A Service Failed: Reading Logs with journalctl

A service won't start, and systemctl only tells you that it failed:

● myapp.service - My App
     Active: failed (Result: exit-code)

The why isn't there — it's in the journal, systemd's central log. On a modern Linux box almost every service logs there, and journalctl is how you read it. Learn a handful of its flags and most "it just won't start" mysteries solve themselves.

Step 1: The quick summary from systemctl

systemctl status already shows the last few log lines — often enough on its own:

systemctl status myapp        # last ~10 journal lines are at the bottom

Read those first; the failure reason is frequently right there.

Step 2: The full logs for one service

Need more than the tail? Pull the whole journal for that unit:

journalctl -u myapp           # all logs for myapp.service
journalctl -u myapp -e        # jump to the end (most recent)
journalctl -u myapp -n 50     # last 50 lines

-u filters to one unit — the difference between a wall of system-wide noise and just your service.

Step 3: Watch it live while it fails

Follow the log and restart the service in another pane to see exactly what it prints as it dies:

journalctl -u myapp -f        # -f follows, like tail -f

journalctl -u <service> -e is the single command that answers "why did it fail?" nine times out of ten. Jump to the end and read upward from the last error.

Handy extra filters

journalctl -u myapp --since "10 min ago"    # recent window only
journalctl -u myapp -p err                  # errors and worse
journalctl -b                               # only this boot

The checklist

1. systemctl status <service> — read the tail it already shows.
2. journalctl -u <service> -e — full log, jump to the newest.
3. journalctl -u <service> -f — follow live while you restart it.
4. Narrow with --since, -p err, or -b when the log is noisy.