chiark / gitweb /
update TODO
[elogind.git] / man / journalctl.xml
1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
4
5 <!--
6   This file is part of systemd.
7
8   Copyright 2012 Lennart Poettering
9
10   systemd is free software; you can redistribute it and/or modify it
11   under the terms of the GNU Lesser General Public License as published by
12   the Free Software Foundation; either version 2.1 of the License, or
13   (at your option) any later version.
14
15   systemd is distributed in the hope that it will be useful, but
16   WITHOUT ANY WARRANTY; without even the implied warranty of
17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18   Lesser General Public License for more details.
19
20   You should have received a copy of the GNU Lesser General Public License
21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
22 -->
23
24 <refentry id="journalctl"
25           xmlns:xi="http://www.w3.org/2001/XInclude">
26
27         <refentryinfo>
28                 <title>journalctl</title>
29                 <productname>systemd</productname>
30
31                 <authorgroup>
32                         <author>
33                                 <contrib>Developer</contrib>
34                                 <firstname>Lennart</firstname>
35                                 <surname>Poettering</surname>
36                                 <email>lennart@poettering.net</email>
37                         </author>
38                 </authorgroup>
39         </refentryinfo>
40
41         <refmeta>
42                 <refentrytitle>journalctl</refentrytitle>
43                 <manvolnum>1</manvolnum>
44         </refmeta>
45
46         <refnamediv>
47                 <refname>journalctl</refname>
48                 <refpurpose>Query the systemd journal</refpurpose>
49         </refnamediv>
50
51         <refsynopsisdiv>
52                 <cmdsynopsis>
53                         <command>journalctl</command>
54                         <arg choice="opt" rep="repeat">OPTIONS</arg>
55                         <arg choice="opt" rep="repeat">MATCHES</arg>
56                 </cmdsynopsis>
57         </refsynopsisdiv>
58
59         <refsect1>
60                 <title>Description</title>
61
62                 <para><command>journalctl</command> may be used to
63                 query the contents of the
64                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
65                 journal as written by
66                 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
67
68                 <para>If called without parameters, it will show the full
69                 contents of the journal, starting with the oldest
70                 entry collected.</para>
71
72                 <para>If one or more match arguments are passed, the
73                 output is filtered accordingly. A match is in the
74                 format <literal>FIELD=VALUE</literal>,
75                 e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
76                 referring to the components of a structured journal
77                 entry. See
78                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
79                 for a list of well-known fields. If multiple matches
80                 are specified matching different fields, the log
81                 entries are filtered by both, i.e. the resulting output
82                 will show only entries matching all the specified
83                 matches of this kind. If two matches apply to the same
84                 field, then they are automatically matched as
85                 alternatives, i.e. the resulting output will show
86                 entries matching any of the specified matches for the
87                 same field. Finally, the character
88                 <literal>+</literal> may appears as a separate word
89                 between other terms on the command line. This causes
90                 all matches before and after to be combined in a
91                 disjunction (i.e. logical OR).</para>
92
93                 <para>As shortcuts for a few types of field/value
94                 matches, file paths may be specified. If a file path
95                 refers to an executable file, this is equivalent to an
96                 <literal>_EXE=</literal> match for the canonicalized
97                 binary path. Similarly, if a path refers to a device
98                 node, this is equivalent to a
99                 <literal>_KERNEL_DEVICE=</literal> match for the
100                 device.</para>
101
102                 <para>Additional constraints may be added using options
103                 <option>--boot</option>, <option>--unit=</option>,
104                 etc, to further limit what entries will be shown
105                 (logical AND).</para>
106
107                 <para>Output is interleaved from all accessible
108                 journal files, whether they are rotated or currently
109                 being written, and regardless of whether they belong to the
110                 system itself or are accessible user journals.</para>
111
112                 <para>The set of journal files which will be used
113                 can be modified using the <option>--user</option>,
114                 <option>--system</option>, <option>--directory</option>,
115                 and <option>--file</option> options, see below.</para>
116
117                 <para>All users are granted access to their private
118                 per-user journals. However, by default, only root and
119                 users who are members of the <literal>systemd-journal</literal>
120                 group get access to the system journal and the
121                 journals of other users.</para>
122
123                 <para>The output is paged through
124                 <command>less</command> by default, and long lines are
125                 "truncated" to screen width. The hidden part can be
126                 viewed by using the left-arrow and right-arrow
127                 keys. Paging can be disabled; see the
128                 <option>--no-pager</option> option and the "Environment"
129                 section below.</para>
130
131                 <para>When outputting to a tty, lines are colored
132                 according to priority: lines of level ERROR and higher
133                 are colored red; lines of level NOTICE and higher are
134                 highlighted; other lines are displayed normally.
135                 </para>
136         </refsect1>
137
138         <refsect1>
139                 <title>Options</title>
140
141                 <para>The following options are understood:</para>
142
143                 <variablelist>
144                         <varlistentry>
145                                 <term><option>--no-full</option></term>
146                                 <term><option>--full</option></term>
147                                 <term><option>-l</option></term>
148
149                                 <listitem><para>Ellipsize fields when
150                                 they do not fit in available columns.
151                                 The default is to show full fields,
152                                 allowing them to wrap or be truncated
153                                 by the pager, if one is used.</para>
154
155                                 <para>The old options
156                                 <option>-l</option>/<option>--full</option>
157                                 are not useful anymore, except to undo
158                                 <option>--no-full</option>.</para></listitem>
159                         </varlistentry>
160
161                         <varlistentry>
162                                 <term><option>-a</option></term>
163                                 <term><option>--all</option></term>
164
165                                 <listitem><para>Show all fields in
166                                 full, even if they include unprintable
167                                 characters or are very
168                                 long.</para></listitem>
169                         </varlistentry>
170
171                         <varlistentry>
172                                 <term><option>-f</option></term>
173                                 <term><option>--follow</option></term>
174
175                                 <listitem><para>Show only the most recent
176                                 journal entries, and continuously print
177                                 new entries as they are appended to
178                                 the journal.</para></listitem>
179                         </varlistentry>
180
181                         <varlistentry>
182                                 <term><option>-e</option></term>
183                                 <term><option>--pager-end</option></term>
184
185                                 <listitem><para>Immediately jump to
186                                 the end of the journal inside the
187                                 implied pager tool. This implies
188                                 <option>-n1000</option> to guarantee
189                                 that the pager will not buffer logs of
190                                 unbounded size. This may be overridden
191                                 with an explicit <option>-n</option>
192                                 with some other numeric value while
193                                 <option>-nall</option> will disable this cap.
194                                 Note that this option is only supported for the
195                                 <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
196                                 pager.</para></listitem>
197                         </varlistentry>
198
199                         <varlistentry>
200                                 <term><option>-n</option></term>
201                                 <term><option>--lines=</option></term>
202
203                                 <listitem><para>Show the most recent
204                                 journal events and limit the number of
205                                 events shown. If
206                                 <option>--follow</option> is used,
207                                 this option is implied. The argument is
208                                 a positive integer or <literal>all</literal>
209                                 to disable line limiting. The default value is
210                                 10 if no argument is given.</para></listitem>
211                         </varlistentry>
212
213                         <varlistentry>
214                                 <term><option>--no-tail</option></term>
215
216                                 <listitem><para>Show all stored output
217                                 lines, even in follow mode. Undoes the
218                                 effect of
219                                 <option>--lines=</option>.</para></listitem>
220                         </varlistentry>
221
222                         <varlistentry>
223                                 <term><option>-r</option></term>
224                                 <term><option>--reverse</option></term>
225
226                                 <listitem><para>Reverse output so that the newest
227                                 entries are displayed first.</para></listitem>
228                         </varlistentry>
229
230                         <varlistentry>
231                                 <term><option>-o</option></term>
232                                 <term><option>--output=</option></term>
233
234                                 <listitem><para>Controls the
235                                 formatting of the journal entries that
236                                 are shown. Takes one of the following options:
237                                 </para>
238                                 <variablelist>
239                                         <varlistentry>
240                                                 <term>
241                                                         <option>short</option>
242                                                 </term>
243                                                 <listitem>
244                                                         <para>is the default
245                                                         and generates an output
246                                                         that is mostly identical
247                                                         to the formatting of
248                                                         classic syslog files,
249                                                         showing one line per
250                                                         journal entry.</para>
251                                                 </listitem>
252                                         </varlistentry>
253
254                                         <varlistentry>
255                                                 <term>
256                                                         <option>short-iso</option>
257                                                 </term>
258                                                 <listitem>
259                                                         <para>is very similar,
260                                                         but shows ISO 8601
261                                                         wallclock timestamps.
262                                                         </para>
263                                                 </listitem>
264                                         </varlistentry>
265
266                                         <varlistentry>
267                                                 <term>
268                                                         <option>short-precise</option>
269                                                 </term>
270                                                 <listitem>
271                                                         <para>is very similar,
272                                                         but shows timestamps
273                                                         with full microsecond
274                                                         precision.
275                                                         </para>
276                                                 </listitem>
277                                         </varlistentry>
278
279                                         <varlistentry>
280                                                 <term>
281                                                         <option>short-monotonic</option>
282                                                 </term>
283                                                 <listitem>
284                                                         <para>is very similar,
285                                                         but shows monotonic
286                                                         timestamps instead of
287                                                         wallclock timestamps.
288                                                         </para>
289                                                 </listitem>
290                                         </varlistentry>
291
292                                         <varlistentry>
293                                                 <term>
294                                                         <option>verbose</option>
295                                                 </term>
296                                                 <listitem>
297                                                         <para>shows the
298                                                         full-structured entry
299                                                         items with all fields.
300                                                         </para>
301                                                 </listitem>
302                                         </varlistentry>
303
304                                         <varlistentry>
305                                                 <term>
306                                                         <option>export</option>
307                                                 </term>
308                                                 <listitem>
309                                                         <para>serializes the
310                                                         journal into a binary
311                                                         (but mostly text-based)
312                                                         stream suitable for
313                                                         backups and network
314                                                         transfer (see <ulink
315                                                         url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
316                                                         Export Format</ulink>
317                                                         for more
318                                                         information).</para>
319                                                 </listitem>
320                                         </varlistentry>
321
322                                         <varlistentry>
323                                                 <term>
324                                                         <option>json</option>
325                                                 </term>
326                                                 <listitem>
327                                                         <para>formats entries
328                                                         as JSON data structures,
329                                                         one per line (see <ulink
330                                                         url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
331                                                         JSON Format</ulink> for
332                                                         more information).</para>
333                                                 </listitem>
334                                         </varlistentry>
335
336                                         <varlistentry>
337                                                 <term>
338                                                         <option>json-pretty</option>
339                                                 </term>
340                                                 <listitem>
341                                                         <para>formats entries as
342                                                         JSON data structures,
343                                                         but formats them in
344                                                         multiple lines in order
345                                                         to make them more
346                                                         readable by humans.</para>
347                                                 </listitem>
348                                         </varlistentry>
349
350                                         <varlistentry>
351                                                 <term>
352                                                         <option>json-sse</option>
353                                                 </term>
354                                                 <listitem>
355                                                         <para>formats entries as
356                                                         JSON data structures,
357                                                         but wraps them in a
358                                                         format suitable for <ulink
359                                                         url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
360                                                         Events</ulink>.</para>
361                                                 </listitem>
362                                         </varlistentry>
363
364                                         <varlistentry>
365                                                 <term>
366                                                         <option>cat</option>
367                                                 </term>
368                                                 <listitem>
369                                                         <para>generates a very
370                                                         terse output, only
371                                                         showing the actual
372                                                         message of each journal
373                                                         entry with no metadata,
374                                                         not even a timestamp.
375                                                         </para>
376                                                 </listitem>
377                                         </varlistentry>
378                                 </variablelist>
379                                 </listitem>
380                         </varlistentry>
381
382                         <varlistentry>
383                                 <term><option>--utc</option></term>
384
385                                 <listitem><para>Express time in Coordinated Universal
386                                 Time (UTC).</para></listitem>
387                         </varlistentry>
388
389                         <varlistentry>
390                                 <term><option>-x</option></term>
391                                 <term><option>--catalog</option></term>
392
393                                 <listitem><para>Augment log lines with
394                                 explanation texts from the message
395                                 catalog. This will add explanatory
396                                 help texts to log messages in the
397                                 output where this is available. These
398                                 short help texts will explain the
399                                 context of an error or log event,
400                                 possible solutions, as well as
401                                 pointers to support forums, developer
402                                 documentation, and any other relevant
403                                 manuals. Note that help texts are not
404                                 available for all messages, but only
405                                 for selected ones. For more
406                                 information on the message catalog,
407                                 please refer to the <ulink
408                                 url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
409                                 Catalog Developer
410                                 Documentation</ulink>.</para>
411
412                                 <para>Note: when attaching
413                                 <command>journalctl</command> output
414                                 to bug reports, please do
415                                 <emphasis>not</emphasis> use
416                                 <option>-x</option>.</para>
417                                 </listitem>
418                         </varlistentry>
419
420                         <varlistentry>
421                                 <term><option>-q</option></term>
422                                 <term><option>--quiet</option></term>
423
424                                 <listitem><para>Suppresses any warning
425                                 messages regarding inaccessible system
426                                 journals when run as a normal
427                                 user.</para></listitem>
428                         </varlistentry>
429
430                         <varlistentry>
431                                 <term><option>-m</option></term>
432                                 <term><option>--merge</option></term>
433
434                                 <listitem><para>Show entries
435                                 interleaved from all available
436                                 journals, including remote
437                                 ones.</para></listitem>
438                         </varlistentry>
439
440                         <varlistentry>
441                                 <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>┬▒offset</replaceable></optional></option></term>
442                                 <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>┬▒offset</replaceable></optional></option></term>
443
444                                 <listitem><para>Show messages from a specific
445                                 boot. This will add a match for
446                                 <literal>_BOOT_ID=</literal>.</para>
447
448                                 <para>The argument may be empty, in which case
449                                 logs for the current boot will be shown.</para>
450
451                                 <para>If the boot ID is omitted, a positive
452                                 <replaceable>offset</replaceable> will look up
453                                 the boots starting from the beginning of the
454                                 journal, and a equal-or-less-than zero
455                                 <replaceable>offset</replaceable> will look up
456                                 boots starting from the end of the
457                                 journal. Thus, <constant>1</constant> means the
458                                 first boot found in the journal in
459                                 chronological order, <constant>2</constant> the
460                                 second and so on; while <constant>-0</constant>
461                                 is the last boot, <constant>-1</constant> the
462                                 boot before last, and so on. An empty
463                                 <replaceable>offset</replaceable> is equivalent
464                                 to specifying <constant>-0</constant>, except
465                                 when the current boot is not the last boot
466                                 (e.g. because <option>--directory</option> was
467                                 specified to look at logs from a different
468                                 machine).</para>
469
470                                 <para>If the 32-character
471                                 <replaceable>ID</replaceable> is specified, it
472                                 may optionally be followed by
473                                 <replaceable>offset</replaceable> which
474                                 identifies the boot relative to the one given by
475                                 boot <replaceable>ID</replaceable>. Negative
476                                 values mean earlier boots and a positive values
477                                 mean later boots. If
478                                 <replaceable>offset</replaceable> is not
479                                 specified, a value of zero is assumed, and the
480                                 logs for the boot given by
481                                 <replaceable>ID</replaceable> are shown.
482                                 </para>
483
484                                 </listitem>
485                         </varlistentry>
486
487                         <varlistentry>
488                                 <term><option>--list-boots</option></term>
489
490                                 <listitem><para>Show a tabular list of
491                                 boot numbers (relative to the current
492                                 boot), their IDs, and the timestamps
493                                 of the first and last message
494                                 pertaining to the boot.
495                                 </para></listitem>
496                         </varlistentry>
497
498                         <varlistentry>
499                                 <term><option>-k</option></term>
500                                 <term><option>--dmesg</option></term>
501
502                                 <listitem><para>Show only kernel messages. This
503                                 implies <option>-b</option> and adds the match
504                                 <literal>_TRANSPORT=kernel</literal>.
505                                 </para></listitem>
506                         </varlistentry>
507
508                         <varlistentry>
509                                 <term><option>-t</option></term>
510                                 <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable>|<replaceable>PATTERN</replaceable></option></term>
511
512                                 <listitem><para>Show messages for the
513                                 specified syslog identifier
514                                 <replaceable>SYSLOG_IDENTIFIER</replaceable>, or
515                                 for any of the messages with a <literal>SYSLOG_IDENTIFIER</literal>
516                                 matched by <replaceable>PATTERN</replaceable>.</para>
517
518                                 <para>This parameter can be specified
519                                 multiple times.</para></listitem>
520                         </varlistentry>
521
522                         <varlistentry>
523                                 <term><option>-u</option></term>
524                                 <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
525
526                                 <listitem><para>Show messages for the
527                                 specified systemd unit
528                                 <replaceable>UNIT</replaceable> (such
529                                 as a service unit), or for any of the
530                                 units matched by
531                                 <replaceable>PATTERN</replaceable>.
532                                 If a pattern is specified, a list of
533                                 unit names found in the journal is
534                                 compared with the specified pattern
535                                 and all that match are used. For each
536                                 unit name, a match is added for
537                                 messages from the unit
538                                 (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
539                                 along with additional matches for
540                                 messages from systemd and messages
541                                 about coredumps for the specified
542                                 unit.</para>
543
544                                 <para>This parameter can be specified
545                                 multiple times.</para></listitem>
546                         </varlistentry>
547
548                         <varlistentry>
549                                 <term><option>--user-unit=</option></term>
550
551                                 <listitem><para>Show messages for the
552                                 specified user session unit. This will
553                                 add a match for messages from the unit
554                                 (<literal>_SYSTEMD_USER_UNIT=</literal>
555                                 and <literal>_UID=</literal>) and
556                                 additional matches for messages from
557                                 session systemd and messages about
558                                 coredumps for the specified unit.</para>
559                                 <para>This parameter can be specified multiple times.
560                                 </para></listitem>
561                         </varlistentry>
562
563                         <varlistentry>
564                                 <term><option>-p</option></term>
565                                 <term><option>--priority=</option></term>
566
567                                 <listitem><para>Filter output by
568                                 message priorities or priority
569                                 ranges. Takes either a single numeric
570                                 or textual log level (i.e. between
571                                 0/<literal>emerg</literal> and
572                                 7/<literal>debug</literal>), or a
573                                 range of numeric/text log levels in
574                                 the form FROM..TO. The log levels are
575                                 the usual syslog log levels as
576                                 documented in
577                                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
578                                 i.e. <literal>emerg</literal> (0),
579                                 <literal>alert</literal> (1),
580                                 <literal>crit</literal> (2),
581                                 <literal>err</literal> (3),
582                                 <literal>warning</literal> (4),
583                                 <literal>notice</literal> (5),
584                                 <literal>info</literal> (6),
585                                 <literal>debug</literal> (7). If a
586                                 single log level is specified, all
587                                 messages with this log level or a
588                                 lower (hence more important) log level
589                                 are shown. If a range is specified, all
590                                 messages within the range are shown,
591                                 including both the start and the end
592                                 value of the range. This will add
593                                 <literal>PRIORITY=</literal> matches
594                                 for the specified
595                                 priorities.</para></listitem>
596                         </varlistentry>
597
598                         <varlistentry>
599                                 <term><option>-c</option></term>
600                                 <term><option>--cursor=</option></term>
601
602                                 <listitem><para>Start showing entries
603                                 from the location in the journal
604                                 specified by the passed
605                                 cursor.</para></listitem>
606                         </varlistentry>
607
608                         <varlistentry>
609                                 <term><option>--after-cursor=</option></term>
610
611                                 <listitem><para>Start showing entries
612                                 from the location in the journal
613                                 <emphasis>after</emphasis> the
614                                 location specified by the this cursor.
615                                 The cursor is shown when the
616                                 <option>--show-cursor</option> option
617                                 is used.</para></listitem>
618                         </varlistentry>
619
620                         <varlistentry>
621                                 <term><option>--show-cursor</option></term>
622
623                                 <listitem><para>The cursor is shown after the last
624                                 entry after two dashes:</para>
625                                 <programlisting>-- cursor: s=0639...</programlisting>
626                                 <para>The format of the cursor is private
627                                 and subject to change.</para></listitem>
628                         </varlistentry>
629
630                         <varlistentry>
631                                 <term><option>--since=</option></term>
632                                 <term><option>--until=</option></term>
633
634                                 <listitem><para>Start showing entries
635                                 on or newer than the specified date,
636                                 or on or older than the specified
637                                 date, respectively. Date specifications
638                                 should be of the format
639                                 <literal>2012-10-30 18:17:16</literal>.
640                                 If the time part is omitted,
641                                 <literal>00:00:00</literal> is assumed.
642                                 If only the seconds component is omitted,
643                                 <literal>:00</literal> is assumed. If the
644                                 date component is omitted, the current
645                                 day is assumed. Alternatively the strings
646                                 <literal>yesterday</literal>,
647                                 <literal>today</literal>,
648                                 <literal>tomorrow</literal> are
649                                 understood, which refer to 00:00:00 of
650                                 the day before the current day, the
651                                 current day, or the day after the
652                                 current day, respectively. <literal>now</literal>
653                                 refers to the current time. Finally,
654                                 relative times may be specified,
655                                 prefixed with <literal>-</literal> or
656                                 <literal>+</literal>, referring to
657                                 times before or after the current
658                                 time, respectively.</para></listitem>
659                         </varlistentry>
660
661                         <varlistentry>
662                                 <term><option>-F</option></term>
663                                 <term><option>--field=</option></term>
664
665                                 <listitem><para>Print all possible
666                                 data values the specified field can
667                                 take in all entries of the
668                                 journal.</para></listitem>
669                         </varlistentry>
670
671                         <varlistentry>
672                                 <term><option>--system</option></term>
673                                 <term><option>--user</option></term>
674
675                                 <listitem><para>Show messages from
676                                 system services and the kernel (with
677                                 <option>--system</option>). Show
678                                 messages from service of current user
679                                 (with <option>--user</option>).
680                                 If neither is specified, show all
681                                 messages that the user can see.
682                                 </para></listitem>
683                         </varlistentry>
684
685                         <varlistentry>
686                                 <term><option>-M</option></term>
687                                 <term><option>--machine=</option></term>
688
689                                 <listitem><para>Show messages from a
690                                 running, local container. Specify a
691                                 container name to connect
692                                 to.</para></listitem>
693                         </varlistentry>
694
695                         <varlistentry>
696                                 <term><option>-D <replaceable>DIR</replaceable></option></term>
697                                 <term><option>--directory=<replaceable>DIR</replaceable></option></term>
698
699                                 <listitem><para>Takes a directory path
700                                 as argument. If specified, journalctl
701                                 will operate on the specified journal
702                                 directory
703                                 <replaceable>DIR</replaceable> instead
704                                 of the default runtime and system
705                                 journal paths.</para></listitem>
706                         </varlistentry>
707
708                         <varlistentry>
709                                 <term><option>--file=<replaceable>GLOB</replaceable></option></term>
710
711                                 <listitem><para>Takes a file glob as an
712                                 argument. If specified, journalctl will
713                                 operate on the specified journal files
714                                 matching <replaceable>GLOB</replaceable>
715                                 instead of the default runtime and
716                                 system journal paths. May be specified
717                                 multiple times, in which case files will
718                                 be suitably interleaved.</para></listitem>
719                         </varlistentry>
720
721                         <varlistentry>
722                                 <term><option>--root=<replaceable>ROOT</replaceable></option></term>
723
724                                 <listitem><para>Takes a directory path
725                                 as an argument. If specified, journalctl
726                                 will operate on catalog file hierarchy
727                                 underneath the specified directory
728                                 instead of the root directory
729                                 (e.g. <option>--update-catalog</option>
730                                 will create
731                                 <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).
732                                 </para></listitem>
733                         </varlistentry>
734
735                         <varlistentry>
736                                 <term><option>--new-id128</option></term>
737
738                                 <listitem><para>Instead of showing
739                                 journal contents, generate a new 128-bit
740                                 ID suitable for identifying
741                                 messages. This is intended for usage
742                                 by developers who need a new
743                                 identifier for a new message they
744                                 introduce and want to make
745                                 recognizable. This will print the new ID in
746                                 three different formats which can be
747                                 copied into source code or
748                                 similar.</para></listitem>
749                         </varlistentry>
750
751                         <varlistentry>
752                                 <term><option>--header</option></term>
753
754                                 <listitem><para>Instead of showing
755                                 journal contents, show internal header
756                                 information of the journal fields
757                                 accessed.</para></listitem>
758                         </varlistentry>
759
760                         <varlistentry>
761                                 <term><option>--disk-usage</option></term>
762
763                                 <listitem><para>Shows the current disk
764                                 usage of all journal files. This shows
765                                 the sum of the disk usage of all
766                                 archived and active journal
767                                 files.</para></listitem>
768                         </varlistentry>
769
770                         <varlistentry>
771                                 <term><option>--vacuum-size=</option></term>
772                                 <term><option>--vacuum-time=</option></term>
773
774                                 <listitem><para>Removes archived
775                                 journal files until the disk space
776                                 they use falls below the specified
777                                 size (specified with the usual K, M,
778                                 G, T suffixes), or all journal files
779                                 contain no data older than the
780                                 specified timespan (specified with the
781                                 usual s, min, h, days, months, weeks,
782                                 years suffixes). Note that running
783                                 <option>--vacuum-size=</option> has
784                                 only indirect effect on the output
785                                 shown by <option>--disk-usage</option>
786                                 as the latter includes active journal
787                                 files, while the former only operates
788                                 on archived journal
789                                 files. <option>--vacuum-size=</option>
790                                 and <option>--vacuum-time=</option>
791                                 may be combined in a single invocation
792                                 to enforce both a size and time limit
793                                 on the archived journal
794                                 files.</para></listitem>
795                         </varlistentry>
796
797                         <varlistentry>
798                                 <term><option>--list-catalog
799                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
800                                 </option></term>
801
802                                 <listitem><para>List the contents of
803                                 the message catalog as a table of
804                                 message IDs, plus their short
805                                 description strings.</para>
806
807                                 <para>If any
808                                 <replaceable>128-bit-ID</replaceable>s are
809                                 specified, only those entries are shown.
810                                 </para>
811                                 </listitem>
812                         </varlistentry>
813
814                         <varlistentry>
815                                 <term><option>--dump-catalog
816                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
817                                 </option></term>
818
819                                 <listitem><para>Show the contents of
820                                 the message catalog, with entries
821                                 separated by a line consisting of two
822                                 dashes and the ID (the format is the
823                                 same as <filename>.catalog</filename>
824                                 files).</para>
825
826                                 <para>If any
827                                 <replaceable>128-bit-ID</replaceable>s are
828                                 specified, only those entries are shown.
829                                 </para>
830                                 </listitem>
831                         </varlistentry>
832
833                         <varlistentry>
834                                 <term><option>--update-catalog</option></term>
835
836                                 <listitem><para>Update the message
837                                 catalog index. This command needs to
838                                 be executed each time new catalog
839                                 files are installed, removed, or
840                                 updated to rebuild the binary catalog
841                                 index.</para></listitem>
842                         </varlistentry>
843
844                         <varlistentry>
845                                 <term><option>--setup-keys</option></term>
846
847                                 <listitem><para>Instead of showing
848                                 journal contents, generate a new key
849                                 pair for Forward Secure Sealing
850                                 (FSS). This will generate a sealing
851                                 key and a verification key. The
852                                 sealing key is stored in the journal
853                                 data directory and shall remain on the
854                                 host. The verification key should be
855                                 stored externally. Refer to the
856                                 <option>Seal=</option> option in
857                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
858                                 for information on Forward Secure
859                                 Sealing and for a link to a refereed
860                                 scholarly paper detailing the
861                                 cryptographic theory it is based on.
862                                 </para></listitem>
863                         </varlistentry>
864
865                         <varlistentry>
866                                 <term><option>--force</option></term>
867
868                                 <listitem><para>When
869                                 <option>--setup-keys</option> is passed and
870                                 Forward Secure Sealing (FSS) has already been
871                                 configured, recreate FSS keys.</para></listitem>
872                         </varlistentry>
873
874                         <varlistentry>
875                                 <term><option>--interval=</option></term>
876
877                                 <listitem><para>Specifies the change
878                                 interval for the sealing key when
879                                 generating an FSS key pair with
880                                 <option>--setup-keys</option>. Shorter
881                                 intervals increase CPU consumption but
882                                 shorten the time range of
883                                 undetectable journal
884                                 alterations. Defaults to
885                                 15min.</para></listitem>
886                         </varlistentry>
887
888                         <varlistentry>
889                                 <term><option>--verify</option></term>
890
891                                 <listitem><para>Check the journal file
892                                 for internal consistency. If the
893                                 file has been generated with FSS
894                                 enabled and the FSS verification key
895                                 has been specified with
896                                 <option>--verify-key=</option>,
897                                 authenticity of the journal file is
898                                 verified.</para></listitem>
899                         </varlistentry>
900
901                         <varlistentry>
902                                 <term><option>--verify-key=</option></term>
903
904                                 <listitem><para>Specifies the FSS
905                                 verification key to use for the
906                                 <option>--verify</option>
907                                 operation.</para></listitem>
908                         </varlistentry>
909
910                         <varlistentry>
911                                 <term><option>--flush</option></term>
912
913                                 <listitem><para>Asks the Journal
914                                 daemon to flush any log data stored in
915                                 <filename>/run/log/journal</filename>
916                                 into
917                                 <filename>/var/log/journal</filename>,
918                                 if persistent storage is enabled. This
919                                 call does not return until the
920                                 operation is
921                                 complete.</para></listitem>
922                         </varlistentry>
923
924                         <xi:include href="standard-options.xml" xpointer="help" />
925                         <xi:include href="standard-options.xml" xpointer="version" />
926                         <xi:include href="standard-options.xml" xpointer="no-pager" />
927                 </variablelist>
928         </refsect1>
929
930         <refsect1>
931                 <title>Exit status</title>
932
933                 <para>On success, 0 is returned; otherwise, a non-zero
934                 failure code is returned.</para>
935         </refsect1>
936
937         <xi:include href="less-variables.xml" />
938
939         <refsect1>
940                 <title>Examples</title>
941
942                 <para>Without arguments, all collected logs are shown
943                 unfiltered:</para>
944
945                 <programlisting>journalctl</programlisting>
946
947                 <para>With one match specified, all entries with a field matching the expression are shown:</para>
948
949                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
950
951                 <para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>
952
953                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
954
955                 <para>If two matches refer to the same field, all entries matching either expression are shown:</para>
956
957                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
958
959                 <para>If the separator <literal>+</literal> is used,
960                 two expressions may be combined in a logical OR. The
961                 following will show all messages from the Avahi
962                 service process with the PID 28097 plus all messages
963                 from the D-Bus service (from any of its
964                 processes):</para>
965
966                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
967
968                 <para>Show all logs generated by the D-Bus executable:</para>
969
970                 <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
971
972                 <para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>
973
974                 <programlisting>journalctl /dev/sda</programlisting>
975
976                 <para>Show all kernel logs from previous boot:</para>
977
978                 <programlisting>journalctl -k -b -1</programlisting>
979
980                 <para>Show a live log display from a system service <filename>apache.service</filename>:</para>
981
982                 <programlisting>journalctl -f -u apache</programlisting>
983
984         </refsect1>
985
986         <refsect1>
987                 <title>See Also</title>
988                 <para>
989                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
990                         <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
991                         <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
992                         <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
993                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
994                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
995                 </para>
996         </refsect1>
997
998 </refentry>