Journalctl

journalctl
    -f, --follow        # continuously print, (tail -f)
    -n, --lines=        # show and limit recent events, default 10, implied on -f
    -x, --catalog       # helpful hints to context of errors or log event.
    -m, --merge         # merge all entries from all journals, including remote ones
    -k, --dmesg         # show only kernel messages
    -u, --unit=         # show logs for a specific service
    --user              # show logs for a specific user

journalctl -u ssh               # see logs for ssh service
journalctl -f --user megacron   # follow user megacron persistently
journalctl --disk-usage         # size of journal on disk
journalctl --list-boots         # list of system boots, most recent boot is always 0
journalctl -b 0 -u ssh          # see ssh logs for a certain boot session
journalctl --since=yesterday --until= now   # all messages for a range of time
journalctl -n 100 /usr/sbin/sshd    # see most 100 recent entries for ssh