Windows eventvwr / Event Viewer equivalent in Linux
Reads logs from the systemd journal — the Linux equivalent of Windows Event Viewer.
eventvwr / Event Viewer
journalctl
journalctl
journalctl
Overview
What this command does
On Windows, "eventvwr / Event Viewer" is used to view system logs. On Linux, the closest practical mapping shown here is "journalctl". Reads logs from the systemd journal — the Linux equivalent of Windows Event Viewer. This reference is grouped under Services & Processes → Services.
Windows → Linux context
What changes when you use this on Linux?
Equivalent task, different tool
Windows eventvwr / Event Viewer maps to journalctl for this task. Treat this as a workflow mapping rather than a character-for-character syntax translation.
Portable across the compared distros
The Debian/Ubuntu, Fedora and Arch rows use the same command in this mapping. Package availability or defaults can still vary, so check the installed tool version when an option behaves differently.
For the broader concept behind this mapping, read Linux services and processes.
Practical tasks
Common use cases
View system logs
Reads logs from the systemd journal — the Linux equivalent of Windows Event Viewer.
journalctl -f
Follow live log output (like tail -f)
journalctl -u nginx
Logs for a specific service
journalctl -b
Logs since last boot
Ready to run
Copyable Linux commands
Review paths, device names, package names and permissions before running any command.
journalctl -f
journalctl -u ssh
journalctl -b -p err
journalctl --since "2024-01-15"
Walkthrough
Examples with explanations
# Windows: eventvwr (GUI only)
journalctl -f # follow live system log
journalctl -u ssh # SSH service logs only
journalctl -b -p err # errors since last boot
journalctl --since "2024-01-15" # logs from a specific dateReference
Common options and variations
| Command or option | Use |
|---|---|
journalctl -f | Follow live log output (like tail -f) |
journalctl -u nginx | Logs for a specific service |
journalctl -b | Logs since last boot |
journalctl --since '1 hour ago' | Logs from last hour |
journalctl -p err | Show only errors |
journalctl -n 50 | Show last 50 log entries |
Distro differences
Debian/Ubuntu vs Fedora vs Arch
The command "journalctl" is the same in all three rows, while package or base details differ: Debian/Ubuntu uses apt + systemd; Fedora uses dnf + systemd; Arch uses pacman + systemd.
| Distribution | Package manager / base | Equivalent command | Difference to notice |
|---|---|---|---|
| Debian/Ubuntu | apt + systemd | journalctl |
Same systemctl/journalctl syntax on systemd-based Debian and Ubuntu systems. |
| Fedora | dnf + systemd | journalctl |
Same command syntax; service names can differ by package. |
| Arch | pacman + systemd | journalctl |
Same command syntax; enable services explicitly after package installation. |
Keep learning