1<?xml version='1.0'?> <!--*-nxml-*--> 2<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" 3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> 4<!-- SPDX-License-Identifier: LGPL-2.1-or-later --> 5 6 <refentry id="journalctl" 7 xmlns:xi="http://www.w3.org/2001/XInclude"> 8 9 <refentryinfo> 10 <title>journalctl</title> 11 <productname>systemd</productname> 12 </refentryinfo> 13 14 <refmeta> 15 <refentrytitle>journalctl</refentrytitle> 16 <manvolnum>1</manvolnum> 17 </refmeta> 18 19 <refnamediv> 20 <refname>journalctl</refname> 21 <refpurpose>Query the systemd journal</refpurpose> 22 </refnamediv> 23 24 <refsynopsisdiv> 25 <cmdsynopsis> 26 <command>journalctl</command> 27 <arg choice="opt" rep="repeat">OPTIONS</arg> 28 <arg choice="opt" rep="repeat">MATCHES</arg> 29 </cmdsynopsis> 30 </refsynopsisdiv> 31 32 <refsect1> 33 <title>Description</title> 34 35 <para><command>journalctl</command> may be used to query the 36 contents of the 37 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> 38 journal as written by 39 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para> 40 41 <para>If called without parameters, it will show the full 42 contents of the journal, starting with the oldest entry 43 collected.</para> 44 45 <para>If one or more match arguments are passed, the output is 46 filtered accordingly. A match is in the format 47 <literal>FIELD=VALUE</literal>, 48 e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring 49 to the components of a structured journal entry. See 50 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry> 51 for a list of well-known fields. If multiple matches are 52 specified matching different fields, the log entries are 53 filtered by both, i.e. the resulting output will show only 54 entries matching all the specified matches of this kind. If two 55 matches apply to the same field, then they are automatically 56 matched as alternatives, i.e. the resulting output will show 57 entries matching any of the specified matches for the same 58 field. Finally, the character <literal>+</literal> may appear 59 as a separate word between other terms on the command line. This 60 causes all matches before and after to be combined in a 61 disjunction (i.e. logical OR).</para> 62 63 <para>It is also possible to filter the entries by specifying an 64 absolute file path as an argument. The file path may be a file or 65 a symbolic link and the file must exist at the time of the query. If a 66 file path refers to an executable binary, an <literal>_EXE=</literal> 67 match for the canonicalized binary path is added to the query. If a 68 file path refers to an executable script, a <literal>_COMM=</literal> 69 match for the script name is added to the query. If a file path 70 refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for 71 the kernel name of the device and for each of its ancestor devices is 72 added to the query. Symbolic links are dereferenced, kernel names are 73 synthesized, and parent devices are identified from the environment at 74 the time of the query. In general, a device node is the best proxy for 75 an actual device, as log entries do not usually contain fields that 76 identify an actual device. For the resulting log entries to be correct 77 for the actual device, the relevant parts of the environment at the time 78 the entry was logged, in particular the actual device corresponding to 79 the device node, must have been the same as those at the time of the 80 query. Because device nodes generally change their corresponding devices 81 across reboots, specifying a device node path causes the resulting 82 entries to be restricted to those from the current boot.</para> 83 84 <para>Additional constraints may be added using options 85 <option>--boot</option>, <option>--unit=</option>, etc., to 86 further limit what entries will be shown (logical AND).</para> 87 88 <para>Output is interleaved from all accessible journal files, whether they are rotated or currently 89 being written, and regardless of whether they belong to the system itself or are accessible user 90 journals. The <option>--header</option> option can be used to identify which files 91 <emphasis>are</emphasis> being shown.</para> 92 93 <para>The set of journal files which will be used can be 94 modified using the <option>--user</option>, 95 <option>--system</option>, <option>--directory</option>, and 96 <option>--file</option> options, see below.</para> 97 98 <para>All users are granted access to their private per-user 99 journals. However, by default, only root and users who are 100 members of a few special groups are granted access to the system 101 journal and the journals of other users. Members of the groups 102 <literal>systemd-journal</literal>, <literal>adm</literal>, and 103 <literal>wheel</literal> can read all journal files. Note 104 that the two latter groups traditionally have additional 105 privileges specified by the distribution. Members of the 106 <literal>wheel</literal> group can often perform administrative 107 tasks.</para> 108 109 <para>The output is paged through <command>less</command> by 110 default, and long lines are "truncated" to screen width. The 111 hidden part can be viewed by using the left-arrow and 112 right-arrow keys. Paging can be disabled; see the 113 <option>--no-pager</option> option and the "Environment" section 114 below.</para> 115 116 <para>When outputting to a tty, lines are colored according to 117 priority: lines of level ERROR and higher are colored red; lines 118 of level NOTICE and higher are highlighted; lines of level DEBUG 119 are colored lighter grey; other lines are displayed normally.</para> 120 </refsect1> 121 122 <refsect1> 123 <title>Options</title> 124 125 <para>The following options are understood:</para> 126 127 <variablelist> 128 <varlistentry> 129 <term><option>--no-full</option></term> 130 <term><option>--full</option></term> 131 <term><option>-l</option></term> 132 133 <listitem><para>Ellipsize fields when they do not fit in 134 available columns. The default is to show full fields, 135 allowing them to wrap or be truncated by the pager, if one 136 is used.</para> 137 138 <para>The old options 139 <option>-l</option>/<option>--full</option> are not useful 140 anymore, except to undo <option>--no-full</option>.</para> 141 </listitem> 142 </varlistentry> 143 144 <varlistentry> 145 <term><option>-a</option></term> 146 <term><option>--all</option></term> 147 148 <listitem><para>Show all fields in full, even if they include unprintable characters or are very long. By 149 default, fields with unprintable characters are abbreviated as "blob data". (Note that the pager may escape 150 unprintable characters again.)</para></listitem> 151 </varlistentry> 152 153 <varlistentry> 154 <term><option>-f</option></term> 155 <term><option>--follow</option></term> 156 157 <listitem><para>Show only the most recent journal entries, 158 and continuously print new entries as they are appended to 159 the journal.</para></listitem> 160 </varlistentry> 161 162 <varlistentry> 163 <term><option>-e</option></term> 164 <term><option>--pager-end</option></term> 165 166 <listitem><para>Immediately jump to the end of the journal 167 inside the implied pager tool. This implies 168 <option>-n1000</option> to guarantee that the pager will not 169 buffer logs of unbounded size. This may be overridden with 170 an explicit <option>-n</option> with some other numeric 171 value, while <option>-nall</option> will disable this cap. 172 Note that this option is only supported for the 173 <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry> 174 pager.</para></listitem> 175 </varlistentry> 176 177 <varlistentry> 178 <term><option>-n</option></term> 179 <term><option>--lines=</option></term> 180 181 <listitem><para>Show the most recent journal events and 182 limit the number of events shown. If 183 <option>--follow</option> is used, this option is 184 implied. The argument is a positive integer or 185 <literal>all</literal> to disable line limiting. The default 186 value is 10 if no argument is given.</para></listitem> 187 </varlistentry> 188 189 <varlistentry> 190 <term><option>--no-tail</option></term> 191 192 <listitem><para>Show all stored output lines, even in follow 193 mode. Undoes the effect of <option>--lines=</option>. 194 </para></listitem> 195 </varlistentry> 196 197 <varlistentry> 198 <term><option>-r</option></term> 199 <term><option>--reverse</option></term> 200 201 <listitem><para>Reverse output so that the newest entries 202 are displayed first.</para></listitem> 203 </varlistentry> 204 205 <varlistentry> 206 <term><option>-o</option></term> 207 <term><option>--output=</option></term> 208 209 <listitem><para>Controls the formatting of the journal 210 entries that are shown. Takes one of the following 211 options:</para> 212 <variablelist> 213 <varlistentry> 214 <term> 215 <option>short</option> 216 </term> 217 <listitem> 218 <para>is the default and generates an output that is 219 mostly identical to the formatting of classic syslog 220 files, showing one line per journal entry.</para> 221 </listitem> 222 </varlistentry> 223 224 <varlistentry> 225 <term> 226 <option>short-full</option> 227 </term> 228 <listitem> 229 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and 230 <option>--until=</option> options accept. Unlike the timestamp information shown in 231 <option>short</option> output mode this mode includes weekday, year and timezone information in the 232 output, and is locale-independent.</para> 233 </listitem> 234 </varlistentry> 235 236 <varlistentry> 237 <term> 238 <option>short-iso</option> 239 </term> 240 <listitem> 241 <para>is very similar, but shows ISO 8601 wallclock 242 timestamps.</para> 243 </listitem> 244 </varlistentry> 245 246 <varlistentry> 247 <term> 248 <option>short-iso-precise</option> 249 </term> 250 <listitem> 251 <para>as for <option>short-iso</option> but includes full 252 microsecond precision.</para> 253 </listitem> 254 </varlistentry> 255 256 <varlistentry> 257 <term> 258 <option>short-precise</option> 259 </term> 260 <listitem> 261 <para>is very similar, but shows classic syslog timestamps 262 with full microsecond precision.</para> 263 </listitem> 264 </varlistentry> 265 266 <varlistentry> 267 <term> 268 <option>short-monotonic</option> 269 </term> 270 <listitem> 271 <para>is very similar, but shows monotonic timestamps 272 instead of wallclock timestamps.</para> 273 </listitem> 274 </varlistentry> 275 276 <varlistentry> 277 <term> 278 <option>short-unix</option> 279 </term> 280 <listitem> 281 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock 282 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para> 283 </listitem> 284 </varlistentry> 285 286 <varlistentry> 287 <term> 288 <option>verbose</option> 289 </term> 290 <listitem> 291 <para>shows the full-structured entry items with all 292 fields.</para> 293 </listitem> 294 </varlistentry> 295 296 <varlistentry> 297 <term> 298 <option>export</option> 299 </term> 300 <listitem> 301 <para>serializes the journal into a binary (but mostly 302 text-based) stream suitable for backups and network 303 transfer (see 304 <ulink url="https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-export-format">Journal Export Format</ulink> 305 for more information). To import the binary stream back 306 into native journald format use 307 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para> 308 </listitem> 309 </varlistentry> 310 311 <varlistentry> 312 <term> 313 <option>json</option> 314 </term> 315 <listitem> 316 <para>formats entries as JSON objects, separated by newline characters (see <ulink 317 url="https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-json-format">Journal JSON Format</ulink> for more 318 information). Field values are generally encoded as JSON strings, with three exceptions: 319 <orderedlist> 320 <listitem><para>Fields larger than 4096 bytes are encoded as <constant>null</constant> values. (This 321 may be turned off by passing <option>--all</option>, but be aware that this may allocate overly long 322 JSON objects.) </para></listitem> 323 324 <listitem><para>Journal entries permit non-unique fields within the same log entry. JSON does not allow 325 non-unique fields within objects. Due to this, if a non-unique field is encountered a JSON array is 326 used as field value, listing all field values as elements.</para></listitem> 327 328 <listitem><para>Fields containing non-printable or non-UTF8 bytes are encoded as arrays containing 329 the raw bytes individually formatted as unsigned numbers.</para></listitem> 330 </orderedlist> 331 332 Note that this encoding is reversible (with the exception of the size limit).</para> 333 </listitem> 334 </varlistentry> 335 336 <varlistentry> 337 <term> 338 <option>json-pretty</option> 339 </term> 340 <listitem> 341 <para>formats entries as JSON data structures, but 342 formats them in multiple lines in order to make them 343 more readable by humans.</para> 344 </listitem> 345 </varlistentry> 346 347 <varlistentry> 348 <term> 349 <option>json-sse</option> 350 </term> 351 <listitem> 352 <para>formats entries as JSON data structures, but wraps 353 them in a format suitable for 354 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>. 355 </para> 356 </listitem> 357 </varlistentry> 358 359 <varlistentry> 360 <term> 361 <option>json-seq</option> 362 </term> 363 <listitem> 364 <para>formats entries as JSON data structures, but prefixes them with an ASCII Record Separator 365 character (0x1E) and suffixes them with an ASCII Line Feed character (0x0A), in accordance with <ulink 366 url="https://tools.ietf.org/html/rfc7464">JavaScript Object Notation (JSON) Text Sequences </ulink> 367 (<literal>application/json-seq</literal>). 368 </para> 369 </listitem> 370 </varlistentry> 371 372 <varlistentry> 373 <term> 374 <option>cat</option> 375 </term> 376 <listitem> 377 <para>generates a very terse output, only showing the actual message of each journal entry 378 with no metadata, not even a timestamp. If combined with the 379 <option>--output-fields=</option> option will output the listed fields for each log record, 380 instead of the message.</para> 381 </listitem> 382 </varlistentry> 383 384 <varlistentry> 385 <term> 386 <option>with-unit</option> 387 </term> 388 <listitem> 389 <para>similar to short-full, but prefixes the unit and 390 user unit names instead of the traditional syslog 391 identifier. Useful when using templated instances, as it 392 will include the arguments in the unit names.</para> 393 </listitem> 394 </varlistentry> 395 </variablelist> 396 </listitem> 397 </varlistentry> 398 399 <varlistentry> 400 <term><option>--output-fields=</option></term> 401 402 <listitem><para>A comma separated list of the fields which should be included in the output. This has 403 an effect only for the output modes which would normally show all fields (<option>verbose</option>, 404 <option>export</option>, <option>json</option>, <option>json-pretty</option>, 405 <option>json-sse</option> and <option>json-seq</option>), as well as on <option>cat</option>. For the 406 former, the <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>, 407 <literal>__MONOTONIC_TIMESTAMP</literal>, and <literal>_BOOT_ID</literal> fields are always 408 printed.</para></listitem> 409 </varlistentry> 410 411 <varlistentry> 412 <term><option>--utc</option></term> 413 414 <listitem><para>Express time in Coordinated Universal Time 415 (UTC).</para></listitem> 416 </varlistentry> 417 418 <varlistentry> 419 <term><option>--no-hostname</option></term> 420 421 <listitem><para>Don't show the hostname field of log messages originating from the local host. This 422 switch has an effect only on the <option>short</option> family of output modes (see above). 423 </para> 424 425 <para>Note: this option does not remove occurrences of the hostname from log entries themselves, so 426 it does not prevent the hostname from being visible in the logs.</para> 427 </listitem> 428 </varlistentry> 429 430 <varlistentry> 431 <term><option>-x</option></term> 432 <term><option>--catalog</option></term> 433 434 <listitem><para>Augment log lines with explanation texts from 435 the message catalog. This will add explanatory help texts to 436 log messages in the output where this is available. These 437 short help texts will explain the context of an error or log 438 event, possible solutions, as well as pointers to support 439 forums, developer documentation, and any other relevant 440 manuals. Note that help texts are not available for all 441 messages, but only for selected ones. For more information on 442 the message catalog, please refer to the 443 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para> 444 445 <para>Note: when attaching <command>journalctl</command> 446 output to bug reports, please do <emphasis>not</emphasis> use 447 <option>-x</option>.</para> 448 </listitem> 449 </varlistentry> 450 451 <varlistentry> 452 <term><option>-q</option></term> 453 <term><option>--quiet</option></term> 454 455 <listitem><para>Suppresses all informational messages 456 (i.e. "-- Journal begins at …", "-- Reboot --"), 457 any warning messages regarding 458 inaccessible system journals when run as a normal 459 user.</para></listitem> 460 </varlistentry> 461 462 <varlistentry> 463 <term><option>-m</option></term> 464 <term><option>--merge</option></term> 465 466 <listitem><para>Show entries interleaved from all available 467 journals, including remote ones.</para></listitem> 468 </varlistentry> 469 470 <varlistentry> 471 <term><option>-b <optional><optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional>|<constant>all</constant></optional></option></term> 472 <term><option>--boot<optional>=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional>|<constant>all</constant></optional></option></term> 473 474 <listitem><para>Show messages from a specific boot. This will 475 add a match for <literal>_BOOT_ID=</literal>.</para> 476 477 <para>The argument may be empty, in which case logs for the 478 current boot will be shown.</para> 479 480 <para>If the boot ID is omitted, a positive 481 <replaceable>offset</replaceable> will look up the boots 482 starting from the beginning of the journal, and an 483 equal-or-less-than zero <replaceable>offset</replaceable> will 484 look up boots starting from the end of the journal. Thus, 485 <constant>1</constant> means the first boot found in the 486 journal in chronological order, <constant>2</constant> the 487 second and so on; while <constant>-0</constant> is the last 488 boot, <constant>-1</constant> the boot before last, and so 489 on. An empty <replaceable>offset</replaceable> is equivalent 490 to specifying <constant>-0</constant>, except when the current 491 boot is not the last boot (e.g. because 492 <option>--directory</option> was specified to look at logs 493 from a different machine).</para> 494 495 <para>If the 32-character <replaceable>ID</replaceable> is 496 specified, it may optionally be followed by 497 <replaceable>offset</replaceable> which identifies the boot 498 relative to the one given by boot 499 <replaceable>ID</replaceable>. Negative values mean earlier 500 boots and positive values mean later boots. If 501 <replaceable>offset</replaceable> is not specified, a value of 502 zero is assumed, and the logs for the boot given by 503 <replaceable>ID</replaceable> are shown.</para> 504 505 <para>The special argument <constant>all</constant> can be 506 used to negate the effect of an earlier use of 507 <option>-b</option>.</para> 508 </listitem> 509 </varlistentry> 510 511 <varlistentry> 512 <term><option>--list-boots</option></term> 513 514 <listitem><para>Show a tabular list of boot numbers (relative to 515 the current boot), their IDs, and the timestamps of the first 516 and last message pertaining to the boot.</para></listitem> 517 </varlistentry> 518 519 <varlistentry> 520 <term><option>-k</option></term> 521 <term><option>--dmesg</option></term> 522 523 <listitem><para>Show only kernel messages. This implies 524 <option>-b</option> and adds the match 525 <literal>_TRANSPORT=kernel</literal>.</para></listitem> 526 </varlistentry> 527 528 <varlistentry> 529 <term><option>-t</option></term> 530 <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term> 531 532 <listitem><para>Show messages for the specified syslog 533 identifier 534 <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para> 535 536 <para>This parameter can be specified multiple 537 times.</para></listitem> 538 </varlistentry> 539 540 <varlistentry> 541 <term><option>-u</option></term> 542 <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term> 543 544 <listitem><para>Show messages for the specified systemd unit 545 <replaceable>UNIT</replaceable> (such as a service unit), or 546 for any of the units matched by 547 <replaceable>PATTERN</replaceable>. If a pattern is 548 specified, a list of unit names found in the journal is 549 compared with the specified pattern and all that match are 550 used. For each unit name, a match is added for messages from 551 the unit 552 (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>), 553 along with additional matches for messages from systemd and 554 messages about coredumps for the specified unit. A match 555 is also added for <literal>_SYSTEMD_SLICE=<replaceable>UNIT</replaceable></literal>, 556 such that if the provided <replaceable>UNIT</replaceable> is a 557 <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry> 558 unit, all logs of children of the slice will be shown. 559 </para> 560 561 <para>This parameter can be specified multiple times.</para> 562 </listitem> 563 </varlistentry> 564 565 <varlistentry> 566 <term><option>--user-unit=</option></term> 567 568 <listitem><para>Show messages for the specified user session 569 unit. This will add a match for messages from the unit 570 (<literal>_SYSTEMD_USER_UNIT=</literal> and 571 <literal>_UID=</literal>) and additional matches for messages 572 from session systemd and messages about coredumps for the 573 specified unit. A match 574 is also added for <literal>_SYSTEMD_USER_SLICE=<replaceable>UNIT</replaceable></literal>, 575 such that if the provided <replaceable>UNIT</replaceable> is a 576 <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry> 577 unit, all logs of children of the unit will be shown.</para> 578 579 <para>This parameter can be specified multiple times.</para> 580 </listitem> 581 </varlistentry> 582 583 <varlistentry> 584 <term><option>-p</option></term> 585 <term><option>--priority=</option></term> 586 587 <listitem><para>Filter output by message priorities or 588 priority ranges. Takes either a single numeric or textual log 589 level (i.e. between 0/<literal>emerg</literal> and 590 7/<literal>debug</literal>), or a range of numeric/text log 591 levels in the form FROM..TO. The log levels are the usual 592 syslog log levels as documented in 593 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>, 594 i.e. <literal>emerg</literal> (0), 595 <literal>alert</literal> (1), <literal>crit</literal> (2), 596 <literal>err</literal> (3), <literal>warning</literal> (4), 597 <literal>notice</literal> (5), <literal>info</literal> (6), 598 <literal>debug</literal> (7). If a single log level is 599 specified, all messages with this log level or a lower (hence 600 more important) log level are shown. If a range is specified, 601 all messages within the range are shown, including both the 602 start and the end value of the range. This will add 603 <literal>PRIORITY=</literal> matches for the specified 604 priorities.</para></listitem> 605 </varlistentry> 606 607 <varlistentry> 608 <term><option>--facility=</option></term> 609 610 <listitem><para>Filter output by syslog facility. Takes a comma-separated list of numbers or facility 611 names. The names are the usual syslog facilities as documented in 612 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>. 613 <option>--facility=help</option> may be used to display a list of known facility names and exit. 614 </para></listitem> 615 </varlistentry> 616 617 <varlistentry> 618 <term><option>-g</option></term> 619 <term><option>--grep=</option></term> 620 621 <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname> 622 field matches the specified regular expression. PERL-compatible regular expressions 623 are used, see 624 <citerefentry project='url'><refentrytitle url='http://pcre.org/current/doc/html/pcre2pattern.html'>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry> 625 for a detailed description of the syntax.</para> 626 627 <para>If the pattern is all lowercase, matching is case insensitive. 628 Otherwise, matching is case sensitive. This can be overridden with the 629 <option>--case-sensitive</option> option, see below.</para> 630 </listitem> 631 </varlistentry> 632 633 <varlistentry> 634 <term><option>--case-sensitive<optional>=BOOLEAN</optional></option></term> 635 636 <listitem><para>Make pattern matching case sensitive or case insensitive.</para> 637 </listitem> 638 </varlistentry> 639 640 <varlistentry> 641 <term><option>-c</option></term> 642 <term><option>--cursor=</option></term> 643 644 <listitem><para>Start showing entries from the location in the 645 journal specified by the passed cursor.</para></listitem> 646 </varlistentry> 647 648 <varlistentry> 649 <term><option>--cursor-file=<replaceable>FILE</replaceable></option></term> 650 651 <listitem><para>If <replaceable>FILE</replaceable> exists and contains a 652 cursor, start showing entries <emphasis>after</emphasis> this location. 653 Otherwise the show entries according the other given options. At the end, 654 write the cursor of the last entry to <replaceable>FILE</replaceable>. Use 655 this option to continually read the journal by sequentially calling 656 <command>journalctl</command>.</para></listitem> 657 </varlistentry> 658 659 <varlistentry> 660 <term><option>--after-cursor=</option></term> 661 662 <listitem><para>Start showing entries from the location in the 663 journal <emphasis>after</emphasis> the location specified by 664 the passed cursor. The cursor is shown when the 665 <option>--show-cursor</option> option is used.</para> 666 </listitem> 667 </varlistentry> 668 669 <varlistentry> 670 <term><option>--show-cursor</option></term> 671 672 <listitem><para>The cursor is shown after the last entry after 673 two dashes:</para> 674 <programlisting>-- cursor: s=0639…</programlisting> 675 <para>The format of the cursor is private 676 and subject to change.</para></listitem> 677 </varlistentry> 678 679 <varlistentry> 680 <term><option>-S</option></term> 681 <term><option>--since=</option></term> 682 <term><option>-U</option></term> 683 <term><option>--until=</option></term> 684 685 <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified 686 date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>. If the 687 time part is omitted, <literal>00:00:00</literal> is assumed. If only the seconds component is omitted, 688 <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively 689 the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood, 690 which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day, 691 respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified, 692 prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current 693 time, respectively. For complete time and date specification, see 694 <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that 695 <option>--output=short-full</option> prints timestamps that follow precisely this format. 696 </para> 697 </listitem> 698 </varlistentry> 699 700 <varlistentry> 701 <term><option>-F</option></term> 702 <term><option>--field=</option></term> 703 704 <listitem><para>Print all possible data values the specified 705 field can take in all entries of the journal.</para></listitem> 706 </varlistentry> 707 708 <varlistentry> 709 <term><option>-N</option></term> 710 <term><option>--fields</option></term> 711 712 <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem> 713 </varlistentry> 714 715 <varlistentry> 716 <term><option>--system</option></term> 717 <term><option>--user</option></term> 718 719 <listitem><para>Show messages from system services and the 720 kernel (with <option>--system</option>). Show messages from 721 service of current user (with <option>--user</option>). If 722 neither is specified, show all messages that the user can see. 723 </para></listitem> 724 </varlistentry> 725 726 <varlistentry> 727 <term><option>-M</option></term> 728 <term><option>--machine=</option></term> 729 730 <listitem><para>Show messages from a running, local 731 container. Specify a container name to connect to.</para> 732 </listitem> 733 </varlistentry> 734 735 <varlistentry> 736 <term><option>-D <replaceable>DIR</replaceable></option></term> 737 <term><option>--directory=<replaceable>DIR</replaceable></option></term> 738 739 <listitem><para>Takes a directory path as argument. If 740 specified, journalctl will operate on the specified journal 741 directory <replaceable>DIR</replaceable> instead of the 742 default runtime and system journal paths.</para></listitem> 743 </varlistentry> 744 745 <varlistentry> 746 <term><option>--file=<replaceable>GLOB</replaceable></option></term> 747 748 <listitem><para>Takes a file glob as an argument. If 749 specified, journalctl will operate on the specified journal 750 files matching <replaceable>GLOB</replaceable> instead of the 751 default runtime and system journal paths. May be specified 752 multiple times, in which case files will be suitably 753 interleaved.</para></listitem> 754 </varlistentry> 755 756 <varlistentry> 757 <term><option>--root=<replaceable>ROOT</replaceable></option></term> 758 759 <listitem><para>Takes a directory path as an argument. If specified, <command>journalctl</command> 760 will operate on journal directories and catalog file hierarchy underneath the specified directory 761 instead of the root directory (e.g. <option>--update-catalog</option> will create 762 <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>, and journal 763 files under <filename><replaceable>ROOT</replaceable>/run/journal/</filename> or 764 <filename><replaceable>ROOT</replaceable>/var/log/journal/</filename> will be displayed). 765 </para></listitem> 766 </varlistentry> 767 768 <varlistentry> 769 <term><option>--image=<replaceable>IMAGE</replaceable></option></term> 770 771 <listitem><para>Takes a path to a disk image file or block device node. If specified, 772 <command>journalctl</command> will operate on the file system in the indicated disk image. This is 773 similar to <option>--root=</option> but operates on file systems stored in disk images or block 774 devices, thus providing an easy way to extract log data from disk images. The disk image should 775 either contain just a file system or a set of file systems within a GPT partition table, following 776 the <ulink url="https://systemd.io/DISCOVERABLE_PARTITIONS">Discoverable Partitions 777 Specification</ulink>. For further information on supported disk images, see 778 <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s 779 switch of the same name.</para></listitem> 780 </varlistentry> 781 782 <varlistentry> 783 <term><option>--namespace=<replaceable>NAMESPACE</replaceable></option></term> 784 785 <listitem><para>Takes a journal namespace identifier string as argument. If not specified the data 786 collected by the default namespace is shown. If specified shows the log data of the specified 787 namespace instead. If the namespace is specified as <literal>*</literal> data from all namespaces is 788 shown, interleaved. If the namespace identifier is prefixed with <literal>+</literal> data from the 789 specified namespace and the default namespace is shown, interleaved, but no other. For details about 790 journal namespaces see 791 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para></listitem> 792 </varlistentry> 793 794 <varlistentry> 795 <term><option>--header</option></term> 796 797 <listitem><para>Instead of showing journal contents, show internal header information of the journal 798 fields accessed.</para> 799 800 <para>This option is particularly useful when trying to identify out-of-order journal entries, as 801 happens for example when the machine is booted with the wrong system time.</para></listitem> 802 </varlistentry> 803 804 <varlistentry> 805 <term><option>--disk-usage</option></term> 806 807 <listitem><para>Shows the current disk usage of all journal 808 files. This shows the sum of the disk usage of all archived 809 and active journal files.</para></listitem> 810 </varlistentry> 811 812 <varlistentry> 813 <term><option>--vacuum-size=</option></term> 814 <term><option>--vacuum-time=</option></term> 815 <term><option>--vacuum-files=</option></term> 816 817 <listitem><para>Removes the oldest archived journal files until the disk space they use falls below the 818 specified size (specified with the usual <literal>K</literal>, <literal>M</literal>, <literal>G</literal> and 819 <literal>T</literal> suffixes), or all archived journal files contain no data older than the specified timespan 820 (specified with the usual <literal>s</literal>, <literal>m</literal>, <literal>h</literal>, 821 <literal>days</literal>, <literal>months</literal>, <literal>weeks</literal> and <literal>years</literal> 822 suffixes), or no more than the specified number of separate journal files remain. Note that running 823 <option>--vacuum-size=</option> has only an indirect effect on the output shown by 824 <option>--disk-usage</option>, as the latter includes active journal files, while the vacuuming operation only 825 operates on archived journal files. Similarly, <option>--vacuum-files=</option> might not actually reduce the 826 number of journal files to below the specified number, as it will not remove active journal 827 files.</para> 828 829 <para><option>--vacuum-size=</option>, <option>--vacuum-time=</option> and <option>--vacuum-files=</option> 830 may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit 831 on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing 832 the specific limit, and is thus redundant.</para> 833 834 <para>These three switches may also be combined with <option>--rotate</option> into one command. If so, all 835 active files are rotated first, and the requested vacuuming operation is executed right after. The rotation has 836 the effect that all currently active files are archived (and potentially new, empty journal files opened as 837 replacement), and hence the vacuuming operation has the greatest effect as it can take all log data written so 838 far into account.</para></listitem> 839 </varlistentry> 840 841 <varlistentry> 842 <term><option>--list-catalog 843 <optional><replaceable>128-bit-ID…</replaceable></optional> 844 </option></term> 845 846 <listitem><para>List the contents of the message catalog as a 847 table of message IDs, plus their short description strings. 848 </para> 849 850 <para>If any <replaceable>128-bit-ID</replaceable>s are 851 specified, only those entries are shown.</para> 852 </listitem> 853 </varlistentry> 854 855 <varlistentry> 856 <term><option>--dump-catalog 857 <optional><replaceable>128-bit-ID…</replaceable></optional> 858 </option></term> 859 860 <listitem><para>Show the contents of the message catalog, with 861 entries separated by a line consisting of two dashes and the 862 ID (the format is the same as <filename>.catalog</filename> 863 files).</para> 864 865 <para>If any <replaceable>128-bit-ID</replaceable>s are 866 specified, only those entries are shown.</para> 867 </listitem> 868 </varlistentry> 869 870 <varlistentry> 871 <term><option>--update-catalog</option></term> 872 873 <listitem><para>Update the message catalog index. This command 874 needs to be executed each time new catalog files are 875 installed, removed, or updated to rebuild the binary catalog 876 index.</para></listitem> 877 </varlistentry> 878 879 <varlistentry> 880 <term><option>--setup-keys</option></term> 881 882 <listitem><para>Instead of showing journal contents, generate 883 a new key pair for Forward Secure Sealing (FSS). This will 884 generate a sealing key and a verification key. The sealing key 885 is stored in the journal data directory and shall remain on 886 the host. The verification key should be stored 887 externally. Refer to the <option>Seal=</option> option in 888 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> 889 for information on Forward Secure Sealing and for a link to a 890 refereed scholarly paper detailing the cryptographic theory it 891 is based on.</para></listitem> 892 </varlistentry> 893 894 <varlistentry> 895 <term><option>--force</option></term> 896 897 <listitem><para>When <option>--setup-keys</option> is passed 898 and Forward Secure Sealing (FSS) has already been configured, 899 recreate FSS keys.</para></listitem> 900 </varlistentry> 901 902 <varlistentry> 903 <term><option>--interval=</option></term> 904 905 <listitem><para>Specifies the change interval for the sealing 906 key when generating an FSS key pair with 907 <option>--setup-keys</option>. Shorter intervals increase CPU 908 consumption but shorten the time range of undetectable journal 909 alterations. Defaults to 15min.</para></listitem> 910 </varlistentry> 911 912 <varlistentry> 913 <term><option>--verify</option></term> 914 915 <listitem><para>Check the journal file for internal 916 consistency. If the file has been generated with FSS enabled and 917 the FSS verification key has been specified with 918 <option>--verify-key=</option>, authenticity of the journal file 919 is verified.</para></listitem> 920 </varlistentry> 921 922 <varlistentry> 923 <term><option>--verify-key=</option></term> 924 925 <listitem><para>Specifies the FSS verification key to use for 926 the <option>--verify</option> operation.</para></listitem> 927 </varlistentry> 928 929 <varlistentry> 930 <term><option>--sync</option></term> 931 932 <listitem><para>Asks the journal daemon to write all yet 933 unwritten journal data to the backing file system and 934 synchronize all journals. This call does not return until the 935 synchronization operation is complete. This command guarantees 936 that any log messages written before its invocation are safely 937 stored on disk at the time it returns.</para></listitem> 938 </varlistentry> 939 940 <varlistentry> 941 <term><option>--flush</option></term> 942 943 <listitem><para>Asks the journal daemon to flush any log data stored in 944 <filename>/run/log/journal/</filename> into <filename>/var/log/journal/</filename>, if persistent 945 storage is enabled. This call does not return until the operation is complete. Note that this call is 946 idempotent: the data is only flushed from <filename>/run/log/journal/</filename> into 947 <filename>/var/log/journal/</filename> once during system runtime (but see 948 <option>--relinquish-var</option> below), and this command exits cleanly without executing any 949 operation if this has already happened. This command effectively guarantees that all data is flushed 950 to <filename>/var/log/journal/</filename> at the time it returns.</para></listitem> 951 </varlistentry> 952 953 <varlistentry> 954 <term><option>--relinquish-var</option></term> 955 956 <listitem><para>Asks the journal daemon for the reverse operation to <option>--flush</option>: if 957 requested the daemon will write further log data to <filename>/run/log/journal/</filename> and stops 958 writing to <filename>/var/log/journal/</filename>. A subsequent call to <option>--flush</option> 959 causes the log output to switch back to <filename>/var/log/journal/</filename>, see 960 above.</para></listitem> 961 </varlistentry> 962 963 <varlistentry> 964 <term><option>--smart-relinquish-var</option></term> 965 966 <listitem><para>Similar to <option>--relinquish-var</option> but executes no operation if the root file 967 system and <filename>/var/lib/journal/</filename> reside on the same mount point. This operation is 968 used during system shutdown in order to make the journal daemon stop writing data to 969 <filename>/var/log/journal/</filename> in case that directory is located on a mount point that needs 970 to be unmounted.</para></listitem> 971 </varlistentry> 972 973 <varlistentry> 974 <term><option>--rotate</option></term> 975 976 <listitem><para>Asks the journal daemon to rotate journal files. This call does not return until the rotation 977 operation is complete. Journal file rotation has the effect that all currently active journal files are marked 978 as archived and renamed, so that they are never written to in future. New (empty) journal files are then 979 created in their place. This operation may be combined with <option>--vacuum-size=</option>, 980 <option>--vacuum-time=</option> and <option>--vacuum-file=</option> into a single command, see 981 above.</para></listitem> 982 </varlistentry> 983 984 <xi:include href="standard-options.xml" xpointer="help" /> 985 <xi:include href="standard-options.xml" xpointer="version" /> 986 <xi:include href="standard-options.xml" xpointer="no-pager" /> 987 </variablelist> 988 </refsect1> 989 990 <refsect1> 991 <title>Exit status</title> 992 993 <para>On success, 0 is returned; otherwise, a non-zero failure 994 code is returned.</para> 995 </refsect1> 996 997 <xi:include href="common-variables.xml" /> 998 999 <refsect1> 1000 <title>Examples</title> 1001 1002 <para>Without arguments, all collected logs are shown 1003 unfiltered:</para> 1004 1005 <programlisting>journalctl</programlisting> 1006 1007 <para>With one match specified, all entries with a field matching 1008 the expression are shown:</para> 1009 1010 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service 1011journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting> 1012 1013 <para>If two different fields are matched, only entries matching 1014 both expressions at the same time are shown:</para> 1015 1016 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting> 1017 1018 <para>If two matches refer to the same field, all entries matching 1019 either expression are shown:</para> 1020 1021 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting> 1022 1023 <para>If the separator <literal>+</literal> is used, two 1024 expressions may be combined in a logical OR. The following will 1025 show all messages from the Avahi service process with the PID 1026 28097 plus all messages from the D-Bus service (from any of its 1027 processes):</para> 1028 1029 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting> 1030 1031 <para>To show all fields emitted <emphasis>by</emphasis> a unit and <emphasis>about</emphasis> 1032 the unit, option <option>-u</option>/<option>--unit=</option> should be used. 1033 <command>journalctl -u <replaceable>name</replaceable></command> 1034 expands to a complex filter similar to 1035 <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service 1036 + UNIT=<replaceable>name</replaceable>.service _PID=1 1037 + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0 1038 + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1 1039 </programlisting> 1040 (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry> 1041 for an explanation of those patterns). 1042 </para> 1043 1044 <para>Show all logs generated by the D-Bus executable:</para> 1045 1046 <programlisting>journalctl /usr/bin/dbus-daemon</programlisting> 1047 1048 <para>Show all kernel logs from previous boot:</para> 1049 1050 <programlisting>journalctl -k -b -1</programlisting> 1051 1052 <para>Show a live log display from a system service 1053 <filename>apache.service</filename>:</para> 1054 1055 <programlisting>journalctl -f -u apache</programlisting> 1056 1057 </refsect1> 1058 1059 <refsect1> 1060 <title>See Also</title> 1061 <para> 1062 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 1063 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 1064 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 1065 <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 1066 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>, 1067 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, 1068 <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>, 1069 <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 1070 <citerefentry><refentrytitle>systemd-journal-upload.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> 1071 </para> 1072 </refsect1> 1073</refentry> 1074