Query and manage systemd journal logs with journalctl (filters, JSON output, disk cleanup)

Documented steps

1. Unit logs: `journalctl -u myapp.service` (add `-f` to follow, `-e` jump to end, `-r` reverse). Multiple `-u` flags AND together as a union of units.
2. Time windows: `journalctl -u myapp --since "2026-09-08 10:00" --until "1 hour ago"`; also accepts `today`, `yesterday`, `-2d`, `@epoch`.
3. Boots: `journalctl -b` current boot, `-b -1` previous boot, `journalctl --list-boots` to enumerate. Priorities: `-p err` shows err and worse (`-p warning..err` for a range).
4. Text search: `journalctl -u myapp --grep 'timeout|refused'` (PCRE, case-insensitive when the pattern is all-lowercase; requires systemd built with pcre2).
5. Machine-readable: `-o json` (one object per line) or `-o json-pretty`; `-o cat` strips metadata. Structured field filters stack: `journalctl _SYSTEMD_UNIT=myapp.service _PID=1234`; discover field values with `journalctl -F _SYSTEMD_UNIT`.
6. Kernel messages only: `journalctl -k` (OOM kills, segfaults, netfilter drops).
7. Disk usage and cleanup: `journalctl --disk-usage`; `sudo journalctl --vacuum-size=500M` or `--vacuum-time=30d`. Persist across reboots by ensuring /var/log/journal exists (`mkdir -p /var/log/journal && systemd-tmpfiles --create --prefix /var/log/journal`) or Storage=persistent in /etc/systemd/journald.conf.
8. Verbose record inspection: `journalctl -u myapp -o verbose -n 5` shows every field (useful to find _EXE, _CMDLINE, MESSAGE_ID for precise filtering).