journalctl --since and --until: show logs from a time range

journalctl --since=TIME shows journal entries on or newer than a time, and --until=TIME entries on or older than a time. Short forms are -S and -U. They take absolute dates like "2026-10-24 09:00", the words yesterday, today, tomorrow and now, or relative times like -1h and "30 min ago". Combine them with -u to read what one service logged during an incident.

Syntax

journalctl --since "2026-10-24 09:00" --until "2026-10-24 10:30"
journalctl -S today
journalctl -S yesterday -U today            # all of yesterday
journalctl -u nginx --since "30 min ago"
journalctl -u nginx -S -2h -p warning       # last two hours, warning and worse
journalctl --since "2026-10-24 08:00 UTC" --no-pager > incident.log

The manual documents both options since systemd 195. The time syntax is defined in systemd.time(7).

Accepted values

Time span units include s, min (or m), h, d, w, M (months of 30.44 days) and y; spaces between number and unit may be omitted.

Interactions

• With -b. -b restricts to one boot and --since further narrows the window; when they do not overlap you get no entries (see journalctl -b).
• With -f. --since decides where the output starts; -f then keeps following new entries.
• With -r. --reverse shows the newest first inside the range.
• Output timestamps. --output=short-full prints timestamps in exactly the format --since accepts, so you can copy a line's time into the next query.

Pitfalls

• Quote values with spaces. journalctl --since 1 hour ago passes only 1 as the value and hour and ago as separate arguments, which journalctl does not treat as part of the time; write --since "1 hour ago" or -S -1h.
• Old entries may be gone. The range cannot reach before the oldest entry still stored; journald rotates and vacuums files, and with volatile storage everything before the last boot is lost.
• Permissions. Users who are not in the systemd-journal, adm or wheel group see only their own entries, so a range can look empty without sudo.

FAQ