X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fjournalctl.xml;h=1ea004fc8156b56fe101ab8ba33b484d721e7b50;hb=3b7124a8db56ed57525b9ecfd19cfdc8c9facba0;hp=bb964b01ed5e1a860c45bcb0fc2bb89ce6fa179d;hpb=14a65d65a0c25ba4809b8d97f54ebf3e12eac84c;p=elogind.git diff --git a/man/journalctl.xml b/man/journalctl.xml index bb964b01e..1ea004fc8 100644 --- a/man/journalctl.xml +++ b/man/journalctl.xml @@ -49,7 +49,7 @@ - journalctl OPTIONS MATCH + journalctl OPTIONS MATCHES @@ -66,12 +66,34 @@ contents of the journal, starting with the oldest entry collected. - If a match argument is passed the output is - filtered accordingly. A match is in the format - FIELD=VALUE, - e.g. _SYSTEMD_UNIT=httpd.service. See + If one or more match arguments are passed the + output is filtered accordingly. A match is in the + format FIELD=VALUE, + e.g. _SYSTEMD_UNIT=httpd.service, + referring to the components of a structured journal + entry. See systemd.journal-fields7 - for a list of well-known fields. + for a list of well-known fields. If multiple matches + are specified matching different fields the log + entries are filtered by both, i.e. the resulting output + will show only entries matching all the specified + matches of this kind. If two matches apply to the same + field, then they are automatically matched as + alternatives, i.e. the resulting output will show + entries matching any of the specified matches for the + same field. Finally, if the character + "+" appears as separate word on the + command line all matches before and after are combined + in a disjunction (i.e. logical OR). + + As shortcuts for a few types of field/value + matches file paths may be specified. If a file path + refers to an executable file, this is equivalent to an + _EXE= match for the canonicalized + binary path. Similar, if a path refers to a device + node, this is equivalent to a + _KERNEL_DEVICE= match for the + device. Output is interleaved from all accessible journal files, whether they are rotated or currently @@ -128,7 +150,7 @@ Show only most recent - journal entries, and continously print + journal entries, and continuously print new entries as they are appended to the journal. @@ -160,8 +182,8 @@ Controls the - formatting of the journal entries that are - shown. Takes one of + formatting of the journal entries that + are shown. Takes one of short, short-monotonic, verbose, @@ -176,13 +198,16 @@ is very similar but shows monotonic timestamps instead of wallclock timestamps. verbose - shows the full structered entry items + shows the full structured entry items with all - fiels. export + fields. export serializes the journal into a binary (but mostly text-based) stream suitable for backups and network - transfer. json + transfer (see Journal + Export Format for more + information). json formats entries as JSON data structures. cat generates a very terse output only @@ -196,7 +221,7 @@ Suppresses any warning - message regarding inaccessable system + message regarding inaccessible system journals when run as normal user. @@ -229,6 +254,38 @@ paths. + + + + + Filter output by + message priorities or priority + ranges. Takes either a single numeric + or textual log level (i.e. between + 0/emerg and + 7/debug), or a + range of numeric/text log levels in + the form FROM..TO. The log levels are + the usual syslog log levels as + documented in + syslog3, + i.e. emerg (0), + alert (1), + crit (2), + err (3), + warning (4), + notice (5), + info (6), + debug (7). If a + single log level is specified all + messages with this log levels or a + lower (hence more important) log level + are shown. If a range is specified all + messages within the range are shown, + including both the start and the end + value of the range. + + @@ -245,6 +302,65 @@ similar. + + + + Instead of showing + journal contents show internal header + information of the journal fiels + accessed. + + + + + + Instead of showing + journal contents generate a new key + pair for Forward Secure Sealing + (FSS). This will generate a sealing + key and a verification key. The + sealing key is stored in the journal + data directory and shall remain on the + host. The verification key should be + stored externally. + + + + + + Specifies the change + interval for the sealing key, when + generating an FSS key pair with + . Shorter + intervals increase CPU consumption but + shorten the time range of + undetectable journal + alterations. Defaults to + 15min. + + + + + + Check the journal file + for internal consistency. If the + file has been generated with FSS + enabled, and the FSS verification key + has been specified with + + authenticity of the journal file is + verified. + + + + + + Specifies the FSS + verification key to use for the + + operation. + + @@ -271,6 +387,45 @@ + + Examples + + Without arguments all collected logs are shown + unfiltered: + + journalctl + + With one match specified all entries with a field matching the expression are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service + + If two different fields are matched only entries matching both expressions at the same time are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + + If two matches refer to the same field all entries matching either expression are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service + + If the separator "+" is used + two expression may be combined in a logical OR. The + following will show all messages from the Avahi + service process with the PID 28097 plus all messages + from the D-Bus service (from any of its + processes): + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service + + Show all logs generated by the D-Bus executable: + + journalctl /usr/bin/dbus-daemon + + Show all logs of the kernel device node /dev/sda: + + journalctl /dev/sda + + + See Also