Cheatsheet Pages / systemd Cheatsheet
How to cut a time window out of the journal — journalctl --since / --until
The incident happened between 14:00 and 15:00 — you want exactly that slice of log, nothing else.
Most management commands need sudo, and systemctl only works on a system actually booted with systemd — inside containers it fails with “System has not been booted with systemd as init system”. Every command was checked against systemd 255, and the example units pass systemd-analyze verify.
journalctl --since "1 hour ago" # relative times just work
journalctl --since "2026-10-20 09:00" --until "2026-10-20 10:00" # absolute window
journalctl -u nginx --since today # today / yesterday are valid too