journalctl service

journalctl -u <service> --since '1 hour ago'

Shows the logs of a specific systemd service within a time window to detect anomalous activity or boot failures.

Run it when a service behaves weirdly — constant restarts, unexpected command execution, usage spikes — and you need its recent activity without digging through the full system log. journalctl -u filters by the unit and --since narrows the window: in seconds you have the service's recent life. In an IR, it's the first query when 'service X did something it shouldn't': you see startups, failures, and the process's own messages. It's also how to detect services that loop-restart after a config change or a broken persistence attempt.

Don't use it if the service doesn't use journald (apps that log to their own file): the unit will come up empty and the info is elsewhere. Journal persistence depends on config (/var/log/journal): on systems with Storage=volatile, logs are lost on every reboot — an attacker who reboots the host erases the trail. And beware: the service log shows what the process writes, not what it does outside its output; a compromised service that silently executes commands won't be seen here without process telemetry (auditd, Falco).