X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fjournalctl.xml;h=55474c53d9e198b9410a0721215970e4040951e1;hp=c4d2a7e0e8b2921b5b1609da4372c4e295ca2c04;hb=4cd1214db6cf4b262e8ce6381bc710091b375c96;hpb=169c4f65131fbc7bcb51e7d5487a715cdcd0e0eb diff --git a/man/journalctl.xml b/man/journalctl.xml index c4d2a7e0e..55474c53d 100644 --- a/man/journalctl.xml +++ b/man/journalctl.xml @@ -8,16 +8,16 @@ Copyright 2012 Lennart Poettering systemd is free software; you can redistribute it and/or modify it - under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. systemd is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - General Public License for more details. + Lesser General Public License for more details. - You should have received a copy of the GNU General Public License + You should have received a copy of the GNU Lesser General Public License along with systemd; If not, see . --> @@ -44,43 +44,83 @@ journalctl - systemd-journalctl Query the systemd journal - journalctl OPTIONS MATCH + journalctl + OPTIONS + MATCHES Description - journalctl may be - used to query the contents of the + journalctl may be used to + query the contents of the systemd1 - journal. + journal as written by + systemd-journald.service8. - If called without parameter will show the full + If called without parameters, it will show the full contents of the journal, starting with the oldest entry collected. - If a match argument is passed the output is - filtered accordingly. A match is in the format - FIELD=VALUE, - e.g. _SYSTEMD_UNIT=httpd.service. + If one or more match arguments are passed, the + output is filtered accordingly. A match is in the + format FIELD=VALUE, + e.g. _SYSTEMD_UNIT=httpd.service, + referring to the components of a structured journal + entry. See + systemd.journal-fields7 + for a list of well-known fields. If multiple matches + are specified matching different fields, the log + entries are filtered by both, i.e. the resulting output + will show only entries matching all the specified + matches of this kind. If two matches apply to the same + field, then they are automatically matched as + alternatives, i.e. the resulting output will show + entries matching any of the specified matches for the + same field. Finally, if the character + + appears as a separate word on the + command line, all matches before and after are combined + in a disjunction (i.e. logical OR). + + As shortcuts for a few types of field/value + matches, file paths may be specified. If a file path + refers to an executable file, this is equivalent to an + _EXE= match for the canonicalized + binary path. Similarly, if a path refers to a device + node, this is equivalent to a + _KERNEL_DEVICE= match for the + device. Output is interleaved from all accessible journal files, whether they are rotated or currently - being written, and regardless whether they belong to the + being written, and regardless of whether they belong to the system itself or are accessible user journals. All users are granted access to their private - per-user journals. However, by default only root and - users who are members of the adm + per-user journals. However, by default, only root and + users who are members of the systemd-journal group get access to the system journal and the journals of other users. + + The output is paged through + less by default, and long lines are + "truncated" to screen width. The hidden part can be + viewed by using the left-arrow and right-arrow + keys. Paging can be disabled; see the + option and the "Environment" + section below. + + When outputing to a tty, lines are colored + according to priority: lines of level ERROR and higher + are colored red; lines of level NOTICE and higher are + highlighted; other lines are displayed normally. + @@ -90,8 +130,8 @@ - + Prints a short help text and exits. @@ -107,13 +147,30 @@ - Do not pipe output into a - pager. - + Do not pipe output into a + pager. + + + + + + + + Ellipsize fields when + they do not fit in available columns. + The default is to show full fields, + allowing them to wrap or be truncated + by the pager, if one is used. + + The old options + / + are not useful anymore, except to undo + . + - + Show all fields in full, even if they include unprintable @@ -122,26 +179,44 @@ - + - Show only most recent - journal entries, and continously print + Show only the most recent + journal entries, and continuously print new entries as they are appended to the journal. - + + + + Immediately jump to + the end of the journal inside the + implied pager tool. This implies + to guarantee + that the pager will not buffer logs of + unbounded size. This may be overridden + with an explicit + with some other numeric value on the + command line. Note that this option is + only supported for the + less1 + pager. + + + + - Controls the number of - journal lines to show, counting from - the most recent ones. Takes a positive - integer argument. In follow mode - defaults to 10, otherwise is unset - thus not limiting how many lines are - shown. + Show the most recent + journal events and limit the number of + events shown. If + is used, + this option is implied. The argument, + a positive integer, is optional, and + defaults to 10. @@ -154,81 +229,646 @@ - + + + + Reverse output so that the newest + entries are displayed first. + + + + Controls the - formatting of the journal entries that are - shown. Takes one of - short, - short-monotonic, - verbose, - export, - json, - cat. short - is the default and generates an output - that is mostly identical to the - formatting of classic syslog log - files, showing one line per journal - entry. short-monotonic - is very similar but shows monotonic - timestamps instead of wallclock - timestamps. verbose - shows the full structered entry items - with all - fiels. export - serializes the journal into a binary - (but mostly text-based) stream - suitable for backups and network - transfer. json - formats entries as JSON data - structures. cat - generates a very terse output only - showing the actual message of each - journal entry with no meta data, not - even a timestamp. + formatting of the journal entries that + are shown. Takes one of the following options: + + + + + + + + is the default + and generates an output + that is mostly identical + to the formatting of + classic syslog files, + showing one line per + journal entry. + + + + + + + + + is very similar, + but shows ISO 8601 + wallclock timestamps. + + + + + + + + + + is very similar, + but shows timestamps + with full microsecond + precision. + + + + + + + + + + is very similar, + but shows monotonic + timestamps instead of + wallclock timestamps. + + + + + + + + + + shows the + full-structured entry + items with all fields. + + + + + + + + + + serializes the + journal into a binary + (but mostly text-based) + stream suitable for + backups and network + transfer (see Journal + Export Format + for more + information). + + + + + + + + + formats entries + as JSON data structures, + one per line (see Journal + JSON Format for + more information). + + + + + + + + + formats entries as + JSON data structures, + but formats them in + multiple lines in order + to make them more + readable by humans. + + + + + + + + + formats entries as + JSON data structures, + but wraps them in a + format suitable for Server-Sent + Events. + + + + + + + + + generates a very + terse output, only + showing the actual + message of each journal + entry with no meta data, + not even a timestamp. + + + + + + + + + + + + Augment log lines with + explanation texts from the message + catalog. This will add explanatory + help texts to log messages in the + output where this is available. These + short help texts will explain the + context of an error or log event, + possible solutions, as well as + pointers to support forums, developer + documentation, and any other relevant + manuals. Note that help texts are not + available for all messages, but only + for selected ones. For more + information on the message catalog, + please refer to the Message + Catalog Developer + Documentation. + + Note: when attaching + journalctl output + to bug reports, please do + not use + . + - + Suppresses any warning - message regarding inaccessable system - journals when run as normal + messages regarding inaccessible system + journals when run as a normal user. + + + + + Show entries + interleaved from all available + journals, including remote + ones. + + + + + + + Show messages from a specific + boot. This will add a match for + _BOOT_ID=. + + The argument may be empty, in which case + logs for the current boot will be shown. + + If the boot ID is omitted, a positive + offset will look up + the boots starting from the beginning of the + journal, and a equal-or-less-than zero + offset will look up + boots starting from the end of the + journal. Thus, 1 means the + first boot found in the journal in + chronological order, 2 the + second and so on; while -0 + is the last boot, -1 the + boot before last, and so on. An empty + offset is equivalent + to specifying -0, except + when the current boot is not the last boot + (e.g. because was + specified to look at logs from a different + machine). + + If the 32-character + ID is specified, it + may optionally be followed by + offset which + identifies the boot relative to the one given by + boot ID. Negative + values mean earlier boots and a positive values + mean later boots. If + offset is not + specified, a value of zero is assumed, and the + logs for the boot given by + ID are shown. + + + + + + + + + Show a tabular list of + boot numbers (relative to the current + boot), their IDs, and the timestamps + of the first and last message + pertaining to the boot. + + + + + + + + Show only kernel messages. This + implies and adds the match + _TRANSPORT=kernel. + + + + + + + + Show messages for the + specified systemd unit. This will add + a match for messages from the unit + (_SYSTEMD_UNIT=) + and additional matches for messages + from systemd and messages about + coredumps for the specified unit. + This parameter can be specified multiple times. + + + + + + + Show messages for the + specified user session unit. This will + add a match for messages from the unit + (_SYSTEMD_USER_UNIT= + and _UID=) and + additional matches for messages from + session systemd and messages about + coredumps for the specified unit. + This parameter can be specified multiple times. + + + + + + + + Filter output by + message priorities or priority + ranges. Takes either a single numeric + or textual log level (i.e. between + 0/emerg and + 7/debug), or a + range of numeric/text log levels in + the form FROM..TO. The log levels are + the usual syslog log levels as + documented in + syslog3, + i.e. emerg (0), + alert (1), + crit (2), + err (3), + warning (4), + notice (5), + info (6), + debug (7). If a + single log level is specified, all + messages with this log level or a + lower (hence more important) log level + are shown. If a range is specified, all + messages within the range are shown, + including both the start and the end + value of the range. This will add + PRIORITY= matches + for the specified + priorities. + + + + + + + Start showing entries + from the location in the journal + specified by the passed + cursor. + + + + + + Start showing entries + from the location in the journal + after the + location specified by the this cursor. + The cursor is shown when the + option + is used. + + + + + + The cursor is shown after the last + entry after two dashes: + -- cursor: s=0639... + The format of the cursor is private + and subject to change. + + + + + + + Start showing entries + on or newer than the specified date, + or on or older than the specified + date, respectively. Date specifications + should be of the format + 2012-10-30 18:17:16. + If the time part is omitted, + 00:00:00 is assumed. + If only the seconds component is omitted, + :00 is assumed. If the + date component is omitted, the current + day is assumed. Alternatively the strings + yesterday, + today, + tomorrow are + understood, which refer to 00:00:00 of + the day before the current day, the + current day, or the day after the + current day, respectively. now + refers to the current time. Finally, + relative times may be specified, + prefixed with - or + +, referring to + times before or after the current + time, respectively. + + + + + + + Print all possible + data values the specified field can + take in all entries of the + journal. + + + + + + + Show messages from + system services and the kernel (with + ). Show + messages from service of current user + (with ). + If neither is specified, show all + messages that the user can see. + + + + + + + + Show messages from a + running, local container. Specify a + container name to connect + to. + + + + + + + Takes a directory path + as argument. If specified, journalctl + will operate on the specified journal + directory + DIR instead + of the default runtime and system + journal paths. + + + + + + Takes a file glob as an + argument. If specified, journalctl will + operate on the specified journal files + matching GLOB + instead of the default runtime and + system journal paths. May be specified + multiple times, in which case files will + be suitably interleaved. + + + + + + Takes a directory path + as an argument. If specified, journalctl + will operate on catalog file hierarchy + underneath the specified directory + instead of the root directory + (e.g. + will create + ROOT/var/lib/systemd/catalog/database). + + + Instead of showing - journal contents generate a new 128 - bit ID suitable for identifying + journal contents, generate a new 128-bit + ID suitable for identifying messages. This is intended for usage by developers who need a new identifier for a new message they introduce and want to make - recognizable. Will print the new ID in + recognizable. This will print the new ID in three different formats which can be copied into source code or similar. + + + + Instead of showing + journal contents, show internal header + information of the journal fields + accessed. + + + + + + Shows the current disk + usage of all + journal files. + + + + + + List the contents of + the message catalog as a table of + message IDs, plus their short + description strings. + + If any + 128-bit-IDs are + specified, only those entries are shown. + + + + + + + + Show the contents of + the message catalog, with entries + separated by a line consisting of two + dashes and the ID (the format is the + same as .catalog + files). + + If any + 128-bit-IDs are + specified, only those entries are shown. + + + + + + + + Update the message + catalog index. This command needs to + be executed each time new catalog + files are installed, removed, or + updated to rebuild the binary catalog + index. + + + + + + Instead of showing + journal contents, generate a new key + pair for Forward Secure Sealing + (FSS). This will generate a sealing + key and a verification key. The + sealing key is stored in the journal + data directory and shall remain on the + host. The verification key should be + stored externally. Refer to the + option in + journald.conf5 + for information on Forward Secure + Sealing and for a link to a refereed + scholarly paper detailing the + cryptographic theory it is based on. + + + + + + + When + is passed and + Forward Secure Sealing (FSS) has already been + configured, recreate FSS keys. + + + + + + Specifies the change + interval for the sealing key when + generating an FSS key pair with + . Shorter + intervals increase CPU consumption but + shorten the time range of + undetectable journal + alterations. Defaults to + 15min. + + + + + + Check the journal file + for internal consistency. If the + file has been generated with FSS + enabled and the FSS verification key + has been specified with + , + authenticity of the journal file is + verified. + + + + + + Specifies the FSS + verification key to use for the + + operation. + + Exit status - On success 0 is returned, a non-zero failure - code otherwise. + On success, 0 is returned; otherwise, a non-zero + failure code is returned. Environment - + $SYSTEMD_PAGER Pager to use when @@ -241,12 +881,57 @@ + + Examples + + Without arguments, all collected logs are shown + unfiltered: + + journalctl + + With one match specified, all entries with a field matching the expression are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service + + If two different fields are matched, only entries matching both expressions at the same time are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + + If two matches refer to the same field, all entries matching either expression are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service + + If the separator + is used, + two expressions may be combined in a logical OR. The + following will show all messages from the Avahi + service process with the PID 28097 plus all messages + from the D-Bus service (from any of its + processes): + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service + + Show all logs generated by the D-Bus executable: + + journalctl /usr/bin/dbus-daemon + + Show all logs of the kernel device node /dev/sda: + + journalctl /dev/sda + + Show all kernel logs from previous boot: + + journalctl -k -b -1 + + + See Also systemd1, + systemd-journald.service8, systemctl1, - systemd-journald.conf5 + systemd.journal-fields7, + journald.conf5