journalctl is the primary tool for querying the systemd journal. It collects logs from the kernel, initrd, services, and applications.

Basic usage:

# View all logs
journalctl

# Follow new logs
journalctl -f

# Logs since last boot
journalctl -b

# Logs for a specific service
journalctl -u sshd.service

# Logs since a specific time
journalctl --since "1 hour ago"

Combine with grep to filter specific messages across your entire system log history.