journalctl –since, and the log you did not have to find

Time filtering with natural-language arguments removes the step where you work out which rotated file the incident is in.

$ journalctl -u nginx --since '2021-09-30 08:00' --until '09:30'
$ journalctl -u php-fpm --since '2 hours ago' -p err
$ journalctl -u app-worker -f -n 50
$ journalctl --since yesterday --grep 'certificate'

# and the one that answers 'what happened to this box'
$ journalctl --since '30 min ago' -p warning

The priority filter is the underused one — -p err across all units for a time window is the fastest way to find what else was unhappy at the same moment, which is exactly the question during an incident. --grep arrived recently enough that plenty of documentation still pipes to grep, which works and loses the structured fields. The journal is capped by SystemMaxUse and silently discards the oldest entries, so a quiet incident from last month may simply not be there.