journalctl
options
    --list-boots
        https://askubuntu.com/questions/1002524/why-does-journalctl-list-boots-only-show-the-current-boot
        https://unix.stackexchange.com/questions/408936/why-journalctl-list-boots-doesnt-match-what-uptime-and-who-b-report
        https://unix.stackexchange.com/questions/383551/journalctl-shows-very-old-boots-which-are-not-recycled/383575#383575
        last reboot
        https://itsfoss.com/wrong-time-dual-boot/
        https://bbs.archlinux.org/viewtopic.php?id=284692
            SystemMaxFiles=
            RuntimeMaxFiles=
            Storage=persistent
    --verify
        verify journal consistency
        /run/log/journal/<only-one-hash>/system.journal
        ??? /var/log/journal
        sudo mkdir /var/log/journal/

    -b, --boot=[1...n]
        current session, -1 - previous, -2 - ...
    --since
        today|09:30
    --until
        11:00
    _COMM=<process-name>
    _PID=<PID>
        </usr/bin/Xorg>
    _UID=<UID>
    -o verbose
        shoe extra message metadata
        could later be using for filtering like _SYTEMD_UNIT=collectd.service
    -n 10
        only the last 10 lines
    -e
        starting from tail
    -u  <unit>
        for unit (like nginx.service)
    -eu sshd
        starting from tail, logs of sshd only
    -fan500
        monitor last 500 lines
    -p, --priority=err
        The log levels are documented in syslog(3), i.e.
        "emerg" (0), "alert" (1), "crit" (2), "err" (3),
        "warning" (4), "notice" (5), "info" (6), "debug" (7)
    -k
        kernel messages
    -f
        like tail -f
    -o [json|json-pretty]
    -x --catalog
        Add message explanations where available
commands
    --disk-usage
        show occupied space
    --vacuum-size=1G
    --vacuum-time=1years

samples
    journalctl -xeu <unit>.service