man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2012 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="journalctl"
  25           xmlns:xi="http://www.w3.org/2001/XInclude">
  26
  27         <refentryinfo>
  28                 <title>journalctl</title>
  29                 <productname>systemd</productname>
  30
  31                 <authorgroup>
  32                         <author>
  33                                 <contrib>Developer</contrib>
  34                                 <firstname>Lennart</firstname>
  35                                 <surname>Poettering</surname>
  36                                 <email>lennart@poettering.net</email>
  37                         </author>
  38                 </authorgroup>
  39         </refentryinfo>
  40
  41         <refmeta>
  42                 <refentrytitle>journalctl</refentrytitle>
  43                 <manvolnum>1</manvolnum>
  44         </refmeta>
  45
  46         <refnamediv>
  47                 <refname>journalctl</refname>
  48                 <refpurpose>Query the systemd journal</refpurpose>
  49         </refnamediv>
  50
  51         <refsynopsisdiv>
  52                 <cmdsynopsis>
  53                         <command>journalctl</command>
  54                         <arg choice="opt" rep="repeat">OPTIONS</arg>
  55                         <arg choice="opt" rep="repeat">MATCHES</arg>
  56                 </cmdsynopsis>
  57         </refsynopsisdiv>
  58
  59         <refsect1>
  60                 <title>Description</title>
  61
  62                 <para><command>journalctl</command> may be used to
  63                 query the contents of the
  64                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  65                 journal as written by
  66                 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  67
  68                 <para>If called without parameters, it will show the full
  69                 contents of the journal, starting with the oldest
  70                 entry collected.</para>
  71
  72                 <para>If one or more match arguments are passed, the
  73                 output is filtered accordingly. A match is in the
  74                 format <literal>FIELD=VALUE</literal>,
  75                 e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
  76                 referring to the components of a structured journal
  77                 entry. See
  78                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  79                 for a list of well-known fields. If multiple matches
  80                 are specified matching different fields, the log
  81                 entries are filtered by both, i.e. the resulting output
  82                 will show only entries matching all the specified
  83                 matches of this kind. If two matches apply to the same
  84                 field, then they are automatically matched as
  85                 alternatives, i.e. the resulting output will show
  86                 entries matching any of the specified matches for the
  87                 same field. Finally, the character
  88                 <literal>+</literal> may appears as a separate word
  89                 between other terms on the command line. This causes
  90                 all matches before and after to be combined in a
  91                 disjunction (i.e. logical OR).</para>
  92
  93                 <para>As shortcuts for a few types of field/value
  94                 matches, file paths may be specified. If a file path
  95                 refers to an executable file, this is equivalent to an
  96                 <literal>_EXE=</literal> match for the canonicalized
  97                 binary path. Similarly, if a path refers to a device
  98                 node, this is equivalent to a
  99                 <literal>_KERNEL_DEVICE=</literal> match for the
 100                 device.</para>
 101
 102                 <para>Additional constraints may be added using options
 103                 <option>--boot</option>, <option>--unit=</option>,
 104                 etc, to further limit what entries will be shown
 105                 (logical AND).</para>
 106
 107                 <para>Output is interleaved from all accessible
 108                 journal files, whether they are rotated or currently
 109                 being written, and regardless of whether they belong to the
 110                 system itself or are accessible user journals.</para>
 111
 112                 <para>The set of journal files which will be used
 113                 can be modified using the <option>--user</option>,
 114                 <option>--system</option>, <option>--directory</option>,
 115                 and <option>--file</option> options, see below.</para>
 116
 117                 <para>All users are granted access to their private
 118                 per-user journals. However, by default, only root and
 119                 users who are members of the <literal>systemd-journal</literal>
 120                 group get access to the system journal and the
 121                 journals of other users.</para>
 122
 123                 <para>The output is paged through
 124                 <command>less</command> by default, and long lines are
 125                 "truncated" to screen width. The hidden part can be
 126                 viewed by using the left-arrow and right-arrow
 127                 keys. Paging can be disabled; see the
 128                 <option>--no-pager</option> option and the "Environment"
 129                 section below.</para>
 130
 131                 <para>When outputting to a tty, lines are colored
 132                 according to priority: lines of level ERROR and higher
 133                 are colored red; lines of level NOTICE and higher are
 134                 highlighted; other lines are displayed normally.
 135                 </para>
 136         </refsect1>
 137
 138         <refsect1>
 139                 <title>Options</title>
 140
 141                 <para>The following options are understood:</para>
 142
 143                 <variablelist>
 144                         <varlistentry>
 145                                 <term><option>--no-full</option></term>
 146                                 <term><option>--full</option></term>
 147                                 <term><option>-l</option></term>
 148
 149                                 <listitem><para>Ellipsize fields when
 150                                 they do not fit in available columns.
 151                                 The default is to show full fields,
 152                                 allowing them to wrap or be truncated
 153                                 by the pager, if one is used.</para>
 154
 155                                 <para>The old options
 156                                 <option>-l</option>/<option>--full</option>
 157                                 are not useful anymore, except to undo
 158                                 <option>--no-full</option>.</para></listitem>
 159                         </varlistentry>
 160
 161                         <varlistentry>
 162                                 <term><option>-a</option></term>
 163                                 <term><option>--all</option></term>
 164
 165                                 <listitem><para>Show all fields in
 166                                 full, even if they include unprintable
 167                                 characters or are very
 168                                 long.</para></listitem>
 169                         </varlistentry>
 170
 171                         <varlistentry>
 172                                 <term><option>-f</option></term>
 173                                 <term><option>--follow</option></term>
 174
 175                                 <listitem><para>Show only the most recent
 176                                 journal entries, and continuously print
 177                                 new entries as they are appended to
 178                                 the journal.</para></listitem>
 179                         </varlistentry>
 180
 181                         <varlistentry>
 182                                 <term><option>-e</option></term>
 183                                 <term><option>--pager-end</option></term>
 184
 185                                 <listitem><para>Immediately jump to
 186                                 the end of the journal inside the
 187                                 implied pager tool. This implies
 188                                 <option>-n1000</option> to guarantee
 189                                 that the pager will not buffer logs of
 190                                 unbounded size. This may be overridden
 191                                 with an explicit <option>-n</option>
 192                                 with some other numeric value while
 193                                 <option>-nall</option> will disable this cap.
 194                                 Note that this option is only supported for the
 195                                 <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 196                                 pager.</para></listitem>
 197                         </varlistentry>
 198
 199                         <varlistentry>
 200                                 <term><option>-n</option></term>
 201                                 <term><option>--lines=</option></term>
 202
 203                                 <listitem><para>Show the most recent
 204                                 journal events and limit the number of
 205                                 events shown. If
 206                                 <option>--follow</option> is used,
 207                                 this option is implied. The argument is
 208                                 a positive integer or <literal>all</literal>
 209                                 to disable line limiting. The default value is
 210                                 10 if no argument is given.</para></listitem>
 211                         </varlistentry>
 212
 213                         <varlistentry>
 214                                 <term><option>--no-tail</option></term>
 215
 216                                 <listitem><para>Show all stored output
 217                                 lines, even in follow mode. Undoes the
 218                                 effect of
 219                                 <option>--lines=</option>.</para></listitem>
 220                         </varlistentry>
 221
 222                         <varlistentry>
 223                                 <term><option>-r</option></term>
 224                                 <term><option>--reverse</option></term>
 225
 226                                 <listitem><para>Reverse output so that the newest
 227                                 entries are displayed first.</para></listitem>
 228                         </varlistentry>
 229
 230                         <varlistentry>
 231                                 <term><option>-o</option></term>
 232                                 <term><option>--output=</option></term>
 233
 234                                 <listitem><para>Controls the
 235                                 formatting of the journal entries that
 236                                 are shown. Takes one of the following options:
 237                                 </para>
 238                                 <variablelist>
 239                                         <varlistentry>
 240                                                 <term>
 241                                                         <option>short</option>
 242                                                 </term>
 243                                                 <listitem>
 244                                                         <para>is the default
 245                                                         and generates an output
 246                                                         that is mostly identical
 247                                                         to the formatting of
 248                                                         classic syslog files,
 249                                                         showing one line per
 250                                                         journal entry.</para>
 251                                                 </listitem>
 252                                         </varlistentry>
 253
 254                                         <varlistentry>
 255                                                 <term>
 256                                                         <option>short-iso</option>
 257                                                 </term>
 258                                                 <listitem>
 259                                                         <para>is very similar,
 260                                                         but shows ISO 8601
 261                                                         wallclock timestamps.
 262                                                         </para>
 263                                                 </listitem>
 264                                         </varlistentry>
 265
 266                                         <varlistentry>
 267                                                 <term>
 268                                                         <option>short-precise</option>
 269                                                 </term>
 270                                                 <listitem>
 271                                                         <para>is very similar,
 272                                                         but shows timestamps
 273                                                         with full microsecond
 274                                                         precision.
 275                                                         </para>
 276                                                 </listitem>
 277                                         </varlistentry>
 278
 279                                         <varlistentry>
 280                                                 <term>
 281                                                         <option>short-monotonic</option>
 282                                                 </term>
 283                                                 <listitem>
 284                                                         <para>is very similar,
 285                                                         but shows monotonic
 286                                                         timestamps instead of
 287                                                         wallclock timestamps.
 288                                                         </para>
 289                                                 </listitem>
 290                                         </varlistentry>
 291
 292                                         <varlistentry>
 293                                                 <term>
 294                                                         <option>verbose</option>
 295                                                 </term>
 296                                                 <listitem>
 297                                                         <para>shows the
 298                                                         full-structured entry
 299                                                         items with all fields.
 300                                                         </para>
 301                                                 </listitem>
 302                                         </varlistentry>
 303
 304                                         <varlistentry>
 305                                                 <term>
 306                                                         <option>export</option>
 307                                                 </term>
 308                                                 <listitem>
 309                                                         <para>serializes the
 310                                                         journal into a binary
 311                                                         (but mostly text-based)
 312                                                         stream suitable for
 313                                                         backups and network
 314                                                         transfer (see <ulink
 315                                                         url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
 316                                                         Export Format</ulink>
 317                                                         for more
 318                                                         information).</para>
 319                                                 </listitem>
 320                                         </varlistentry>
 321
 322                                         <varlistentry>
 323                                                 <term>
 324                                                         <option>json</option>
 325                                                 </term>
 326                                                 <listitem>
 327                                                         <para>formats entries
 328                                                         as JSON data structures,
 329                                                         one per line (see <ulink
 330                                                         url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
 331                                                         JSON Format</ulink> for
 332                                                         more information).</para>
 333                                                 </listitem>
 334                                         </varlistentry>
 335
 336                                         <varlistentry>
 337                                                 <term>
 338                                                         <option>json-pretty</option>
 339                                                 </term>
 340                                                 <listitem>
 341                                                         <para>formats entries as
 342                                                         JSON data structures,
 343                                                         but formats them in
 344                                                         multiple lines in order
 345                                                         to make them more
 346                                                         readable by humans.</para>
 347                                                 </listitem>
 348                                         </varlistentry>
 349
 350                                         <varlistentry>
 351                                                 <term>
 352                                                         <option>json-sse</option>
 353                                                 </term>
 354                                                 <listitem>
 355                                                         <para>formats entries as
 356                                                         JSON data structures,
 357                                                         but wraps them in a
 358                                                         format suitable for <ulink
 359                                                         url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
 360                                                         Events</ulink>.</para>
 361                                                 </listitem>
 362                                         </varlistentry>
 363
 364                                         <varlistentry>
 365                                                 <term>
 366                                                         <option>cat</option>
 367                                                 </term>
 368                                                 <listitem>
 369                                                         <para>generates a very
 370                                                         terse output, only
 371                                                         showing the actual
 372                                                         message of each journal
 373                                                         entry with no metadata,
 374                                                         not even a timestamp.
 375                                                         </para>
 376                                                 </listitem>
 377                                         </varlistentry>
 378                                 </variablelist>
 379                                 </listitem>
 380                         </varlistentry>
 381
 382                         <varlistentry>
 383                                 <term><option>--utc</option></term>
 384
 385                                 <listitem><para>Express time in Coordinated Universal
 386                                 Time (UTC).</para></listitem>
 387                         </varlistentry>
 388
 389                         <varlistentry>
 390                                 <term><option>-x</option></term>
 391                                 <term><option>--catalog</option></term>
 392
 393                                 <listitem><para>Augment log lines with
 394                                 explanation texts from the message
 395                                 catalog. This will add explanatory
 396                                 help texts to log messages in the
 397                                 output where this is available. These
 398                                 short help texts will explain the
 399                                 context of an error or log event,
 400                                 possible solutions, as well as
 401                                 pointers to support forums, developer
 402                                 documentation, and any other relevant
 403                                 manuals. Note that help texts are not
 404                                 available for all messages, but only
 405                                 for selected ones. For more
 406                                 information on the message catalog,
 407                                 please refer to the <ulink
 408                                 url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
 409                                 Catalog Developer
 410                                 Documentation</ulink>.</para>
 411
 412                                 <para>Note: when attaching
 413                                 <command>journalctl</command> output
 414                                 to bug reports, please do
 415                                 <emphasis>not</emphasis> use
 416                                 <option>-x</option>.</para>
 417                                 </listitem>
 418                         </varlistentry>
 419
 420                         <varlistentry>
 421                                 <term><option>-q</option></term>
 422                                 <term><option>--quiet</option></term>
 423
 424                                 <listitem><para>Suppresses any warning
 425                                 messages regarding inaccessible system
 426                                 journals when run as a normal
 427                                 user.</para></listitem>
 428                         </varlistentry>
 429
 430                         <varlistentry>
 431                                 <term><option>-m</option></term>
 432                                 <term><option>--merge</option></term>
 433
 434                                 <listitem><para>Show entries
 435                                 interleaved from all available
 436                                 journals, including remote
 437                                 ones.</para></listitem>
 438                         </varlistentry>
 439
 440                         <varlistentry>
 441                                 <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 442                                 <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 443
 444                                 <listitem><para>Show messages from a specific
 445                                 boot. This will add a match for
 446                                 <literal>_BOOT_ID=</literal>.</para>
 447
 448                                 <para>The argument may be empty, in which case
 449                                 logs for the current boot will be shown.</para>
 450
 451                                 <para>If the boot ID is omitted, a positive
 452                                 <replaceable>offset</replaceable> will look up
 453                                 the boots starting from the beginning of the
 454                                 journal, and a equal-or-less-than zero
 455                                 <replaceable>offset</replaceable> will look up
 456                                 boots starting from the end of the
 457                                 journal. Thus, <constant>1</constant> means the
 458                                 first boot found in the journal in
 459                                 chronological order, <constant>2</constant> the
 460                                 second and so on; while <constant>-0</constant>
 461                                 is the last boot, <constant>-1</constant> the
 462                                 boot before last, and so on. An empty
 463                                 <replaceable>offset</replaceable> is equivalent
 464                                 to specifying <constant>-0</constant>, except
 465                                 when the current boot is not the last boot
 466                                 (e.g. because <option>--directory</option> was
 467                                 specified to look at logs from a different
 468                                 machine).</para>
 469
 470                                 <para>If the 32-character
 471                                 <replaceable>ID</replaceable> is specified, it
 472                                 may optionally be followed by
 473                                 <replaceable>offset</replaceable> which
 474                                 identifies the boot relative to the one given by
 475                                 boot <replaceable>ID</replaceable>. Negative
 476                                 values mean earlier boots and a positive values
 477                                 mean later boots. If
 478                                 <replaceable>offset</replaceable> is not
 479                                 specified, a value of zero is assumed, and the
 480                                 logs for the boot given by
 481                                 <replaceable>ID</replaceable> are shown.
 482                                 </para>
 483
 484                                 </listitem>
 485                         </varlistentry>
 486
 487                         <varlistentry>
 488                                 <term><option>--list-boots</option></term>
 489
 490                                 <listitem><para>Show a tabular list of
 491                                 boot numbers (relative to the current
 492                                 boot), their IDs, and the timestamps
 493                                 of the first and last message
 494                                 pertaining to the boot.
 495                                 </para></listitem>
 496                         </varlistentry>
 497
 498                         <varlistentry>
 499                                 <term><option>-k</option></term>
 500                                 <term><option>--dmesg</option></term>
 501
 502                                 <listitem><para>Show only kernel messages. This
 503                                 implies <option>-b</option> and adds the match
 504                                 <literal>_TRANSPORT=kernel</literal>.
 505                                 </para></listitem>
 506                         </varlistentry>
 507
 508                         <varlistentry>
 509                                 <term><option>-t</option></term>
 510                                 <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 511
 512                                 <listitem><para>Show messages for the
 513                                 specified syslog identifier
 514                                 <replaceable>SYSLOG_IDENTIFIER</replaceable>, or
 515                                 for any of the messages with a <literal>SYSLOG_IDENTIFIER</literal>
 516                                 matched by <replaceable>PATTERN</replaceable>.</para>
 517
 518                                 <para>This parameter can be specified
 519                                 multiple times.</para></listitem>
 520                         </varlistentry>
 521
 522                         <varlistentry>
 523                                 <term><option>-u</option></term>
 524                                 <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 525
 526                                 <listitem><para>Show messages for the
 527                                 specified systemd unit
 528                                 <replaceable>UNIT</replaceable> (such
 529                                 as a service unit), or for any of the
 530                                 units matched by
 531                                 <replaceable>PATTERN</replaceable>.
 532                                 If a pattern is specified, a list of
 533                                 unit names found in the journal is
 534                                 compared with the specified pattern
 535                                 and all that match are used. For each
 536                                 unit name, a match is added for
 537                                 messages from the unit
 538                                 (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 539                                 along with additional matches for
 540                                 messages from systemd and messages
 541                                 about coredumps for the specified
 542                                 unit.</para>
 543
 544                                 <para>This parameter can be specified
 545                                 multiple times.</para></listitem>
 546                         </varlistentry>
 547
 548                         <varlistentry>
 549                                 <term><option>--user-unit=</option></term>
 550
 551                                 <listitem><para>Show messages for the
 552                                 specified user session unit. This will
 553                                 add a match for messages from the unit
 554                                 (<literal>_SYSTEMD_USER_UNIT=</literal>
 555                                 and <literal>_UID=</literal>) and
 556                                 additional matches for messages from
 557                                 session systemd and messages about
 558                                 coredumps for the specified unit.</para>
 559                                 <para>This parameter can be specified multiple times.
 560                                 </para></listitem>
 561                         </varlistentry>
 562
 563                         <varlistentry>
 564                                 <term><option>-p</option></term>
 565                                 <term><option>--priority=</option></term>
 566
 567                                 <listitem><para>Filter output by
 568                                 message priorities or priority
 569                                 ranges. Takes either a single numeric
 570                                 or textual log level (i.e. between
 571                                 0/<literal>emerg</literal> and
 572                                 7/<literal>debug</literal>), or a
 573                                 range of numeric/text log levels in
 574                                 the form FROM..TO. The log levels are
 575                                 the usual syslog log levels as
 576                                 documented in
 577                                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 578                                 i.e. <literal>emerg</literal> (0),
 579                                 <literal>alert</literal> (1),
 580                                 <literal>crit</literal> (2),
 581                                 <literal>err</literal> (3),
 582                                 <literal>warning</literal> (4),
 583                                 <literal>notice</literal> (5),
 584                                 <literal>info</literal> (6),
 585                                 <literal>debug</literal> (7). If a
 586                                 single log level is specified, all
 587                                 messages with this log level or a
 588                                 lower (hence more important) log level
 589                                 are shown. If a range is specified, all
 590                                 messages within the range are shown,
 591                                 including both the start and the end
 592                                 value of the range. This will add
 593                                 <literal>PRIORITY=</literal> matches
 594                                 for the specified
 595                                 priorities.</para></listitem>
 596                         </varlistentry>
 597
 598                         <varlistentry>
 599                                 <term><option>-c</option></term>
 600                                 <term><option>--cursor=</option></term>
 601
 602                                 <listitem><para>Start showing entries
 603                                 from the location in the journal
 604                                 specified by the passed
 605                                 cursor.</para></listitem>
 606                         </varlistentry>
 607
 608                         <varlistentry>
 609                                 <term><option>--after-cursor=</option></term>
 610
 611                                 <listitem><para>Start showing entries
 612                                 from the location in the journal
 613                                 <emphasis>after</emphasis> the
 614                                 location specified by the this cursor.
 615                                 The cursor is shown when the
 616                                 <option>--show-cursor</option> option
 617                                 is used.</para></listitem>
 618                         </varlistentry>
 619
 620                         <varlistentry>
 621                                 <term><option>--show-cursor</option></term>
 622
 623                                 <listitem><para>The cursor is shown after the last
 624                                 entry after two dashes:</para>
 625                                 <programlisting>-- cursor: s=0639...</programlisting>
 626                                 <para>The format of the cursor is private
 627                                 and subject to change.</para></listitem>
 628                         </varlistentry>
 629
 630                         <varlistentry>
 631                                 <term><option>--since=</option></term>
 632                                 <term><option>--until=</option></term>
 633
 634                                 <listitem><para>Start showing entries
 635                                 on or newer than the specified date,
 636                                 or on or older than the specified
 637                                 date, respectively. Date specifications
 638                                 should be of the format
 639                                 <literal>2012-10-30 18:17:16</literal>.
 640                                 If the time part is omitted,
 641                                 <literal>00:00:00</literal> is assumed.
 642                                 If only the seconds component is omitted,
 643                                 <literal>:00</literal> is assumed. If the
 644                                 date component is omitted, the current
 645                                 day is assumed. Alternatively the strings
 646                                 <literal>yesterday</literal>,
 647                                 <literal>today</literal>,
 648                                 <literal>tomorrow</literal> are
 649                                 understood, which refer to 00:00:00 of
 650                                 the day before the current day, the
 651                                 current day, or the day after the
 652                                 current day, respectively. <literal>now</literal>
 653                                 refers to the current time. Finally,
 654                                 relative times may be specified,
 655                                 prefixed with <literal>-</literal> or
 656                                 <literal>+</literal>, referring to
 657                                 times before or after the current
 658                                 time, respectively.</para></listitem>
 659                         </varlistentry>
 660
 661                         <varlistentry>
 662                                 <term><option>-F</option></term>
 663                                 <term><option>--field=</option></term>
 664
 665                                 <listitem><para>Print all possible
 666                                 data values the specified field can
 667                                 take in all entries of the
 668                                 journal.</para></listitem>
 669                         </varlistentry>
 670
 671                         <varlistentry>
 672                                 <term><option>--system</option></term>
 673                                 <term><option>--user</option></term>
 674
 675                                 <listitem><para>Show messages from
 676                                 system services and the kernel (with
 677                                 <option>--system</option>). Show
 678                                 messages from service of current user
 679                                 (with <option>--user</option>).
 680                                 If neither is specified, show all
 681                                 messages that the user can see.
 682                                 </para></listitem>
 683                         </varlistentry>
 684
 685                         <varlistentry>
 686                                 <term><option>-M</option></term>
 687                                 <term><option>--machine=</option></term>
 688
 689                                 <listitem><para>Show messages from a
 690                                 running, local container. Specify a
 691                                 container name to connect
 692                                 to.</para></listitem>
 693                         </varlistentry>
 694
 695                         <varlistentry>
 696                                 <term><option>-D <replaceable>DIR</replaceable></option></term>
 697                                 <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 698
 699                                 <listitem><para>Takes a directory path
 700                                 as argument. If specified, journalctl
 701                                 will operate on the specified journal
 702                                 directory
 703                                 <replaceable>DIR</replaceable> instead
 704                                 of the default runtime and system
 705                                 journal paths.</para></listitem>
 706                         </varlistentry>
 707
 708                         <varlistentry>
 709                                 <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 710
 711                                 <listitem><para>Takes a file glob as an
 712                                 argument. If specified, journalctl will
 713                                 operate on the specified journal files
 714                                 matching <replaceable>GLOB</replaceable>
 715                                 instead of the default runtime and
 716                                 system journal paths. May be specified
 717                                 multiple times, in which case files will
 718                                 be suitably interleaved.</para></listitem>
 719                         </varlistentry>
 720
 721                         <varlistentry>
 722                                 <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 723
 724                                 <listitem><para>Takes a directory path
 725                                 as an argument. If specified, journalctl
 726                                 will operate on catalog file hierarchy
 727                                 underneath the specified directory
 728                                 instead of the root directory
 729                                 (e.g. <option>--update-catalog</option>
 730                                 will create
 731                                 <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).
 732                                 </para></listitem>
 733                         </varlistentry>
 734
 735                         <varlistentry>
 736                                 <term><option>--new-id128</option></term>
 737
 738                                 <listitem><para>Instead of showing
 739                                 journal contents, generate a new 128-bit
 740                                 ID suitable for identifying
 741                                 messages. This is intended for usage
 742                                 by developers who need a new
 743                                 identifier for a new message they
 744                                 introduce and want to make
 745                                 recognizable. This will print the new ID in
 746                                 three different formats which can be
 747                                 copied into source code or
 748                                 similar.</para></listitem>
 749                         </varlistentry>
 750
 751                         <varlistentry>
 752                                 <term><option>--header</option></term>
 753
 754                                 <listitem><para>Instead of showing
 755                                 journal contents, show internal header
 756                                 information of the journal fields
 757                                 accessed.</para></listitem>
 758                         </varlistentry>
 759
 760                         <varlistentry>
 761                                 <term><option>--disk-usage</option></term>
 762
 763                                 <listitem><para>Shows the current disk
 764                                 usage of all journal files. This shows
 765                                 the sum of the disk usage of all
 766                                 archived and active journal
 767                                 files.</para></listitem>
 768                         </varlistentry>
 769
 770                         <varlistentry>
 771                                 <term><option>--vacuum-size=</option></term>
 772                                 <term><option>--vacuum-time=</option></term>
 773
 774                                 <listitem><para>Removes archived
 775                                 journal files until the disk space
 776                                 they use falls below the specified
 777                                 size (specified with the usual K, M,
 778                                 G, T suffixes), or all journal files
 779                                 contain no data older than the
 780                                 specified timespan (specified with the
 781                                 usual s, min, h, days, months, weeks,
 782                                 years suffixes). Note that running
 783                                 <option>--vacuum-size=</option> has
 784                                 only indirect effect on the output
 785                                 shown by <option>--disk-usage</option>
 786                                 as the latter includes active journal
 787                                 files, while the former only operates
 788                                 on archived journal
 789                                 files. <option>--vacuum-size=</option>
 790                                 and <option>--vacuum-time=</option>
 791                                 may be combined in a single invocation
 792                                 to enforce both a size and time limit
 793                                 on the archived journal
 794                                 files.</para></listitem>
 795                         </varlistentry>
 796
 797                         <varlistentry>
 798                                 <term><option>--list-catalog
 799                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 800                                 </option></term>
 801
 802                                 <listitem><para>List the contents of
 803                                 the message catalog as a table of
 804                                 message IDs, plus their short
 805                                 description strings.</para>
 806
 807                                 <para>If any
 808                                 <replaceable>128-bit-ID</replaceable>s are
 809                                 specified, only those entries are shown.
 810                                 </para>
 811                                 </listitem>
 812                         </varlistentry>
 813
 814                         <varlistentry>
 815                                 <term><option>--dump-catalog
 816                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 817                                 </option></term>
 818
 819                                 <listitem><para>Show the contents of
 820                                 the message catalog, with entries
 821                                 separated by a line consisting of two
 822                                 dashes and the ID (the format is the
 823                                 same as <filename>.catalog</filename>
 824                                 files).</para>
 825
 826                                 <para>If any
 827                                 <replaceable>128-bit-ID</replaceable>s are
 828                                 specified, only those entries are shown.
 829                                 </para>
 830                                 </listitem>
 831                         </varlistentry>
 832
 833                         <varlistentry>
 834                                 <term><option>--update-catalog</option></term>
 835
 836                                 <listitem><para>Update the message
 837                                 catalog index. This command needs to
 838                                 be executed each time new catalog
 839                                 files are installed, removed, or
 840                                 updated to rebuild the binary catalog
 841                                 index.</para></listitem>
 842                         </varlistentry>
 843
 844                         <varlistentry>
 845                                 <term><option>--setup-keys</option></term>
 846
 847                                 <listitem><para>Instead of showing
 848                                 journal contents, generate a new key
 849                                 pair for Forward Secure Sealing
 850                                 (FSS). This will generate a sealing
 851                                 key and a verification key. The
 852                                 sealing key is stored in the journal
 853                                 data directory and shall remain on the
 854                                 host. The verification key should be
 855                                 stored externally. Refer to the
 856                                 <option>Seal=</option> option in
 857                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 858                                 for information on Forward Secure
 859                                 Sealing and for a link to a refereed
 860                                 scholarly paper detailing the
 861                                 cryptographic theory it is based on.
 862                                 </para></listitem>
 863                         </varlistentry>
 864
 865                         <varlistentry>
 866                                 <term><option>--force</option></term>
 867
 868                                 <listitem><para>When
 869                                 <option>--setup-keys</option> is passed and
 870                                 Forward Secure Sealing (FSS) has already been
 871                                 configured, recreate FSS keys.</para></listitem>
 872                         </varlistentry>
 873
 874                         <varlistentry>
 875                                 <term><option>--interval=</option></term>
 876
 877                                 <listitem><para>Specifies the change
 878                                 interval for the sealing key when
 879                                 generating an FSS key pair with
 880                                 <option>--setup-keys</option>. Shorter
 881                                 intervals increase CPU consumption but
 882                                 shorten the time range of
 883                                 undetectable journal
 884                                 alterations. Defaults to
 885                                 15min.</para></listitem>
 886                         </varlistentry>
 887
 888                         <varlistentry>
 889                                 <term><option>--verify</option></term>
 890
 891                                 <listitem><para>Check the journal file
 892                                 for internal consistency. If the
 893                                 file has been generated with FSS
 894                                 enabled and the FSS verification key
 895                                 has been specified with
 896                                 <option>--verify-key=</option>,
 897                                 authenticity of the journal file is
 898                                 verified.</para></listitem>
 899                         </varlistentry>
 900
 901                         <varlistentry>
 902                                 <term><option>--verify-key=</option></term>
 903
 904                                 <listitem><para>Specifies the FSS
 905                                 verification key to use for the
 906                                 <option>--verify</option>
 907                                 operation.</para></listitem>
 908                         </varlistentry>
 909
 910                         <varlistentry>
 911                                 <term><option>--flush</option></term>
 912
 913                                 <listitem><para>Asks the Journal
 914                                 daemon to flush any log data stored in
 915                                 <filename>/run/log/journal</filename>
 916                                 into
 917                                 <filename>/var/log/journal</filename>,
 918                                 if persistent storage is enabled. This
 919                                 call does not return until the
 920                                 operation is
 921                                 complete.</para></listitem>
 922                         </varlistentry>
 923
 924                         <xi:include href="standard-options.xml" xpointer="help" />
 925                         <xi:include href="standard-options.xml" xpointer="version" />
 926                         <xi:include href="standard-options.xml" xpointer="no-pager" />
 927                 </variablelist>
 928         </refsect1>
 929
 930         <refsect1>
 931                 <title>Exit status</title>
 932
 933                 <para>On success, 0 is returned; otherwise, a non-zero
 934                 failure code is returned.</para>
 935         </refsect1>
 936
 937         <xi:include href="less-variables.xml" />
 938
 939         <refsect1>
 940                 <title>Examples</title>
 941
 942                 <para>Without arguments, all collected logs are shown
 943                 unfiltered:</para>
 944
 945                 <programlisting>journalctl</programlisting>
 946
 947                 <para>With one match specified, all entries with a field matching the expression are shown:</para>
 948
 949                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
 950
 951                 <para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>
 952
 953                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 954
 955                 <para>If two matches refer to the same field, all entries matching either expression are shown:</para>
 956
 957                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 958
 959                 <para>If the separator <literal>+</literal> is used,
 960                 two expressions may be combined in a logical OR. The
 961                 following will show all messages from the Avahi
 962                 service process with the PID 28097 plus all messages
 963                 from the D-Bus service (from any of its
 964                 processes):</para>
 965
 966                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 967
 968                 <para>Show all logs generated by the D-Bus executable:</para>
 969
 970                 <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 971
 972                 <para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>
 973
 974                 <programlisting>journalctl /dev/sda</programlisting>
 975
 976                 <para>Show all kernel logs from previous boot:</para>
 977
 978                 <programlisting>journalctl -k -b -1</programlisting>
 979
 980                 <para>Show a live log display from a system service <filename>apache.service</filename>:</para>
 981
 982                 <programlisting>journalctl -f -u apache</programlisting>
 983
 984         </refsect1>
 985
 986         <refsect1>
 987                 <title>See Also</title>
 988                 <para>
 989                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 990                         <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 991                         <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 992                         <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 993                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 994                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 995                 </para>
 996         </refsect1>
 997
 998 </refentry>