X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fjournalctl.xml;h=0703bf9fb613f45c58370174b1beab5f4c104aca;hb=769d324c99aab129148bd25f5f663ef441287d86;hp=f6e46cfbc737dbcd44c9be5f224666e6f638f645;hpb=19c5f19d69bb5f520fa7213239490c55de06d99d;p=elogind.git
diff --git a/man/journalctl.xml b/man/journalctl.xml
index f6e46cfbc..0703bf9fb 100644
--- a/man/journalctl.xml
+++ b/man/journalctl.xml
@@ -8,20 +8,21 @@
Copyright 2012 Lennart Poettering
systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
(at your option) any later version.
systemd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
+ Lesser General Public License for more details.
- You should have received a copy of the GNU General Public License
+ You should have received a copy of the GNU Lesser General Public License
along with systemd; If not, see .
-->
-
+journalctl
@@ -49,37 +50,89 @@
- journalctl OPTIONSMATCH
+ journalctl
+ OPTIONS
+ MATCHESDescription
- journalctl may be
- used to query the contents of the
+ journalctl may be used to
+ query the contents of the
systemd1
- journal.
+ journal as written by
+ systemd-journald.service8.
- If called without parameter will show the full
+ If called without parameters, it will show the full
contents of the journal, starting with the oldest
entry collected.
- If a match argument is passed the output is
- filtered accordingly. A match is in the format
- FIELD=VALUE,
- e.g. _SYSTEMD_UNIT=httpd.service.
+ If one or more match arguments are passed, the
+ output is filtered accordingly. A match is in the
+ format FIELD=VALUE,
+ e.g. _SYSTEMD_UNIT=httpd.service,
+ referring to the components of a structured journal
+ entry. See
+ systemd.journal-fields7
+ for a list of well-known fields. If multiple matches
+ are specified matching different fields, the log
+ entries are filtered by both, i.e. the resulting output
+ will show only entries matching all the specified
+ matches of this kind. If two matches apply to the same
+ field, then they are automatically matched as
+ alternatives, i.e. the resulting output will show
+ entries matching any of the specified matches for the
+ same field. Finally, the character
+ + may appears as a separate word
+ between other terms on the command line. This causes
+ all matches before and after to be combined in a
+ disjunction (i.e. logical OR).
+
+ As shortcuts for a few types of field/value
+ matches, file paths may be specified. If a file path
+ refers to an executable file, this is equivalent to an
+ _EXE= match for the canonicalized
+ binary path. Similarly, if a path refers to a device
+ node, this is equivalent to a
+ _KERNEL_DEVICE= match for the
+ device.
+
+ Additional constraints may be added using options
+ , ,
+ etc, to further limit what entries will be shown
+ (logical AND).Output is interleaved from all accessible
journal files, whether they are rotated or currently
- being written, and regardless whether they belong to the
+ being written, and regardless of whether they belong to the
system itself or are accessible user journals.
+ The set of journal files which will be used
+ can be modified using the ,
+ , ,
+ and options, see below.
+
All users are granted access to their private
- per-user journals. However, by default only root and
- users who are members of the adm
+ per-user journals. However, by default, only root and
+ users who are members of the systemd-journal
group get access to the system journal and the
journals of other users.
+
+ The output is paged through
+ less by default, and long lines are
+ "truncated" to screen width. The hidden part can be
+ viewed by using the left-arrow and right-arrow
+ keys. Paging can be disabled; see the
+ option and the "Environment"
+ section below.
+
+ When outputting to a tty, lines are colored
+ according to priority: lines of level ERROR and higher
+ are colored red; lines of level NOTICE and higher are
+ highlighted; other lines are displayed normally.
+
@@ -89,30 +142,25 @@
-
-
-
- Prints a short help
- text and exits.
-
+
+
+
-
-
+ Ellipsize fields when
+ they do not fit in available columns.
+ The default is to show full fields,
+ allowing them to wrap or be truncated
+ by the pager, if one is used.
- Prints a short version
- string and exits.
+ The old options
+ /
+ are not useful anymore, except to undo
+ .
-
-
- Do not pipe output into a
- pager.
-
-
-
-
+ Show all fields in
full, even if they include unprintable
@@ -121,26 +169,45 @@
-
+
- Show only most recent
- journal entries, and continously print
+ Show only the most recent
+ journal entries, and continuously print
new entries as they are appended to
the journal.
-
+
+
+
+ Immediately jump to
+ the end of the journal inside the
+ implied pager tool. This implies
+ to guarantee
+ that the pager will not buffer logs of
+ unbounded size. This may be overridden
+ with an explicit
+ with some other numeric value while
+ will disable this cap.
+ Note that this option is only supported for the
+ less1
+ pager.
+
+
+
+
- Controls the number of
- journal lines to show, counting from
- the most recent ones. Takes a positive
- integer argument. In follow mode
- defaults to 10, otherwise is unset
- thus not limiting how many lines are
- shown.
+ Show the most recent
+ journal events and limit the number of
+ events shown. If
+ is used,
+ this option is implied. The argument is
+ a positive integer or all
+ to disable line limiting. The default value is
+ 10 if no argument is given.
@@ -153,106 +220,777 @@
-
+
+
+
+ Reverse output so that the newest
+ entries are displayed first.
+
+
+
+ Controls the
- formatting of the journal entries that are
- shown. Takes one of
- short,
- short-monotonic,
- verbose,
- export,
- json,
- cat. short
- is the default and generates an output
- that is mostly identical to the
- formatting of classic syslog log
- files, showing one line per journal
- entry. short-monotonic
- is very similar but shows monotonic
- timestamps instead of wallclock
- timestamps. verbose
- shows the full structered entry items
- with all
- fiels. export
- serializes the journal into a binary
- (but mostly text-based) stream
- suitable for backups and network
- transfer. json
- formats entries as JSON data
- structures. cat
- generates a very terse output only
- showing the actual message of each
- journal entry with no meta data, not
- even a timestamp.
+ formatting of the journal entries that
+ are shown. Takes one of the following options:
+
+
+
+
+
+
+
+ is the default
+ and generates an output
+ that is mostly identical
+ to the formatting of
+ classic syslog files,
+ showing one line per
+ journal entry.
+
+
+
+
+
+
+
+
+ is very similar,
+ but shows ISO 8601
+ wallclock timestamps.
+
+
+
+
+
+
+
+
+
+ is very similar,
+ but shows timestamps
+ with full microsecond
+ precision.
+
+
+
+
+
+
+
+
+
+ is very similar,
+ but shows monotonic
+ timestamps instead of
+ wallclock timestamps.
+
+
+
+
+
+
+
+
+
+ shows the
+ full-structured entry
+ items with all fields.
+
+
+
+
+
+
+
+
+
+ serializes the
+ journal into a binary
+ (but mostly text-based)
+ stream suitable for
+ backups and network
+ transfer (see Journal
+ Export Format
+ for more
+ information).
+
+
+
+
+
+
+
+
+ formats entries
+ as JSON data structures,
+ one per line (see Journal
+ JSON Format for
+ more information).
+
+
+
+
+
+
+
+
+ formats entries as
+ JSON data structures,
+ but formats them in
+ multiple lines in order
+ to make them more
+ readable by humans.
+
+
+
+
+
+
+
+
+ formats entries as
+ JSON data structures,
+ but wraps them in a
+ format suitable for Server-Sent
+ Events.
+
+
+
+
+
+
+
+
+ generates a very
+ terse output, only
+ showing the actual
+ message of each journal
+ entry with no metadata,
+ not even a timestamp.
+
+
+
+
+
+
+
+
+
+
+ Express time in Coordinated Universal
+ Time (UTC).
+
+
+
+
+
+
+ Augment log lines with
+ explanation texts from the message
+ catalog. This will add explanatory
+ help texts to log messages in the
+ output where this is available. These
+ short help texts will explain the
+ context of an error or log event,
+ possible solutions, as well as
+ pointers to support forums, developer
+ documentation, and any other relevant
+ manuals. Note that help texts are not
+ available for all messages, but only
+ for selected ones. For more
+ information on the message catalog,
+ please refer to the Message
+ Catalog Developer
+ Documentation.
+
+ Note: when attaching
+ journalctl output
+ to bug reports, please do
+ not use
+ .
+
-
+ Suppresses any warning
- message regarding inaccessable system
- journals when run as normal
+ messages regarding inaccessible system
+ journals when run as a normal
user.
-
-
+
+
+
+ Show entries
+ interleaved from all available
+ journals, including remote
+ ones.
+
+
+
+
+
+
+ Show messages from a specific
+ boot. This will add a match for
+ _BOOT_ID=.
+
+ The argument may be empty, in which case
+ logs for the current boot will be shown.
+
+ If the boot ID is omitted, a positive
+ offset will look up
+ the boots starting from the beginning of the
+ journal, and a equal-or-less-than zero
+ offset will look up
+ boots starting from the end of the
+ journal. Thus, 1 means the
+ first boot found in the journal in
+ chronological order, 2 the
+ second and so on; while -0
+ is the last boot, -1 the
+ boot before last, and so on. An empty
+ offset is equivalent
+ to specifying -0, except
+ when the current boot is not the last boot
+ (e.g. because was
+ specified to look at logs from a different
+ machine).
+
+ If the 32-character
+ ID is specified, it
+ may optionally be followed by
+ offset which
+ identifies the boot relative to the one given by
+ boot ID. Negative
+ values mean earlier boots and a positive values
+ mean later boots. If
+ offset is not
+ specified, a value of zero is assumed, and the
+ logs for the boot given by
+ ID are shown.
+
+
+
+
- Show only locally
- generated messages.
+
+
+
+ Show a tabular list of
+ boot numbers (relative to the current
+ boot), their IDs, and the timestamps
+ of the first and last message
+ pertaining to the boot.
+
+
+
+
+
+
+
+ Show only kernel messages. This
+ implies and adds the match
+ _TRANSPORT=kernel.
+
+
+
+
+
+
+
+ Show messages for the
+ specified syslog identifier
+ SYSLOG_IDENTIFIER, or
+ for any of the messages with a SYSLOG_IDENTIFIER
+ matched by PATTERN.
+
+ This parameter can be specified
+ multiple times.
+
+
+
+
+
+
+ Show messages for the
+ specified systemd unit
+ UNIT (such
+ as a service unit), or for any of the
+ units matched by
+ PATTERN.
+ If a pattern is specified, a list of
+ unit names found in the journal is
+ compared with the specified pattern
+ and all that match are used. For each
+ unit name, a match is added for
+ messages from the unit
+ (_SYSTEMD_UNIT=UNIT),
+ along with additional matches for
+ messages from systemd and messages
+ about coredumps for the specified
+ unit.
+
+ This parameter can be specified
+ multiple times.
+
+
+
+
+
+ Show messages for the
+ specified user session unit. This will
+ add a match for messages from the unit
+ (_SYSTEMD_USER_UNIT=
+ and _UID=) and
+ additional matches for messages from
+ session systemd and messages about
+ coredumps for the specified unit.
+ This parameter can be specified multiple times.
+
+
+
+
+
+
+
+ Filter output by
+ message priorities or priority
+ ranges. Takes either a single numeric
+ or textual log level (i.e. between
+ 0/emerg and
+ 7/debug), or a
+ range of numeric/text log levels in
+ the form FROM..TO. The log levels are
+ the usual syslog log levels as
+ documented in
+ syslog3,
+ i.e. emerg (0),
+ alert (1),
+ crit (2),
+ err (3),
+ warning (4),
+ notice (5),
+ info (6),
+ debug (7). If a
+ single log level is specified, all
+ messages with this log level or a
+ lower (hence more important) log level
+ are shown. If a range is specified, all
+ messages within the range are shown,
+ including both the start and the end
+ value of the range. This will add
+ PRIORITY= matches
+ for the specified
+ priorities.
+
+
+
+
+
+
+ Start showing entries
+ from the location in the journal
+ specified by the passed
+ cursor.
+
+
+
+
+
+ Start showing entries
+ from the location in the journal
+ after the
+ location specified by the this cursor.
+ The cursor is shown when the
+ option
+ is used.
+
+
+
+
+
+ The cursor is shown after the last
+ entry after two dashes:
+ -- cursor: s=0639...
+ The format of the cursor is private
+ and subject to change.
+
+
+
+
+
+
+ Start showing entries
+ on or newer than the specified date,
+ or on or older than the specified
+ date, respectively. Date specifications
+ should be of the format
+ 2012-10-30 18:17:16.
+ If the time part is omitted,
+ 00:00:00 is assumed.
+ If only the seconds component is omitted,
+ :00 is assumed. If the
+ date component is omitted, the current
+ day is assumed. Alternatively the strings
+ yesterday,
+ today,
+ tomorrow are
+ understood, which refer to 00:00:00 of
+ the day before the current day, the
+ current day, or the day after the
+ current day, respectively. now
+ refers to the current time. Finally,
+ relative times may be specified,
+ prefixed with - or
+ +, referring to
+ times before or after the current
+ time, respectively.
+
+
+
+
+
+
+ Print all possible
+ data values the specified field can
+ take in all entries of the
+ journal.
+
+
+
+
+
+
+ Show messages from
+ system services and the kernel (with
+ ). Show
+ messages from service of current user
+ (with ).
+ If neither is specified, show all
+ messages that the user can see.
+
+
+
+
+
+
+
+ Show messages from a
+ running, local container. Specify a
+ container name to connect
+ to.
+
+
+
+
+
+
+ Takes a directory path
+ as argument. If specified, journalctl
+ will operate on the specified journal
+ directory
+ DIR instead
+ of the default runtime and system
+ journal paths.
+
+
+
+
+
+ Takes a file glob as an
+ argument. If specified, journalctl will
+ operate on the specified journal files
+ matching GLOB
+ instead of the default runtime and
+ system journal paths. May be specified
+ multiple times, in which case files will
+ be suitably interleaved.
+
+
+
+
+
+ Takes a directory path
+ as an argument. If specified, journalctl
+ will operate on catalog file hierarchy
+ underneath the specified directory
+ instead of the root directory
+ (e.g.
+ will create
+ ROOT/var/lib/systemd/catalog/database).
+ Instead of showing
- journal contents generate a new 128
- bit ID suitable for identifying
+ journal contents, generate a new 128-bit
+ ID suitable for identifying
messages. This is intended for usage
by developers who need a new
identifier for a new message they
introduce and want to make
- recognizable. Will print the new ID in
+ recognizable. This will print the new ID in
three different formats which can be
copied into source code or
similar.
+
+
+
+ Instead of showing
+ journal contents, show internal header
+ information of the journal fields
+ accessed.
+
+
+
+
+
+ Shows the current disk
+ usage of all journal files. This shows
+ the sum of the disk usage of all
+ archived and active journal
+ files.
+
+
+
+
+
+
+ Removes archived
+ journal files until the disk space
+ they use falls below the specified
+ size (specified with the usual K, M,
+ G, T suffixes), or all journal files
+ contain no data older than the
+ specified timespan (specified with the
+ usual s, min, h, days, months, weeks,
+ years suffixes). Note that running
+ has
+ only indirect effect on the output
+ shown by
+ as the latter includes active journal
+ files, while the former only operates
+ on archived journal
+ files.
+ and
+ may be combined in a single invocation
+ to enforce both a size and time limit
+ on the archived journal
+ files.
+
+
+
+
+
+ List the contents of
+ the message catalog as a table of
+ message IDs, plus their short
+ description strings.
+
+ If any
+ 128-bit-IDs are
+ specified, only those entries are shown.
+
+
+
+
+
+
+
+ Show the contents of
+ the message catalog, with entries
+ separated by a line consisting of two
+ dashes and the ID (the format is the
+ same as .catalog
+ files).
+
+ If any
+ 128-bit-IDs are
+ specified, only those entries are shown.
+
+
+
+
+
+
+
+ Update the message
+ catalog index. This command needs to
+ be executed each time new catalog
+ files are installed, removed, or
+ updated to rebuild the binary catalog
+ index.
+
+
+
+
+
+ Instead of showing
+ journal contents, generate a new key
+ pair for Forward Secure Sealing
+ (FSS). This will generate a sealing
+ key and a verification key. The
+ sealing key is stored in the journal
+ data directory and shall remain on the
+ host. The verification key should be
+ stored externally. Refer to the
+ option in
+ journald.conf5
+ for information on Forward Secure
+ Sealing and for a link to a refereed
+ scholarly paper detailing the
+ cryptographic theory it is based on.
+
+
+
+
+
+
+ When
+ is passed and
+ Forward Secure Sealing (FSS) has already been
+ configured, recreate FSS keys.
+
+
+
+
+
+ Specifies the change
+ interval for the sealing key when
+ generating an FSS key pair with
+ . Shorter
+ intervals increase CPU consumption but
+ shorten the time range of
+ undetectable journal
+ alterations. Defaults to
+ 15min.
+
+
+
+
+
+ Check the journal file
+ for internal consistency. If the
+ file has been generated with FSS
+ enabled and the FSS verification key
+ has been specified with
+ ,
+ authenticity of the journal file is
+ verified.
+
+
+
+
+
+ Specifies the FSS
+ verification key to use for the
+
+ operation.
+
+
+
+
+
+ Asks the Journal
+ daemon to flush any log data stored in
+ /run/log/journal
+ into
+ /var/log/journal,
+ if persistent storage is enabled. This
+ call does not return until the
+ operation is
+ complete.
+
+
+
+
+ Exit status
- On success 0 is returned, a non-zero failure
- code otherwise.
+ On success, 0 is returned; otherwise, a non-zero
+ failure code is returned.
+
+
- Environment
+ Examples
+
+ Without arguments, all collected logs are shown
+ unfiltered:
+
+ journalctl
+
+ With one match specified, all entries with a field matching the expression are shown:
+
+ journalctl _SYSTEMD_UNIT=avahi-daemon.service
+
+ If two different fields are matched, only entries matching both expressions at the same time are shown:
+
+ journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
+
+ If two matches refer to the same field, all entries matching either expression are shown:
+
+ journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
+
+ If the separator + is used,
+ two expressions may be combined in a logical OR. The
+ following will show all messages from the Avahi
+ service process with the PID 28097 plus all messages
+ from the D-Bus service (from any of its
+ processes):
+
+ journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
+
+ Show all logs generated by the D-Bus executable:
+
+ journalctl /usr/bin/dbus-daemon
+
+ Show all logs of the kernel device node /dev/sda:
+
+ journalctl /dev/sda
+
+ Show all kernel logs from previous boot:
+
+ journalctl -k -b -1
+
+ Show a live log display from a system service apache.service:
+
+ journalctl -f -u apache
-
-
- $SYSTEMD_PAGER
- Pager to use when
- is not given;
- overrides $PAGER. Setting
- this to an empty string or the value
- cat is equivalent to passing
- .
-
- See Alsosystemd1,
+ systemd-journald.service8,
systemctl1,
+ coredumpctl1,
+ systemd.journal-fields7,
journald.conf5