Copyright 2012 Lennart Poettering
systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
(at your option) any later version.
systemd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
+ Lesser General Public License for more details.
- You should have received a copy of the GNU General Public License
+ You should have received a copy of the GNU Lesser General Public License
along with systemd; If not, see <http://www.gnu.org/licenses/>.
-->
<refnamediv>
<refname>journalctl</refname>
- <refname>systemd-journalctl</refname>
<refpurpose>Query the systemd journal</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
- <command>journalctl <arg choice="opt" rep="repeat">OPTIONS</arg> <arg choice="opt">MATCH</arg></command>
+ <command>journalctl</command>
+ <arg choice="opt" rep="repeat">OPTIONS</arg>
+ <arg choice="opt" rep="repeat">MATCHES</arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
- <para><command>journalctl</command> may be
- used to query the contents of the
+ <para><command>journalctl</command> may be used to
+ query the contents of the
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
- journal.</para>
+ journal as written by
+ <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
- <para>If called without parameter will show the full
+ <para>If called without parameters, it will show the full
contents of the journal, starting with the oldest
entry collected.</para>
- <para>If a match argument is passed the output is
- filtered accordingly. A match is in the format
- <literal>FIELD=VALUE</literal>,
- e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>.</para>
+ <para>If one or more match arguments are passed, the
+ output is filtered accordingly. A match is in the
+ format <literal>FIELD=VALUE</literal>,
+ e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
+ referring to the components of a structured journal
+ entry. See
+ <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+ for a list of well-known fields. If multiple matches
+ are specified matching different fields, the log
+ entries are filtered by both, i.e. the resulting output
+ will show only entries matching all the specified
+ matches of this kind. If two matches apply to the same
+ field, then they are automatically matched as
+ alternatives, i.e. the resulting output will show
+ entries matching any of the specified matches for the
+ same field. Finally, if the character
+ <literal>+</literal> appears as separate word on the
+ command line, all matches before and after are combined
+ in a disjunction (i.e. logical OR).</para>
+
+ <para>As shortcuts for a few types of field/value
+ matches, file paths may be specified. If a file path
+ refers to an executable file, this is equivalent to an
+ <literal>_EXE=</literal> match for the canonicalized
+ binary path. Similarly, if a path refers to a device
+ node, this is equivalent to a
+ <literal>_KERNEL_DEVICE=</literal> match for the
+ device.</para>
<para>Output is interleaved from all accessible
journal files, whether they are rotated or currently
- being written, and regardless whether they belong to the
+ being written, and regardless of whether they belong to the
system itself or are accessible user journals.</para>
<para>All users are granted access to their private
- per-user journals. However, by default only root and
- users who are members of the <literal>adm</literal>
+ per-user journals. However, by default, only root and
+ users who are members of the <literal>systemd-journal</literal>
group get access to the system journal and the
journals of other users.</para>
+
+ <para>The output is paged through
+ <command>less</command> by default, and long lines are
+ "truncated" to screen width. The hidden part can be
+ viewed by using the left-arrow and right-arrow
+ keys. Paging can be disabled, see
+ <option>--no-pager</option> and section Environment
+ below.</para>
+
+ <para>When outputing to a tty, lines are colored
+ according to priority: lines of level ERROR and higher
+ are colored red, lines of level NOTICE and higher are
+ highlighted, and other lines are displayed normally.
+ </para>
</refsect1>
<refsect1>
<variablelist>
<varlistentry>
- <term><option>--help</option></term>
<term><option>-h</option></term>
+ <term><option>--help</option></term>
<listitem><para>Prints a short help
text and exits.</para></listitem>
<varlistentry>
<term><option>--no-pager</option></term>
- <listitem><para>Do not pipe output into a
- pager.</para></listitem>
- </varlistentry>
+ <listitem><para>Do not pipe output into a
+ pager.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--no-full</option></term>
+ <term><option>--full</option></term>
+ <term><option>-l</option></term>
+
+ <listitem><para>Ellipsize fields when
+ they do not fit in available columns.
+ The default is to show full fields,
+ allowing them to wrap or be truncated
+ by the pager if one is used.</para>
+
+ <para>The old options
+ <option>-l</option>/<option>--full</option>
+ are not useful anymore, except to undo
+ <option>--no-full</option>.</para></listitem>
+ </varlistentry>
<varlistentry>
- <term><option>--all</option></term>
<term><option>-a</option></term>
+ <term><option>--all</option></term>
<listitem><para>Show all fields in
full, even if they include unprintable
</varlistentry>
<varlistentry>
- <term><option>--follow</option></term>
<term><option>-f</option></term>
+ <term><option>--follow</option></term>
- <listitem><para>Show only most recent
- journal entries, and continously print
+ <listitem><para>Show only the most recent
+ journal entries, and continuously print
new entries as they are appended to
the journal.</para></listitem>
</varlistentry>
<varlistentry>
- <term><option>--lines=</option></term>
+ <term><option>-e</option></term>
+ <term><option>--pager-end</option></term>
+
+ <listitem><para>Immediately jump to
+ the end of the journal inside the
+ implied pager tool. This implies
+ <option>-n1000</option> to guarantee
+ that the pager will not buffer logs of
+ unbounded size. This may be overridden
+ with an explicit <option>-n</option>
+ with some other numeric value on the
+ command line. Note that this option is
+ only supported for the
+ <citerefentry><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+ pager.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
<term><option>-n</option></term>
+ <term><option>--lines=</option></term>
- <listitem><para>Controls the number of
- journal lines to show, counting from
- the most recent ones. Takes a positive
- integer argument. In follow mode
- defaults to 10, otherwise is unset
- thus not limiting how many lines are
- shown.</para></listitem>
+ <listitem><para>Show the most recent
+ journal events and limit the number of
+ events shown. If
+ <option>--follow</option> is used,
+ this option is implied. The argument,
+ a positive integer, is optional, and
+ defaults to 10. </para></listitem>
</varlistentry>
<varlistentry>
</varlistentry>
<varlistentry>
- <term><option>--output=</option></term>
+ <term><option>-r</option></term>
+ <term><option>--reverse</option></term>
+
+ <listitem><para>Reverse output, so the newest
+ entries are displayed first.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
<term><option>-o</option></term>
+ <term><option>--output=</option></term>
<listitem><para>Controls the
- formatting of the journal entries that are
- shown. Takes one of
- <literal>short</literal>,
- <literal>short-monotonic</literal>,
- <literal>verbose</literal>,
- <literal>export</literal>,
- <literal>json</literal>,
- <literal>cat</literal>. <literal>short</literal>
- is the default and generates an output
- that is mostly identical to the
- formatting of classic syslog log
- files, showing one line per journal
- entry. <literal>short-monotonic</literal>
- is very similar but shows monotonic
- timestamps instead of wallclock
- timestamps. <literal>verbose</literal>
- shows the full structered entry items
- with all
- fiels. <literal>export</literal>
- serializes the journal into a binary
- (but mostly text-based) stream
- suitable for backups and network
- transfer. <literal>json</literal>
- formats entries as JSON data
- structures. <literal>cat</literal>
- generates a very terse output only
- showing the actual message of each
- journal entry with no meta data, not
- even a timestamp.</para></listitem>
+ formatting of the journal entries that
+ are shown. Takes one of the following options:
+ </para>
+ <variablelist>
+ <varlistentry>
+ <term>
+ <option>short</option>
+ </term>
+ <listitem>
+ <para>is the default
+ and generates an output
+ that is mostly identical
+ to the formatting of
+ classic syslog files,
+ showing one line per
+ journal entry.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>short-iso</option>
+ </term>
+ <listitem>
+ <para>is very similar,
+ but shows ISO 8601
+ wallclock timestamps.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>short-precise</option>
+ </term>
+ <listitem>
+ <para>is very similar,
+ but shows timestamps
+ with full microsecond
+ precision.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>short-monotonic</option>
+ </term>
+ <listitem>
+ <para>is very similar,
+ but shows monotonic
+ timestamps instead of
+ wallclock timestamps.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>verbose</option>
+ </term>
+ <listitem>
+ <para>shows the
+ full-structured entry
+ items with all fields.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>export</option>
+ </term>
+ <listitem>
+ <para>serializes the
+ journal into a binary
+ (but mostly text-based)
+ stream suitable for
+ backups and network
+ transfer (see <ulink
+ url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
+ Export Format</ulink>
+ for more
+ information).</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>json</option>
+ </term>
+ <listitem>
+ <para>formats entries
+ as JSON data structures,
+ one per line (see <ulink
+ url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
+ JSON Format</ulink> for
+ more information).</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>json-pretty</option>
+ </term>
+ <listitem>
+ <para>formats entries as
+ JSON data structures,
+ but formats them in
+ multiple lines in order
+ to make them more
+ readable for humans.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>json-sse</option>
+ </term>
+ <listitem>
+ <para>formats entries as
+ JSON data structures,
+ but wraps them in a
+ format suitable for <ulink
+ url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
+ Events</ulink>.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>cat</option>
+ </term>
+ <listitem>
+ <para>generates a very
+ terse output only
+ showing the actual
+ message of each journal
+ entry with no meta data,
+ not even a timestamp.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-x</option></term>
+ <term><option>--catalog</option></term>
+
+ <listitem><para>Augment log lines with
+ explanation texts from the message
+ catalog. This will add explanatory
+ help texts to log messages in the
+ output where this is available. These
+ short help texts will explain the
+ context of an error or log event,
+ possible solutions, as well as
+ pointers to support forums, developer
+ documentation, and any other relevant
+ manuals. Note that help texts are not
+ available for all messages, but only
+ for selected ones. For more
+ information on the message catalog,
+ please refer to the <ulink
+ url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
+ Catalog Developer
+ Documentation</ulink>.</para>
+
+ <para>Note: when attaching
+ <command>journalctl</command> output
+ to bug reports, please do
+ <emphasis>not</emphasis> use
+ <option>-x</option>.</para>
+ </listitem>
</varlistentry>
<varlistentry>
- <term><option>--quiet</option></term>
<term><option>-q</option></term>
+ <term><option>--quiet</option></term>
<listitem><para>Suppresses any warning
- message regarding inaccessable system
+ message regarding inaccessible system
journals when run as normal
user.</para></listitem>
</varlistentry>
<varlistentry>
- <term><option>--local</option></term>
- <term><option>-l</option></term>
+ <term><option>-m</option></term>
+ <term><option>--merge</option></term>
+
+ <listitem><para>Show entries
+ interleaved from all available
+ journals, including remote
+ ones.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
+ <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
+
+ <listitem><para>Show messages from a specific
+ boot. This will add a match for
+ <literal>_BOOT_ID=</literal>.</para>
+
+ <para>The argument may be empty, in which case
+ logs for the current boot will be shown.</para>
+
+ <para>If the boot ID is omitted, a positive
+ <replaceable>offset</replaceable> will look up
+ the boots starting from the beginning of the
+ journal, and a equal-or-less-than zero
+ <replaceable>offset</replaceable> will look up
+ boots starting from the end of the
+ journal. Thus, <constant>1</constant> means the
+ first boot found in the journal in the
+ chronological order, <constant>2</constant> the
+ second and so on; while <constant>-0</constant>
+ is the last boot, <constant>-1</constant> the
+ boot before that, and so on. An empty
+ <replaceable>offset</replaceable> is equivalent
+ to specifying <constant>-0</constant>, except
+ when the current boot is not the last boot
+ (e.g. because <option>--directory</option> was
+ specified to look at logs from a different
+ machine).</para>
+
+ <para>If the 32 character
+ <replaceable>ID</replaceable> is specified, it
+ may optionally be followed by
+ <replaceable>offset</replaceable> which
+ identifies the boot relative to the one given by
+ boot <replaceable>ID</replaceable>. Negative
+ values mean earlier boots and a positive values
+ mean later boots. If
+ <replaceable>offset</replaceable> is not
+ specified, a value of zero is assumed and the
+ logs for the boot given by
+ <replaceable>ID</replaceable> are shown.
+ </para>
+
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--list-boots</option></term>
+
+ <listitem><para>Show a tabular list of
+ boot numbers (relative to current
+ boot), their IDs, and the timestamps
+ of the first and last message
+ pertaining to the boot.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-k</option></term>
+ <term><option>--dmesg</option></term>
+
+ <listitem><para>Show only kernel messages. This
+ implies <option>-b</option> and adds the match
+ <literal>_TRANSPORT=kernel</literal>.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-u</option></term>
+ <term><option>--unit=</option></term>
+
+ <listitem><para>Show messages for the
+ specified systemd unit. This will add
+ a match for messages from the unit
+ (<literal>_SYSTEMD_UNIT=</literal>)
+ and additional matches for messages
+ from systemd and messages about
+ coredumps for the specified unit.</para>
+ <para>This parameter can be specified multiple times.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--user-unit=</option></term>
+
+ <listitem><para>Show messages for the
+ specified user session unit. This will
+ add a match for messages from the unit
+ (<literal>_SYSTEMD_USER_UNIT=</literal>
+ and <literal>_UID=</literal>) and
+ additional matches for messages from
+ session systemd and messages about
+ coredumps for the specified unit.</para>
+ <para>This parameter can be specified multiple times.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-p</option></term>
+ <term><option>--priority=</option></term>
+
+ <listitem><para>Filter output by
+ message priorities or priority
+ ranges. Takes either a single numeric
+ or textual log level (i.e. between
+ 0/<literal>emerg</literal> and
+ 7/<literal>debug</literal>), or a
+ range of numeric/text log levels in
+ the form FROM..TO. The log levels are
+ the usual syslog log levels as
+ documented in
+ <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+ i.e. <literal>emerg</literal> (0),
+ <literal>alert</literal> (1),
+ <literal>crit</literal> (2),
+ <literal>err</literal> (3),
+ <literal>warning</literal> (4),
+ <literal>notice</literal> (5),
+ <literal>info</literal> (6),
+ <literal>debug</literal> (7). If a
+ single log level is specified, all
+ messages with this log level or a
+ lower (hence more important) log level
+ are shown. If a range is specified, all
+ messages within the range are shown,
+ including both the start and the end
+ value of the range. This will add
+ <literal>PRIORITY=</literal> matches
+ for the specified
+ priorities.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-c</option></term>
+ <term><option>--cursor=</option></term>
+
+ <listitem><para>Start showing entries
+ from the location in the journal
+ specified by the passed
+ cursor.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--after-cursor=</option></term>
+
+ <listitem><para>Start showing entries
+ from the location in the journal
+ <emphasis>after</emphasis> the
+ location specified by the this cursor.
+ The cursor is shown when the
+ <option>--show-cursor</option> option
+ is used.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--show-cursor</option></term>
+
+ <listitem><para>The cursor is shown after the last
+ entry after two dashes:</para>
+ <programlisting>-- cursor: s=0639...</programlisting>
+ <para>The format of this the cursor is private
+ and subject ot change.</para></listitem>
+ </varlistentry>
- <listitem><para>Show only locally
- generated messages.</para></listitem>
+ <varlistentry>
+ <term><option>--since=</option></term>
+ <term><option>--until=</option></term>
+
+ <listitem><para>Start showing entries
+ on or newer than the specified date,
+ or on or older than the specified
+ date, respectively. Date specifications
+ should be of the format
+ <literal>2012-10-30 18:17:16</literal>.
+ If the time part is omitted,
+ <literal>00:00:00</literal> is assumed.
+ If only the seconds component is omitted,
+ <literal>:00</literal> is assumed. If the
+ date component is omitted, the current
+ day is assumed. Alternatively the strings
+ <literal>yesterday</literal>,
+ <literal>today</literal>,
+ <literal>tomorrow</literal> are
+ understood, which refer to 00:00:00 of
+ the day before the current day, the
+ current day, or the day after the
+ current day, respectively. <literal>now</literal>
+ refers to the current time. Finally,
+ relative times may be specified,
+ prefixed with <literal>-</literal> or
+ <literal>+</literal>, referring to
+ times before or after the current
+ time, respectively.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-F</option></term>
+ <term><option>--field=</option></term>
+
+ <listitem><para>Print all possible
+ data values the specified field can
+ take in all entries of the
+ journal.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--system</option></term>
+ <term><option>--user</option></term>
+
+ <listitem><para>Show messages from
+ system services and the kernel (with
+ <option>--system</option>). Show
+ messages from service of current user
+ (with <option>--user</option>).
+ If neither is specified, show all
+ messages that the user can see.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-M</option></term>
+ <term><option>--machine=</option></term>
+
+ <listitem><para>Show messages from a
+ running, local container. Specify a
+ container name to connect
+ to.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-D <replaceable>DIR</replaceable></option></term>
+ <term><option>--directory=<replaceable>DIR</replaceable></option></term>
+
+ <listitem><para>Takes a directory path
+ as argument. If specified, journalctl
+ will operate on the specified journal
+ directory
+ <replaceable>DIR</replaceable> instead
+ of the default runtime and system
+ journal paths.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--file=<replaceable>GLOB</replaceable></option></term>
+
+ <listitem><para>Takes a file glob as
+ argument. If specified, journalctl will
+ operate on the specified journal files
+ matching <replaceable>GLOB</replaceable>
+ instead of the default runtime and
+ system journal paths. May be specified
+ multiple times, in which case files will
+ be suitably interleaved.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--root=<replaceable>ROOT</replaceable></option></term>
+
+ <listitem><para>Takes a directory path
+ as argument. If specified, journalctl
+ will operate on catalog file hierarchy
+ underneath the specified directory
+ instead of the root directory
+ (e.g. <option>--update-catalog</option>
+ will create
+ <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).
+ </para></listitem>
</varlistentry>
<varlistentry>
<term><option>--new-id128</option></term>
<listitem><para>Instead of showing
- journal contents generate a new 128
+ journal contents, generate a new 128
bit ID suitable for identifying
messages. This is intended for usage
by developers who need a new
identifier for a new message they
introduce and want to make
- recognizable. Will print the new ID in
+ recognizable. This will print the new ID in
three different formats which can be
copied into source code or
similar.</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>--header</option></term>
+
+ <listitem><para>Instead of showing
+ journal contents, show internal header
+ information of the journal fields
+ accessed.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--disk-usage</option></term>
+
+ <listitem><para>Shows the current disk
+ usage of all
+ journal files.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--list-catalog
+ <optional><replaceable>ID128...</replaceable></optional>
+ </option></term>
+
+ <listitem><para>List the contents of
+ the message catalog, as table of
+ message IDs plus their short
+ description strings.</para>
+
+ <para>If any
+ <replaceable>ID128</replaceable>s are
+ specified, only those entries are shown.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--dump-catalog
+ <optional><replaceable>ID128...</replaceable></optional>
+ </option></term>
+
+ <listitem><para>Show the contents of
+ the message catalog, with entries
+ separated by a line consisting of two
+ dashes and the id (the format is the
+ same as <filename>.catalog</filename>
+ files.</para>
+
+ <para>If any
+ <replaceable>ID128</replaceable>s are
+ specified, only those entries are shown.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--update-catalog</option></term>
+
+ <listitem><para>Update the message
+ catalog index. This command needs to
+ be executed each time new catalog
+ files are installed, removed or
+ updated to rebuild the binary catalog
+ index.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--setup-keys</option></term>
+
+ <listitem><para>Instead of showing
+ journal contents, generate a new key
+ pair for Forward Secure Sealing
+ (FSS). This will generate a sealing
+ key and a verification key. The
+ sealing key is stored in the journal
+ data directory and shall remain on the
+ host. The verification key should be
+ stored externally. Also see the
+ <option>Seal=</option> option in
+ <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ for details.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--force</option></term>
+
+ <listitem><para>When --setup-keys is passed and
+ Forward Secure Sealing has already been set up,
+ recreate FSS keys.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--interval=</option></term>
+
+ <listitem><para>Specifies the change
+ interval for the sealing key when
+ generating an FSS key pair with
+ <option>--setup-keys</option>. Shorter
+ intervals increase CPU consumption but
+ shorten the time range of
+ undetectable journal
+ alterations. Defaults to
+ 15min.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--verify</option></term>
+
+ <listitem><para>Check the journal file
+ for internal consistency. If the
+ file has been generated with FSS
+ enabled and the FSS verification key
+ has been specified with
+ <option>--verify-key=</option>,
+ authenticity of the journal file is
+ verified.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--verify-key=</option></term>
+
+ <listitem><para>Specifies the FSS
+ verification key to use for the
+ <option>--verify</option>
+ operation.</para></listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>
<refsect1>
<title>Exit status</title>
- <para>On success 0 is returned, a non-zero failure
+ <para>On success, 0 is returned, a non-zero failure
code otherwise.</para>
</refsect1>
<refsect1>
<title>Environment</title>
- <variablelist>
+ <variablelist class='environment-variables'>
<varlistentry>
<term><varname>$SYSTEMD_PAGER</varname></term>
<listitem><para>Pager to use when
</variablelist>
</refsect1>
+ <refsect1>
+ <title>Examples</title>
+
+ <para>Without arguments, all collected logs are shown
+ unfiltered:</para>
+
+ <programlisting>journalctl</programlisting>
+
+ <para>With one match specified, all entries with a field matching the expression are shown:</para>
+
+ <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
+
+ <para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>
+
+ <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
+
+ <para>If two matches refer to the same field, all entries matching either expression are shown:</para>
+
+ <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
+
+ <para>If the separator <literal>+</literal> is used,
+ two expressions may be combined in a logical OR. The
+ following will show all messages from the Avahi
+ service process with the PID 28097 plus all messages
+ from the D-Bus service (from any of its
+ processes):</para>
+
+ <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
+
+ <para>Show all logs generated by the D-Bus executable:</para>
+
+ <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
+
+ <para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>
+
+ <programlisting>journalctl /dev/sda</programlisting>
+
+ <para>Show all kernel logs from previous boot:</para>
+
+ <programlisting>journalctl -k -b -1</programlisting>
+
+ </refsect1>
+
<refsect1>
<title>See Also</title>
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
- <citerefentry><refentrytitle>systemd-journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
</para>
</refsect1>