journalctl on mobile: -u, -f, -b and -p commands with examples

journalctl reads the logs that systemd stores. From a phone you only need an SSH connection and a handful of options: -u nginx filters by service, -f follows live output, -b limits to the current boot, --since narrows by time, -p err shows only errors and -n sets how many lines to print.

Essential journalctl commands for checking a server from your phone

journalctl -u nginx -f prints the latest nginx entries and then waits for new ones, just like tail -f on a log file. These commands cover most quick checks:

# Follow nginx live (Ctrl+C to quit)
journalctl -u nginx -f

# Last 50 nginx entries, no pager
journalctl -u nginx -n 50 --no-pager

# Everything since the current boot
journalctl -b

# Previous boot (needs a persistent journal)
journalctl --list-boots
journalctl -b -1

# Narrow by date or time
journalctl --since "2026-10-26 08:00" --until "2026-10-26 09:30"
journalctl -u nginx --since "1 hour ago"
journalctl --since today

# Errors or worse in this boot
journalctl -p err -b

# Combined: nginx errors in the last 10 minutes
journalctl -u nginx -p err --since "10 min ago"

If your user is not in the systemd-journal or adm group, journalctl only shows your own entries; prefix sudo to read system logs. Every option is documented in the journalctl manual page.

What each journalctl option filters: -u, -f, -b, --since, -p and -n

journalctl options combine with AND logic: journalctl -u nginx -b -p err returns only nginx errors since the last boot.

• -u: filters by systemd unit. It takes nginx or nginx.service and can be repeated to interleave several units.
• -f: follows the journal live, printing the last 10 entries first.
• -b: limits output to the current boot; -b -1 is the previous one. Handy after an unexpected reboot.
• --since and --until: accept "YYYY-MM-DD HH:MM:SS" timestamps and expressions such as yesterday, today or "2 hours ago".
• -p: syslog priority from 0 (emerg) to 7 (debug). -p err includes err, crit, alert and emerg.
• -n: number of trailing entries. -n 100 stops thousands of lines from flooding a small screen.

Two more options help on a narrow screen: -r reverses the order so the newest entries come first, and -o cat prints only the message, without timestamp, host or process, which cuts down on line wrapping.

journalctl on iOS and Android versus desktop: comparison table

journalctl pipes its output into the less pager, driven by PgUp, PgDn, End and q; the phone's system keyboard has none of those keys.

With any client, adding --no-pager or -n removes the need for paging keys altogether.

journalctl -f without drops: Mosh and tmux across network changes

Mosh uses UDP, on ports 60000-61000 by default, and starts mosh-server over an initial SSH connection; that is why a running journalctl -u nginx -f survives the switch from Wi-Fi to cellular.

The server firewall must allow that UDP range as well as OpenSSH's TCP port 22. Mosh does no port forwarding and no X11 forwarding. If the server has no public IP or open ports, a Prialo private mesh network or Tailscale makes it reachable without exposing it.

To keep the follow running even after you close the app, start it inside tmux:

tmux new -s logs
journalctl -u nginx -f
# Ctrl+B then d to detach; when you come back:
tmux attach -t logs

termi1 combines both: it keeps the session alive with Mosh and uses tmux so whatever you left running is still there when you return.

Exporting journalctl logs to a file and downloading them over SFTP

journalctl -u nginx --since today --no-pager > /tmp/nginx-today.log saves today's nginx entries as plain text, ready to attach to a ticket or read later.

On desktop you can fetch it with scp, which has used the SFTP protocol by default since OpenSSH 9.0. In termi1, SFTP is built in, so you can view and download the file without leaving the session. Delete the file from /tmp afterwards if it holds sensitive data.

termi1's AI types the journalctl command without pressing Enter

termi1's AI turns a typed or dictated phrase, such as "nginx errors from the last hour", into a command that is typed at the prompt without pressing Enter, so you can check the flags before running it.

It has two modes: "Review", which never presses Enter, and "Safe auto", the default, where only a limited set of commands recognised as safe receive Enter. On connections tagged as production, Production Guard ensures nothing gets Enter automatically and holds back anything that deletes, stops or changes something, such as a systemctl restart nginx after reading the logs. The AI never opens the session or receives keys or passwords, and SSH keys generated on the phone stay in the system's secure storage. Learn more about the SSH, Mosh and SFTP terminal, which you can download from the App Store or Google Play.

Frequently asked questions

How do I watch nginx logs in real time with journalctl?

You watch nginx logs in real time with journalctl -u nginx -f, which prints the last ten entries and appends new ones as they arrive. Press Ctrl+C to quit. If nginx also writes to /var/log/nginx, those files exist separately from the journal.

What is the difference between journalctl -b and journalctl -b -1?

journalctl -b shows entries from the current boot, while journalctl -b -1 shows the previous boot. The second only works if the journal is persistent, meaning it is stored in /var/log/journal rather than only in memory. journalctl --list-boots lists the boots available.

Which priorities does journalctl -p err include?

journalctl -p err includes messages at priority err (3) and every more severe level: crit, alert and emerg. It leaves out warning, notice, info and debug. Combined with -b or --since, it is the fastest way to see what failed without reading every informational line.

Why does journalctl not show system logs without sudo?

journalctl without sudo only shows the user's own entries when that user is not in the systemd-journal or adm group. Adding the user to one of those groups allows reading the system journal without escalating privileges for every query. The change applies after starting a new login session.