man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2012 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="journalctl"
  25           xmlns:xi="http://www.w3.org/2001/XInclude">
  26
  27         <refentryinfo>
  28                 <title>journalctl</title>
  29                 <productname>systemd</productname>
  30
  31                 <authorgroup>
  32                         <author>
  33                                 <contrib>Developer</contrib>
  34                                 <firstname>Lennart</firstname>
  35                                 <surname>Poettering</surname>
  36                                 <email>lennart@poettering.net</email>
  37                         </author>
  38                 </authorgroup>
  39         </refentryinfo>
  40
  41         <refmeta>
  42                 <refentrytitle>journalctl</refentrytitle>
  43                 <manvolnum>1</manvolnum>
  44         </refmeta>
  45
  46         <refnamediv>
  47                 <refname>journalctl</refname>
  48                 <refpurpose>Query the systemd journal</refpurpose>
  49         </refnamediv>
  50
  51         <refsynopsisdiv>
  52                 <cmdsynopsis>
  53                         <command>journalctl</command>
  54                         <arg choice="opt" rep="repeat">OPTIONS</arg>
  55                         <arg choice="opt" rep="repeat">MATCHES</arg>
  56                 </cmdsynopsis>
  57         </refsynopsisdiv>
  58
  59         <refsect1>
  60                 <title>Description</title>
  61
  62                 <para><command>journalctl</command> may be used to
  63                 query the contents of the
  64                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  65                 journal as written by
  66                 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  67
  68                 <para>If called without parameters, it will show the full
  69                 contents of the journal, starting with the oldest
  70                 entry collected.</para>
  71
  72                 <para>If one or more match arguments are passed, the
  73                 output is filtered accordingly. A match is in the
  74                 format <literal>FIELD=VALUE</literal>,
  75                 e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
  76                 referring to the components of a structured journal
  77                 entry. See
  78                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  79                 for a list of well-known fields. If multiple matches
  80                 are specified matching different fields, the log
  81                 entries are filtered by both, i.e. the resulting output
  82                 will show only entries matching all the specified
  83                 matches of this kind. If two matches apply to the same
  84                 field, then they are automatically matched as
  85                 alternatives, i.e. the resulting output will show
  86                 entries matching any of the specified matches for the
  87                 same field. Finally, if the character
  88                 <literal>+</literal> appears as a separate word on the
  89                 command line, all matches before and after are combined
  90                 in a disjunction (i.e. logical OR).</para>
  91
  92                 <para>As shortcuts for a few types of field/value
  93                 matches, file paths may be specified. If a file path
  94                 refers to an executable file, this is equivalent to an
  95                 <literal>_EXE=</literal> match for the canonicalized
  96                 binary path. Similarly, if a path refers to a device
  97                 node, this is equivalent to a
  98                 <literal>_KERNEL_DEVICE=</literal> match for the
  99                 device.</para>
 100
 101                 <para>Output is interleaved from all accessible
 102                 journal files, whether they are rotated or currently
 103                 being written, and regardless of whether they belong to the
 104                 system itself or are accessible user journals.</para>
 105
 106                 <para>All users are granted access to their private
 107                 per-user journals. However, by default, only root and
 108                 users who are members of the <literal>systemd-journal</literal>
 109                 group get access to the system journal and the
 110                 journals of other users.</para>
 111
 112                 <para>The output is paged through
 113                 <command>less</command> by default, and long lines are
 114                 "truncated" to screen width. The hidden part can be
 115                 viewed by using the left-arrow and right-arrow
 116                 keys. Paging can be disabled; see the
 117                 <option>--no-pager</option> option and the "Environment"
 118                 section below.</para>
 119
 120                 <para>When outputing to a tty, lines are colored
 121                 according to priority: lines of level ERROR and higher
 122                 are colored red; lines of level NOTICE and higher are
 123                 highlighted; other lines are displayed normally.
 124                 </para>
 125         </refsect1>
 126
 127         <refsect1>
 128                 <title>Options</title>
 129
 130                 <para>The following options are understood:</para>
 131
 132                 <variablelist>
 133                         <varlistentry>
 134                                 <term><option>--no-full</option></term>
 135                                 <term><option>--full</option></term>
 136                                 <term><option>-l</option></term>
 137
 138                                 <listitem><para>Ellipsize fields when
 139                                 they do not fit in available columns.
 140                                 The default is to show full fields,
 141                                 allowing them to wrap or be truncated
 142                                 by the pager, if one is used.</para>
 143
 144                                 <para>The old options
 145                                 <option>-l</option>/<option>--full</option>
 146                                 are not useful anymore, except to undo
 147                                 <option>--no-full</option>.</para></listitem>
 148                         </varlistentry>
 149
 150                         <varlistentry>
 151                                 <term><option>-a</option></term>
 152                                 <term><option>--all</option></term>
 153
 154                                 <listitem><para>Show all fields in
 155                                 full, even if they include unprintable
 156                                 characters or are very
 157                                 long.</para></listitem>
 158                         </varlistentry>
 159
 160                         <varlistentry>
 161                                 <term><option>-f</option></term>
 162                                 <term><option>--follow</option></term>
 163
 164                                 <listitem><para>Show only the most recent
 165                                 journal entries, and continuously print
 166                                 new entries as they are appended to
 167                                 the journal.</para></listitem>
 168                         </varlistentry>
 169
 170                         <varlistentry>
 171                                 <term><option>-e</option></term>
 172                                 <term><option>--pager-end</option></term>
 173
 174                                 <listitem><para>Immediately jump to
 175                                 the end of the journal inside the
 176                                 implied pager tool. This implies
 177                                 <option>-n1000</option> to guarantee
 178                                 that the pager will not buffer logs of
 179                                 unbounded size. This may be overridden
 180                                 with an explicit <option>-n</option>
 181                                 with some other numeric value on the
 182                                 command line. Note that this option is
 183                                 only supported for the
 184                                 <citerefentry><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 185                                 pager.</para></listitem>
 186                         </varlistentry>
 187
 188                         <varlistentry>
 189                                 <term><option>-n</option></term>
 190                                 <term><option>--lines=</option></term>
 191
 192                                 <listitem><para>Show the most recent
 193                                 journal events and limit the number of
 194                                 events shown. If
 195                                 <option>--follow</option> is used,
 196                                 this option is implied. The argument,
 197                                 a positive integer, is optional, and
 198                                 defaults to 10. </para></listitem>
 199                         </varlistentry>
 200
 201                         <varlistentry>
 202                                 <term><option>--no-tail</option></term>
 203
 204                                 <listitem><para>Show all stored output
 205                                 lines, even in follow mode. Undoes the
 206                                 effect of
 207                                 <option>--lines=</option>.</para></listitem>
 208                         </varlistentry>
 209
 210                         <varlistentry>
 211                                 <term><option>-r</option></term>
 212                                 <term><option>--reverse</option></term>
 213
 214                                 <listitem><para>Reverse output so that the newest
 215                                 entries are displayed first.</para></listitem>
 216                         </varlistentry>
 217
 218                         <varlistentry>
 219                                 <term><option>-o</option></term>
 220                                 <term><option>--output=</option></term>
 221
 222                                 <listitem><para>Controls the
 223                                 formatting of the journal entries that
 224                                 are shown. Takes one of the following options:
 225                                 </para>
 226                                 <variablelist>
 227                                         <varlistentry>
 228                                                 <term>
 229                                                         <option>short</option>
 230                                                 </term>
 231                                                 <listitem>
 232                                                         <para>is the default
 233                                                         and generates an output
 234                                                         that is mostly identical
 235                                                         to the formatting of
 236                                                         classic syslog files,
 237                                                         showing one line per
 238                                                         journal entry.</para>
 239                                                 </listitem>
 240                                         </varlistentry>
 241
 242                                         <varlistentry>
 243                                                 <term>
 244                                                         <option>short-iso</option>
 245                                                 </term>
 246                                                 <listitem>
 247                                                         <para>is very similar,
 248                                                         but shows ISO 8601
 249                                                         wallclock timestamps.
 250                                                         </para>
 251                                                 </listitem>
 252                                         </varlistentry>
 253
 254                                         <varlistentry>
 255                                                 <term>
 256                                                         <option>short-precise</option>
 257                                                 </term>
 258                                                 <listitem>
 259                                                         <para>is very similar,
 260                                                         but shows timestamps
 261                                                         with full microsecond
 262                                                         precision.
 263                                                         </para>
 264                                                 </listitem>
 265                                         </varlistentry>
 266
 267                                         <varlistentry>
 268                                                 <term>
 269                                                         <option>short-monotonic</option>
 270                                                 </term>
 271                                                 <listitem>
 272                                                         <para>is very similar,
 273                                                         but shows monotonic
 274                                                         timestamps instead of
 275                                                         wallclock timestamps.
 276                                                         </para>
 277                                                 </listitem>
 278                                         </varlistentry>
 279
 280                                         <varlistentry>
 281                                                 <term>
 282                                                         <option>verbose</option>
 283                                                 </term>
 284                                                 <listitem>
 285                                                         <para>shows the
 286                                                         full-structured entry
 287                                                         items with all fields.
 288                                                         </para>
 289                                                 </listitem>
 290                                         </varlistentry>
 291
 292                                         <varlistentry>
 293                                                 <term>
 294                                                         <option>export</option>
 295                                                 </term>
 296                                                 <listitem>
 297                                                         <para>serializes the
 298                                                         journal into a binary
 299                                                         (but mostly text-based)
 300                                                         stream suitable for
 301                                                         backups and network
 302                                                         transfer (see <ulink
 303                                                         url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
 304                                                         Export Format</ulink>
 305                                                         for more
 306                                                         information).</para>
 307                                                 </listitem>
 308                                         </varlistentry>
 309
 310                                         <varlistentry>
 311                                                 <term>
 312                                                         <option>json</option>
 313                                                 </term>
 314                                                 <listitem>
 315                                                         <para>formats entries
 316                                                         as JSON data structures,
 317                                                         one per line (see <ulink
 318                                                         url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
 319                                                         JSON Format</ulink> for
 320                                                         more information).</para>
 321                                                 </listitem>
 322                                         </varlistentry>
 323
 324                                         <varlistentry>
 325                                                 <term>
 326                                                         <option>json-pretty</option>
 327                                                 </term>
 328                                                 <listitem>
 329                                                         <para>formats entries as
 330                                                         JSON data structures,
 331                                                         but formats them in
 332                                                         multiple lines in order
 333                                                         to make them more
 334                                                         readable by humans.</para>
 335                                                 </listitem>
 336                                         </varlistentry>
 337
 338                                         <varlistentry>
 339                                                 <term>
 340                                                         <option>json-sse</option>
 341                                                 </term>
 342                                                 <listitem>
 343                                                         <para>formats entries as
 344                                                         JSON data structures,
 345                                                         but wraps them in a
 346                                                         format suitable for <ulink
 347                                                         url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
 348                                                         Events</ulink>.</para>
 349                                                 </listitem>
 350                                         </varlistentry>
 351
 352                                         <varlistentry>
 353                                                 <term>
 354                                                         <option>cat</option>
 355                                                 </term>
 356                                                 <listitem>
 357                                                         <para>generates a very
 358                                                         terse output, only
 359                                                         showing the actual
 360                                                         message of each journal
 361                                                         entry with no metadata,
 362                                                         not even a timestamp.
 363                                                         </para>
 364                                                 </listitem>
 365                                         </varlistentry>
 366                                 </variablelist>
 367                                 </listitem>
 368                         </varlistentry>
 369
 370                         <varlistentry>
 371                                 <term><option>-x</option></term>
 372                                 <term><option>--catalog</option></term>
 373
 374                                 <listitem><para>Augment log lines with
 375                                 explanation texts from the message
 376                                 catalog. This will add explanatory
 377                                 help texts to log messages in the
 378                                 output where this is available. These
 379                                 short help texts will explain the
 380                                 context of an error or log event,
 381                                 possible solutions, as well as
 382                                 pointers to support forums, developer
 383                                 documentation, and any other relevant
 384                                 manuals. Note that help texts are not
 385                                 available for all messages, but only
 386                                 for selected ones. For more
 387                                 information on the message catalog,
 388                                 please refer to the <ulink
 389                                 url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
 390                                 Catalog Developer
 391                                 Documentation</ulink>.</para>
 392
 393                                 <para>Note: when attaching
 394                                 <command>journalctl</command> output
 395                                 to bug reports, please do
 396                                 <emphasis>not</emphasis> use
 397                                 <option>-x</option>.</para>
 398                                 </listitem>
 399                         </varlistentry>
 400
 401                         <varlistentry>
 402                                 <term><option>-q</option></term>
 403                                 <term><option>--quiet</option></term>
 404
 405                                 <listitem><para>Suppresses any warning
 406                                 messages regarding inaccessible system
 407                                 journals when run as a normal
 408                                 user.</para></listitem>
 409                         </varlistentry>
 410
 411                         <varlistentry>
 412                                 <term><option>-m</option></term>
 413                                 <term><option>--merge</option></term>
 414
 415                                 <listitem><para>Show entries
 416                                 interleaved from all available
 417                                 journals, including remote
 418                                 ones.</para></listitem>
 419                         </varlistentry>
 420
 421                         <varlistentry>
 422                                 <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 423                                 <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 424
 425                                 <listitem><para>Show messages from a specific
 426                                 boot. This will add a match for
 427                                 <literal>_BOOT_ID=</literal>.</para>
 428
 429                                 <para>The argument may be empty, in which case
 430                                 logs for the current boot will be shown.</para>
 431
 432                                 <para>If the boot ID is omitted, a positive
 433                                 <replaceable>offset</replaceable> will look up
 434                                 the boots starting from the beginning of the
 435                                 journal, and a equal-or-less-than zero
 436                                 <replaceable>offset</replaceable> will look up
 437                                 boots starting from the end of the
 438                                 journal. Thus, <constant>1</constant> means the
 439                                 first boot found in the journal in
 440                                 chronological order, <constant>2</constant> the
 441                                 second and so on; while <constant>-0</constant>
 442                                 is the last boot, <constant>-1</constant> the
 443                                 boot before last, and so on. An empty
 444                                 <replaceable>offset</replaceable> is equivalent
 445                                 to specifying <constant>-0</constant>, except
 446                                 when the current boot is not the last boot
 447                                 (e.g. because <option>--directory</option> was
 448                                 specified to look at logs from a different
 449                                 machine).</para>
 450
 451                                 <para>If the 32-character
 452                                 <replaceable>ID</replaceable> is specified, it
 453                                 may optionally be followed by
 454                                 <replaceable>offset</replaceable> which
 455                                 identifies the boot relative to the one given by
 456                                 boot <replaceable>ID</replaceable>. Negative
 457                                 values mean earlier boots and a positive values
 458                                 mean later boots. If
 459                                 <replaceable>offset</replaceable> is not
 460                                 specified, a value of zero is assumed, and the
 461                                 logs for the boot given by
 462                                 <replaceable>ID</replaceable> are shown.
 463                                 </para>
 464
 465                                 </listitem>
 466                         </varlistentry>
 467
 468                         <varlistentry>
 469                                 <term><option>--list-boots</option></term>
 470
 471                                 <listitem><para>Show a tabular list of
 472                                 boot numbers (relative to the current
 473                                 boot), their IDs, and the timestamps
 474                                 of the first and last message
 475                                 pertaining to the boot.
 476                                 </para></listitem>
 477                         </varlistentry>
 478
 479                         <varlistentry>
 480                                 <term><option>-k</option></term>
 481                                 <term><option>--dmesg</option></term>
 482
 483                                 <listitem><para>Show only kernel messages. This
 484                                 implies <option>-b</option> and adds the match
 485                                 <literal>_TRANSPORT=kernel</literal>.
 486                                 </para></listitem>
 487                         </varlistentry>
 488
 489                         <varlistentry>
 490                                 <term><option>-u</option></term>
 491                                 <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 492
 493                                 <listitem><para>Show messages for the
 494                                 specified systemd unit
 495                                 <replaceable>UNIT</replaceable>, or
 496                                 for any of the units matched by
 497                                 <replaceable>PATTERN</replaceable>.
 498                                 If a pattern is specified, a list of
 499                                 unit names found in the journal is
 500                                 compared with the specified pattern
 501                                 and all that match are used. For each
 502                                 unit name, a match is added for
 503                                 messages from the unit
 504                                 (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 505                                 along with additional matches for
 506                                 messages from systemd and messages
 507                                 about coredumps for the specified
 508                                 unit.</para>
 509
 510                                 <para>This parameter can be specified
 511                                 multiple times.</para></listitem>
 512                         </varlistentry>
 513
 514                         <varlistentry>
 515                                 <term><option>--user-unit=</option></term>
 516
 517                                 <listitem><para>Show messages for the
 518                                 specified user session unit. This will
 519                                 add a match for messages from the unit
 520                                 (<literal>_SYSTEMD_USER_UNIT=</literal>
 521                                 and <literal>_UID=</literal>) and
 522                                 additional matches for messages from
 523                                 session systemd and messages about
 524                                 coredumps for the specified unit.</para>
 525                                 <para>This parameter can be specified multiple times.
 526                                 </para></listitem>
 527                         </varlistentry>
 528
 529                         <varlistentry>
 530                                 <term><option>-p</option></term>
 531                                 <term><option>--priority=</option></term>
 532
 533                                 <listitem><para>Filter output by
 534                                 message priorities or priority
 535                                 ranges. Takes either a single numeric
 536                                 or textual log level (i.e. between
 537                                 0/<literal>emerg</literal> and
 538                                 7/<literal>debug</literal>), or a
 539                                 range of numeric/text log levels in
 540                                 the form FROM..TO. The log levels are
 541                                 the usual syslog log levels as
 542                                 documented in
 543                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 544                                 i.e. <literal>emerg</literal> (0),
 545                                 <literal>alert</literal> (1),
 546                                 <literal>crit</literal> (2),
 547                                 <literal>err</literal> (3),
 548                                 <literal>warning</literal> (4),
 549                                 <literal>notice</literal> (5),
 550                                 <literal>info</literal> (6),
 551                                 <literal>debug</literal> (7). If a
 552                                 single log level is specified, all
 553                                 messages with this log level or a
 554                                 lower (hence more important) log level
 555                                 are shown. If a range is specified, all
 556                                 messages within the range are shown,
 557                                 including both the start and the end
 558                                 value of the range. This will add
 559                                 <literal>PRIORITY=</literal> matches
 560                                 for the specified
 561                                 priorities.</para></listitem>
 562                         </varlistentry>
 563
 564                         <varlistentry>
 565                                 <term><option>-c</option></term>
 566                                 <term><option>--cursor=</option></term>
 567
 568                                 <listitem><para>Start showing entries
 569                                 from the location in the journal
 570                                 specified by the passed
 571                                 cursor.</para></listitem>
 572                         </varlistentry>
 573
 574                         <varlistentry>
 575                                 <term><option>--after-cursor=</option></term>
 576
 577                                 <listitem><para>Start showing entries
 578                                 from the location in the journal
 579                                 <emphasis>after</emphasis> the
 580                                 location specified by the this cursor.
 581                                 The cursor is shown when the
 582                                 <option>--show-cursor</option> option
 583                                 is used.</para></listitem>
 584                         </varlistentry>
 585
 586                         <varlistentry>
 587                                 <term><option>--show-cursor</option></term>
 588
 589                                 <listitem><para>The cursor is shown after the last
 590                                 entry after two dashes:</para>
 591                                 <programlisting>-- cursor: s=0639...</programlisting>
 592                                 <para>The format of the cursor is private
 593                                 and subject to change.</para></listitem>
 594                         </varlistentry>
 595
 596                         <varlistentry>
 597                                 <term><option>--since=</option></term>
 598                                 <term><option>--until=</option></term>
 599
 600                                 <listitem><para>Start showing entries
 601                                 on or newer than the specified date,
 602                                 or on or older than the specified
 603                                 date, respectively. Date specifications
 604                                 should be of the format
 605                                 <literal>2012-10-30 18:17:16</literal>.
 606                                 If the time part is omitted,
 607                                 <literal>00:00:00</literal> is assumed.
 608                                 If only the seconds component is omitted,
 609                                 <literal>:00</literal> is assumed. If the
 610                                 date component is omitted, the current
 611                                 day is assumed. Alternatively the strings
 612                                 <literal>yesterday</literal>,
 613                                 <literal>today</literal>,
 614                                 <literal>tomorrow</literal> are
 615                                 understood, which refer to 00:00:00 of
 616                                 the day before the current day, the
 617                                 current day, or the day after the
 618                                 current day, respectively. <literal>now</literal>
 619                                 refers to the current time. Finally,
 620                                 relative times may be specified,
 621                                 prefixed with <literal>-</literal> or
 622                                 <literal>+</literal>, referring to
 623                                 times before or after the current
 624                                 time, respectively.</para></listitem>
 625                         </varlistentry>
 626
 627                         <varlistentry>
 628                                 <term><option>-F</option></term>
 629                                 <term><option>--field=</option></term>
 630
 631                                 <listitem><para>Print all possible
 632                                 data values the specified field can
 633                                 take in all entries of the
 634                                 journal.</para></listitem>
 635                         </varlistentry>
 636
 637                         <varlistentry>
 638                                 <term><option>--system</option></term>
 639                                 <term><option>--user</option></term>
 640
 641                                 <listitem><para>Show messages from
 642                                 system services and the kernel (with
 643                                 <option>--system</option>). Show
 644                                 messages from service of current user
 645                                 (with <option>--user</option>).
 646                                 If neither is specified, show all
 647                                 messages that the user can see.
 648                                 </para></listitem>
 649                         </varlistentry>
 650
 651                         <varlistentry>
 652                                 <term><option>-M</option></term>
 653                                 <term><option>--machine=</option></term>
 654
 655                                 <listitem><para>Show messages from a
 656                                 running, local container. Specify a
 657                                 container name to connect
 658                                 to.</para></listitem>
 659                         </varlistentry>
 660
 661                         <varlistentry>
 662                                 <term><option>-D <replaceable>DIR</replaceable></option></term>
 663                                 <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 664
 665                                 <listitem><para>Takes a directory path
 666                                 as argument. If specified, journalctl
 667                                 will operate on the specified journal
 668                                 directory
 669                                 <replaceable>DIR</replaceable> instead
 670                                 of the default runtime and system
 671                                 journal paths.</para></listitem>
 672                         </varlistentry>
 673
 674                         <varlistentry>
 675                                 <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 676
 677                                 <listitem><para>Takes a file glob as an
 678                                 argument. If specified, journalctl will
 679                                 operate on the specified journal files
 680                                 matching <replaceable>GLOB</replaceable>
 681                                 instead of the default runtime and
 682                                 system journal paths. May be specified
 683                                 multiple times, in which case files will
 684                                 be suitably interleaved.</para></listitem>
 685                         </varlistentry>
 686
 687                         <varlistentry>
 688                                 <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 689
 690                                 <listitem><para>Takes a directory path
 691                                 as an argument. If specified, journalctl
 692                                 will operate on catalog file hierarchy
 693                                 underneath the specified directory
 694                                 instead of the root directory
 695                                 (e.g. <option>--update-catalog</option>
 696                                 will create
 697                                 <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).
 698                                 </para></listitem>
 699                         </varlistentry>
 700
 701                         <varlistentry>
 702                                 <term><option>--new-id128</option></term>
 703
 704                                 <listitem><para>Instead of showing
 705                                 journal contents, generate a new 128-bit
 706                                 ID suitable for identifying
 707                                 messages. This is intended for usage
 708                                 by developers who need a new
 709                                 identifier for a new message they
 710                                 introduce and want to make
 711                                 recognizable. This will print the new ID in
 712                                 three different formats which can be
 713                                 copied into source code or
 714                                 similar.</para></listitem>
 715                         </varlistentry>
 716
 717                         <varlistentry>
 718                                 <term><option>--header</option></term>
 719
 720                                 <listitem><para>Instead of showing
 721                                 journal contents, show internal header
 722                                 information of the journal fields
 723                                 accessed.</para></listitem>
 724                         </varlistentry>
 725
 726                         <varlistentry>
 727                                 <term><option>--disk-usage</option></term>
 728
 729                                 <listitem><para>Shows the current disk
 730                                 usage of all
 731                                 journal files.</para></listitem>
 732                         </varlistentry>
 733
 734                         <varlistentry>
 735                                 <term><option>--list-catalog
 736                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 737                                 </option></term>
 738
 739                                 <listitem><para>List the contents of
 740                                 the message catalog as a table of
 741                                 message IDs, plus their short
 742                                 description strings.</para>
 743
 744                                 <para>If any
 745                                 <replaceable>128-bit-ID</replaceable>s are
 746                                 specified, only those entries are shown.
 747                                 </para>
 748                                 </listitem>
 749                         </varlistentry>
 750
 751                         <varlistentry>
 752                                 <term><option>--dump-catalog
 753                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 754                                 </option></term>
 755
 756                                 <listitem><para>Show the contents of
 757                                 the message catalog, with entries
 758                                 separated by a line consisting of two
 759                                 dashes and the ID (the format is the
 760                                 same as <filename>.catalog</filename>
 761                                 files).</para>
 762
 763                                 <para>If any
 764                                 <replaceable>128-bit-ID</replaceable>s are
 765                                 specified, only those entries are shown.
 766                                 </para>
 767                                 </listitem>
 768                         </varlistentry>
 769
 770                         <varlistentry>
 771                                 <term><option>--update-catalog</option></term>
 772
 773                                 <listitem><para>Update the message
 774                                 catalog index. This command needs to
 775                                 be executed each time new catalog
 776                                 files are installed, removed, or
 777                                 updated to rebuild the binary catalog
 778                                 index.</para></listitem>
 779                         </varlistentry>
 780
 781                         <varlistentry>
 782                                 <term><option>--setup-keys</option></term>
 783
 784                                 <listitem><para>Instead of showing
 785                                 journal contents, generate a new key
 786                                 pair for Forward Secure Sealing
 787                                 (FSS). This will generate a sealing
 788                                 key and a verification key. The
 789                                 sealing key is stored in the journal
 790                                 data directory and shall remain on the
 791                                 host. The verification key should be
 792                                 stored externally. Refer to the
 793                                 <option>Seal=</option> option in
 794                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 795                                 for information on Forward Secure
 796                                 Sealing and for a link to a refereed
 797                                 scholarly paper detailing the
 798                                 cryptographic theory it is based on.
 799                                 </para></listitem>
 800                         </varlistentry>
 801
 802                         <varlistentry>
 803                                 <term><option>--force</option></term>
 804
 805                                 <listitem><para>When
 806                                 <option>--setup-keys</option> is passed and
 807                                 Forward Secure Sealing (FSS) has already been
 808                                 configured, recreate FSS keys.</para></listitem>
 809                         </varlistentry>
 810
 811                         <varlistentry>
 812                                 <term><option>--interval=</option></term>
 813
 814                                 <listitem><para>Specifies the change
 815                                 interval for the sealing key when
 816                                 generating an FSS key pair with
 817                                 <option>--setup-keys</option>. Shorter
 818                                 intervals increase CPU consumption but
 819                                 shorten the time range of
 820                                 undetectable journal
 821                                 alterations. Defaults to
 822                                 15min.</para></listitem>
 823                         </varlistentry>
 824
 825                         <varlistentry>
 826                                 <term><option>--verify</option></term>
 827
 828                                 <listitem><para>Check the journal file
 829                                 for internal consistency. If the
 830                                 file has been generated with FSS
 831                                 enabled and the FSS verification key
 832                                 has been specified with
 833                                 <option>--verify-key=</option>,
 834                                 authenticity of the journal file is
 835                                 verified.</para></listitem>
 836                         </varlistentry>
 837
 838                         <varlistentry>
 839                                 <term><option>--verify-key=</option></term>
 840
 841                                 <listitem><para>Specifies the FSS
 842                                 verification key to use for the
 843                                 <option>--verify</option>
 844                                 operation.</para></listitem>
 845                         </varlistentry>
 846
 847                         <xi:include href="standard-options.xml" xpointer="help" />
 848                         <xi:include href="standard-options.xml" xpointer="version" />
 849                         <xi:include href="standard-options.xml" xpointer="no-pager" />
 850                 </variablelist>
 851         </refsect1>
 852
 853         <refsect1>
 854                 <title>Exit status</title>
 855
 856                 <para>On success, 0 is returned; otherwise, a non-zero
 857                 failure code is returned.</para>
 858         </refsect1>
 859
 860         <xi:include href="less-variables.xml" />
 861
 862         <refsect1>
 863                 <title>Examples</title>
 864
 865                 <para>Without arguments, all collected logs are shown
 866                 unfiltered:</para>
 867
 868                 <programlisting>journalctl</programlisting>
 869
 870                 <para>With one match specified, all entries with a field matching the expression are shown:</para>
 871
 872                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
 873
 874                 <para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>
 875
 876                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 877
 878                 <para>If two matches refer to the same field, all entries matching either expression are shown:</para>
 879
 880                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 881
 882                 <para>If the separator <literal>+</literal> is used,
 883                 two expressions may be combined in a logical OR. The
 884                 following will show all messages from the Avahi
 885                 service process with the PID 28097 plus all messages
 886                 from the D-Bus service (from any of its
 887                 processes):</para>
 888
 889                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 890
 891                 <para>Show all logs generated by the D-Bus executable:</para>
 892
 893                 <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 894
 895                 <para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>
 896
 897                 <programlisting>journalctl /dev/sda</programlisting>
 898
 899                 <para>Show all kernel logs from previous boot:</para>
 900
 901                 <programlisting>journalctl -k -b -1</programlisting>
 902
 903         </refsect1>
 904
 905         <refsect1>
 906                 <title>See Also</title>
 907                 <para>
 908                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 909                         <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 910                         <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 911                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 912                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 913                 </para>
 914         </refsect1>
 915
 916 </refentry>