)

Options

When the unit shows no logs

• The program logs to its own files (nginx writes /var/log/nginx/error.log by default); the journal then only has systemd's start and stop messages.
• You are not root and not in the systemd-journal group: journalctl shows only your own user's entries and says so in a hint.
• The journal is volatile (/run/log/journal) and was lost at reboot; create /var/log/journal or set Storage=persistent in journald.conf to keep logs across boots.

journalctl --disk-usage
sudo journalctl --vacuum-time=2weeks          # delete archived entries older than 2 weeks