1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2012 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id="journalctl"
25 xmlns:xi="http://www.w3.org/2001/XInclude">
28 <title>journalctl</title>
29 <productname>systemd</productname>
33 <contrib>Developer</contrib>
34 <firstname>Lennart</firstname>
35 <surname>Poettering</surname>
36 <email>lennart@poettering.net</email>
42 <refentrytitle>journalctl</refentrytitle>
43 <manvolnum>1</manvolnum>
47 <refname>journalctl</refname>
48 <refpurpose>Query the systemd journal</refpurpose>
53 <command>journalctl</command>
54 <arg choice="opt" rep="repeat">OPTIONS</arg>
55 <arg choice="opt" rep="repeat">MATCHES</arg>
60 <title>Description</title>
62 <para><command>journalctl</command> may be used to
63 query the contents of the
64 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
66 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
68 <para>If called without parameters, it will show the full
69 contents of the journal, starting with the oldest
70 entry collected.</para>
72 <para>If one or more match arguments are passed, the
73 output is filtered accordingly. A match is in the
74 format <literal>FIELD=VALUE</literal>,
75 e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
76 referring to the components of a structured journal
78 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
79 for a list of well-known fields. If multiple matches
80 are specified matching different fields, the log
81 entries are filtered by both, i.e. the resulting output
82 will show only entries matching all the specified
83 matches of this kind. If two matches apply to the same
84 field, then they are automatically matched as
85 alternatives, i.e. the resulting output will show
86 entries matching any of the specified matches for the
87 same field. Finally, if the character
88 <literal>+</literal> appears as a separate word on the
89 command line, all matches before and after are combined
90 in a disjunction (i.e. logical OR).</para>
92 <para>As shortcuts for a few types of field/value
93 matches, file paths may be specified. If a file path
94 refers to an executable file, this is equivalent to an
95 <literal>_EXE=</literal> match for the canonicalized
96 binary path. Similarly, if a path refers to a device
97 node, this is equivalent to a
98 <literal>_KERNEL_DEVICE=</literal> match for the
101 <para>Output is interleaved from all accessible
102 journal files, whether they are rotated or currently
103 being written, and regardless of whether they belong to the
104 system itself or are accessible user journals.</para>
106 <para>All users are granted access to their private
107 per-user journals. However, by default, only root and
108 users who are members of the <literal>systemd-journal</literal>
109 group get access to the system journal and the
110 journals of other users.</para>
112 <para>The output is paged through
113 <command>less</command> by default, and long lines are
114 "truncated" to screen width. The hidden part can be
115 viewed by using the left-arrow and right-arrow
116 keys. Paging can be disabled; see the
117 <option>--no-pager</option> option and the "Environment"
118 section below.</para>
120 <para>When outputing to a tty, lines are colored
121 according to priority: lines of level ERROR and higher
122 are colored red; lines of level NOTICE and higher are
123 highlighted; other lines are displayed normally.
128 <title>Options</title>
130 <para>The following options are understood:</para>
134 <term><option>-h</option></term>
135 <term><option>--help</option></term>
137 <listitem><para>Prints a short help
138 text and exits.</para></listitem>
142 <term><option>--version</option></term>
144 <listitem><para>Prints a short version
145 string and exits.</para></listitem>
149 <term><option>--no-pager</option></term>
151 <listitem><para>Do not pipe output into a
152 pager.</para></listitem>
156 <term><option>--no-full</option></term>
157 <term><option>--full</option></term>
158 <term><option>-l</option></term>
160 <listitem><para>Ellipsize fields when
161 they do not fit in available columns.
162 The default is to show full fields,
163 allowing them to wrap or be truncated
164 by the pager, if one is used.</para>
166 <para>The old options
167 <option>-l</option>/<option>--full</option>
168 are not useful anymore, except to undo
169 <option>--no-full</option>.</para></listitem>
173 <term><option>-a</option></term>
174 <term><option>--all</option></term>
176 <listitem><para>Show all fields in
177 full, even if they include unprintable
178 characters or are very
179 long.</para></listitem>
183 <term><option>-f</option></term>
184 <term><option>--follow</option></term>
186 <listitem><para>Show only the most recent
187 journal entries, and continuously print
188 new entries as they are appended to
189 the journal.</para></listitem>
193 <term><option>-e</option></term>
194 <term><option>--pager-end</option></term>
196 <listitem><para>Immediately jump to
197 the end of the journal inside the
198 implied pager tool. This implies
199 <option>-n1000</option> to guarantee
200 that the pager will not buffer logs of
201 unbounded size. This may be overridden
202 with an explicit <option>-n</option>
203 with some other numeric value on the
204 command line. Note that this option is
205 only supported for the
206 <citerefentry><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
207 pager.</para></listitem>
211 <term><option>-n</option></term>
212 <term><option>--lines=</option></term>
214 <listitem><para>Show the most recent
215 journal events and limit the number of
217 <option>--follow</option> is used,
218 this option is implied. The argument,
219 a positive integer, is optional, and
220 defaults to 10. </para></listitem>
224 <term><option>--no-tail</option></term>
226 <listitem><para>Show all stored output
227 lines, even in follow mode. Undoes the
229 <option>--lines=</option>.</para></listitem>
233 <term><option>-r</option></term>
234 <term><option>--reverse</option></term>
236 <listitem><para>Reverse output so that the newest
237 entries are displayed first.</para></listitem>
241 <term><option>-o</option></term>
242 <term><option>--output=</option></term>
244 <listitem><para>Controls the
245 formatting of the journal entries that
246 are shown. Takes one of the following options:
251 <option>short</option>
255 and generates an output
256 that is mostly identical
258 classic syslog files,
260 journal entry.</para>
266 <option>short-iso</option>
269 <para>is very similar,
271 wallclock timestamps.
278 <option>short-precise</option>
281 <para>is very similar,
283 with full microsecond
291 <option>short-monotonic</option>
294 <para>is very similar,
296 timestamps instead of
297 wallclock timestamps.
304 <option>verbose</option>
308 full-structured entry
309 items with all fields.
316 <option>export</option>
320 journal into a binary
321 (but mostly text-based)
325 url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
326 Export Format</ulink>
334 <option>json</option>
337 <para>formats entries
338 as JSON data structures,
339 one per line (see <ulink
340 url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
341 JSON Format</ulink> for
342 more information).</para>
348 <option>json-pretty</option>
351 <para>formats entries as
352 JSON data structures,
354 multiple lines in order
356 readable by humans.</para>
362 <option>json-sse</option>
365 <para>formats entries as
366 JSON data structures,
368 format suitable for <ulink
369 url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
370 Events</ulink>.</para>
379 <para>generates a very
382 message of each journal
383 entry with no meta data,
384 not even a timestamp.
393 <term><option>-x</option></term>
394 <term><option>--catalog</option></term>
396 <listitem><para>Augment log lines with
397 explanation texts from the message
398 catalog. This will add explanatory
399 help texts to log messages in the
400 output where this is available. These
401 short help texts will explain the
402 context of an error or log event,
403 possible solutions, as well as
404 pointers to support forums, developer
405 documentation, and any other relevant
406 manuals. Note that help texts are not
407 available for all messages, but only
408 for selected ones. For more
409 information on the message catalog,
410 please refer to the <ulink
411 url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
413 Documentation</ulink>.</para>
415 <para>Note: when attaching
416 <command>journalctl</command> output
417 to bug reports, please do
418 <emphasis>not</emphasis> use
419 <option>-x</option>.</para>
424 <term><option>-q</option></term>
425 <term><option>--quiet</option></term>
427 <listitem><para>Suppresses any warning
428 messages regarding inaccessible system
429 journals when run as a normal
430 user.</para></listitem>
434 <term><option>-m</option></term>
435 <term><option>--merge</option></term>
437 <listitem><para>Show entries
438 interleaved from all available
439 journals, including remote
440 ones.</para></listitem>
444 <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
445 <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
447 <listitem><para>Show messages from a specific
448 boot. This will add a match for
449 <literal>_BOOT_ID=</literal>.</para>
451 <para>The argument may be empty, in which case
452 logs for the current boot will be shown.</para>
454 <para>If the boot ID is omitted, a positive
455 <replaceable>offset</replaceable> will look up
456 the boots starting from the beginning of the
457 journal, and a equal-or-less-than zero
458 <replaceable>offset</replaceable> will look up
459 boots starting from the end of the
460 journal. Thus, <constant>1</constant> means the
461 first boot found in the journal in
462 chronological order, <constant>2</constant> the
463 second and so on; while <constant>-0</constant>
464 is the last boot, <constant>-1</constant> the
465 boot before last, and so on. An empty
466 <replaceable>offset</replaceable> is equivalent
467 to specifying <constant>-0</constant>, except
468 when the current boot is not the last boot
469 (e.g. because <option>--directory</option> was
470 specified to look at logs from a different
473 <para>If the 32-character
474 <replaceable>ID</replaceable> is specified, it
475 may optionally be followed by
476 <replaceable>offset</replaceable> which
477 identifies the boot relative to the one given by
478 boot <replaceable>ID</replaceable>. Negative
479 values mean earlier boots and a positive values
481 <replaceable>offset</replaceable> is not
482 specified, a value of zero is assumed, and the
483 logs for the boot given by
484 <replaceable>ID</replaceable> are shown.
491 <term><option>--list-boots</option></term>
493 <listitem><para>Show a tabular list of
494 boot numbers (relative to the current
495 boot), their IDs, and the timestamps
496 of the first and last message
497 pertaining to the boot.
502 <term><option>-k</option></term>
503 <term><option>--dmesg</option></term>
505 <listitem><para>Show only kernel messages. This
506 implies <option>-b</option> and adds the match
507 <literal>_TRANSPORT=kernel</literal>.
512 <term><option>-u</option></term>
513 <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
515 <listitem><para>Show messages for the
516 specified systemd unit
517 <replaceable>UNIT</replaceable>, or
518 for any of the units matched by
519 <replaceable>PATTERN</replaceable>.
520 If a pattern is specified, a list of
521 unit names found in the journal is
522 compared with the specified pattern
523 and all that match are used. For each
524 unit name a match is added for
525 messages from the unit
526 (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>)
527 along with additional matches for
528 messages from systemd and messages
529 about coredumps for the specified
532 <para>This parameter can be specified
533 multiple times. </para></listitem>
537 <term><option>--user-unit=</option></term>
539 <listitem><para>Show messages for the
540 specified user session unit. This will
541 add a match for messages from the unit
542 (<literal>_SYSTEMD_USER_UNIT=</literal>
543 and <literal>_UID=</literal>) and
544 additional matches for messages from
545 session systemd and messages about
546 coredumps for the specified unit.</para>
547 <para>This parameter can be specified multiple times.
552 <term><option>-p</option></term>
553 <term><option>--priority=</option></term>
555 <listitem><para>Filter output by
556 message priorities or priority
557 ranges. Takes either a single numeric
558 or textual log level (i.e. between
559 0/<literal>emerg</literal> and
560 7/<literal>debug</literal>), or a
561 range of numeric/text log levels in
562 the form FROM..TO. The log levels are
563 the usual syslog log levels as
565 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
566 i.e. <literal>emerg</literal> (0),
567 <literal>alert</literal> (1),
568 <literal>crit</literal> (2),
569 <literal>err</literal> (3),
570 <literal>warning</literal> (4),
571 <literal>notice</literal> (5),
572 <literal>info</literal> (6),
573 <literal>debug</literal> (7). If a
574 single log level is specified, all
575 messages with this log level or a
576 lower (hence more important) log level
577 are shown. If a range is specified, all
578 messages within the range are shown,
579 including both the start and the end
580 value of the range. This will add
581 <literal>PRIORITY=</literal> matches
583 priorities.</para></listitem>
587 <term><option>-c</option></term>
588 <term><option>--cursor=</option></term>
590 <listitem><para>Start showing entries
591 from the location in the journal
592 specified by the passed
593 cursor.</para></listitem>
597 <term><option>--after-cursor=</option></term>
599 <listitem><para>Start showing entries
600 from the location in the journal
601 <emphasis>after</emphasis> the
602 location specified by the this cursor.
603 The cursor is shown when the
604 <option>--show-cursor</option> option
605 is used.</para></listitem>
609 <term><option>--show-cursor</option></term>
611 <listitem><para>The cursor is shown after the last
612 entry after two dashes:</para>
613 <programlisting>-- cursor: s=0639...</programlisting>
614 <para>The format of the cursor is private
615 and subject to change.</para></listitem>
619 <term><option>--since=</option></term>
620 <term><option>--until=</option></term>
622 <listitem><para>Start showing entries
623 on or newer than the specified date,
624 or on or older than the specified
625 date, respectively. Date specifications
626 should be of the format
627 <literal>2012-10-30 18:17:16</literal>.
628 If the time part is omitted,
629 <literal>00:00:00</literal> is assumed.
630 If only the seconds component is omitted,
631 <literal>:00</literal> is assumed. If the
632 date component is omitted, the current
633 day is assumed. Alternatively the strings
634 <literal>yesterday</literal>,
635 <literal>today</literal>,
636 <literal>tomorrow</literal> are
637 understood, which refer to 00:00:00 of
638 the day before the current day, the
639 current day, or the day after the
640 current day, respectively. <literal>now</literal>
641 refers to the current time. Finally,
642 relative times may be specified,
643 prefixed with <literal>-</literal> or
644 <literal>+</literal>, referring to
645 times before or after the current
646 time, respectively.</para></listitem>
650 <term><option>-F</option></term>
651 <term><option>--field=</option></term>
653 <listitem><para>Print all possible
654 data values the specified field can
655 take in all entries of the
656 journal.</para></listitem>
660 <term><option>--system</option></term>
661 <term><option>--user</option></term>
663 <listitem><para>Show messages from
664 system services and the kernel (with
665 <option>--system</option>). Show
666 messages from service of current user
667 (with <option>--user</option>).
668 If neither is specified, show all
669 messages that the user can see.
674 <term><option>-M</option></term>
675 <term><option>--machine=</option></term>
677 <listitem><para>Show messages from a
678 running, local container. Specify a
679 container name to connect
680 to.</para></listitem>
684 <term><option>-D <replaceable>DIR</replaceable></option></term>
685 <term><option>--directory=<replaceable>DIR</replaceable></option></term>
687 <listitem><para>Takes a directory path
688 as argument. If specified, journalctl
689 will operate on the specified journal
691 <replaceable>DIR</replaceable> instead
692 of the default runtime and system
693 journal paths.</para></listitem>
697 <term><option>--file=<replaceable>GLOB</replaceable></option></term>
699 <listitem><para>Takes a file glob as an
700 argument. If specified, journalctl will
701 operate on the specified journal files
702 matching <replaceable>GLOB</replaceable>
703 instead of the default runtime and
704 system journal paths. May be specified
705 multiple times, in which case files will
706 be suitably interleaved.</para></listitem>
710 <term><option>--root=<replaceable>ROOT</replaceable></option></term>
712 <listitem><para>Takes a directory path
713 as an argument. If specified, journalctl
714 will operate on catalog file hierarchy
715 underneath the specified directory
716 instead of the root directory
717 (e.g. <option>--update-catalog</option>
719 <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).
724 <term><option>--new-id128</option></term>
726 <listitem><para>Instead of showing
727 journal contents, generate a new 128-bit
728 ID suitable for identifying
729 messages. This is intended for usage
730 by developers who need a new
731 identifier for a new message they
732 introduce and want to make
733 recognizable. This will print the new ID in
734 three different formats which can be
735 copied into source code or
736 similar.</para></listitem>
740 <term><option>--header</option></term>
742 <listitem><para>Instead of showing
743 journal contents, show internal header
744 information of the journal fields
745 accessed.</para></listitem>
749 <term><option>--disk-usage</option></term>
751 <listitem><para>Shows the current disk
753 journal files.</para></listitem>
757 <term><option>--list-catalog
758 <optional><replaceable>128-bit-ID...</replaceable></optional>
761 <listitem><para>List the contents of
762 the message catalog as a table of
763 message IDs, plus their short
764 description strings.</para>
767 <replaceable>128-bit-ID</replaceable>s are
768 specified, only those entries are shown.
774 <term><option>--dump-catalog
775 <optional><replaceable>128-bit-ID...</replaceable></optional>
778 <listitem><para>Show the contents of
779 the message catalog, with entries
780 separated by a line consisting of two
781 dashes and the ID (the format is the
782 same as <filename>.catalog</filename>
786 <replaceable>128-bit-ID</replaceable>s are
787 specified, only those entries are shown.
793 <term><option>--update-catalog</option></term>
795 <listitem><para>Update the message
796 catalog index. This command needs to
797 be executed each time new catalog
798 files are installed, removed, or
799 updated to rebuild the binary catalog
800 index.</para></listitem>
804 <term><option>--setup-keys</option></term>
806 <listitem><para>Instead of showing
807 journal contents, generate a new key
808 pair for Forward Secure Sealing
809 (FSS). This will generate a sealing
810 key and a verification key. The
811 sealing key is stored in the journal
812 data directory and shall remain on the
813 host. The verification key should be
814 stored externally. Refer to the
815 <option>Seal=</option> option in
816 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
817 for information on Forward Secure
818 Sealing and for a link to a refereed
819 scholarly paper detailing the
820 cryptographic theory it is based on.
825 <term><option>--force</option></term>
828 <option>--setup-keys</option> is passed and
829 Forward Secure Sealing (FSS) has already been
830 configured, recreate FSS keys.</para></listitem>
834 <term><option>--interval=</option></term>
836 <listitem><para>Specifies the change
837 interval for the sealing key when
838 generating an FSS key pair with
839 <option>--setup-keys</option>. Shorter
840 intervals increase CPU consumption but
841 shorten the time range of
843 alterations. Defaults to
844 15min.</para></listitem>
848 <term><option>--verify</option></term>
850 <listitem><para>Check the journal file
851 for internal consistency. If the
852 file has been generated with FSS
853 enabled and the FSS verification key
854 has been specified with
855 <option>--verify-key=</option>,
856 authenticity of the journal file is
857 verified.</para></listitem>
861 <term><option>--verify-key=</option></term>
863 <listitem><para>Specifies the FSS
864 verification key to use for the
865 <option>--verify</option>
866 operation.</para></listitem>
873 <title>Exit status</title>
875 <para>On success, 0 is returned; otherwise, a non-zero
876 failure code is returned.</para>
879 <xi:include href="less-variables.xml" />
882 <title>Examples</title>
884 <para>Without arguments, all collected logs are shown
887 <programlisting>journalctl</programlisting>
889 <para>With one match specified, all entries with a field matching the expression are shown:</para>
891 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
893 <para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>
895 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
897 <para>If two matches refer to the same field, all entries matching either expression are shown:</para>
899 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
901 <para>If the separator <literal>+</literal> is used,
902 two expressions may be combined in a logical OR. The
903 following will show all messages from the Avahi
904 service process with the PID 28097 plus all messages
905 from the D-Bus service (from any of its
908 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
910 <para>Show all logs generated by the D-Bus executable:</para>
912 <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
914 <para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>
916 <programlisting>journalctl /dev/sda</programlisting>
918 <para>Show all kernel logs from previous boot:</para>
920 <programlisting>journalctl -k -b -1</programlisting>
925 <title>See Also</title>
927 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
928 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
929 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
930 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
931 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>