X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fjournalctl.xml;h=83ddf5c3d66ee64fd6f9d38a91daf4a483964c05;hb=5d5e98eb8c859d5a85fe6cd5e3cc433bd8a096ba;hp=bbc9b341516b7c44765fd6fa110b174f00fb3a5c;hpb=931974af6bbad8b79cbee7e41f98954758016fcc;p=elogind.git diff --git a/man/journalctl.xml b/man/journalctl.xml index bbc9b3415..83ddf5c3d 100644 --- a/man/journalctl.xml +++ b/man/journalctl.xml @@ -49,7 +49,7 @@ - journalctl OPTIONS MATCH + journalctl OPTIONS MATCHES @@ -62,16 +62,38 @@ journal as written by systemd-journald.service8. - If called without parameter will show the full + If called without parameter it will show the full contents of the journal, starting with the oldest entry collected. - If a match argument is passed the output is - filtered accordingly. A match is in the format - FIELD=VALUE, - e.g. _SYSTEMD_UNIT=httpd.service. See + If one or more match arguments are passed the + output is filtered accordingly. A match is in the + format FIELD=VALUE, + e.g. _SYSTEMD_UNIT=httpd.service, + referring to the components of a structured journal + entry. See systemd.journal-fields7 - for a list of well-known fields. + for a list of well-known fields. If multiple matches + are specified matching different fields the log + entries are filtered by both, i.e. the resulting output + will show only entries matching all the specified + matches of this kind. If two matches apply to the same + field, then they are automatically matched as + alternatives, i.e. the resulting output will show + entries matching any of the specified matches for the + same field. Finally, if the character + "+" appears as separate word on the + command line all matches before and after are combined + in a disjunction (i.e. logical OR). + + As shortcuts for a few types of field/value + matches file paths may be specified. If a file path + refers to an executable file, this is equivalent to an + _EXE= match for the canonicalized + binary path. Similar, if a path refers to a device + node, this is equivalent to a + _KERNEL_DEVICE= match for the + device. Output is interleaved from all accessible journal files, whether they are rotated or currently @@ -127,8 +149,8 @@ - Show only most recent - journal entries, and continously print + Show only the most recent + journal entries, and continuously print new entries as they are appended to the journal. @@ -160,13 +182,14 @@ Controls the - formatting of the journal entries that are - shown. Takes one of + formatting of the journal entries that + are shown. Takes one of short, short-monotonic, verbose, export, json, + json-pretty, cat. short is the default and generates an output that is mostly identical to the @@ -176,15 +199,24 @@ is very similar but shows monotonic timestamps instead of wallclock timestamps. verbose - shows the full structered entry items + shows the full structured entry items with all - fiels. export + fields. export serializes the journal into a binary (but mostly text-based) stream suitable for backups and network - transfer. json + transfer (see Journal + Export Format for more + information). json formats entries as JSON data - structures. cat + structures, one per + line. json-pretty + also formats entries as JSON data + structures, but formats them in + multiple lines in order to make them + more readable for + humans. cat generates a very terse output only showing the actual message of each journal entry with no meta data, not @@ -196,17 +228,19 @@ Suppresses any warning - message regarding inaccessable system + message regarding inaccessible system journals when run as normal user. - - + + - Show only locally - generated messages. + Show entries + interleaved from all available + journals, including remote + ones. @@ -217,6 +251,50 @@ current boot. + + + + + Takes an absolute + directory path as argument. If + specified journalctl will operate on the + specified journal directory instead of + the default runtime and system journal + paths. + + + + + + + Filter output by + message priorities or priority + ranges. Takes either a single numeric + or textual log level (i.e. between + 0/emerg and + 7/debug), or a + range of numeric/text log levels in + the form FROM..TO. The log levels are + the usual syslog log levels as + documented in + syslog3, + i.e. emerg (0), + alert (1), + crit (2), + err (3), + warning (4), + notice (5), + info (6), + debug (7). If a + single log level is specified all + messages with this log level or a + lower (hence more important) log level + are shown. If a range is specified all + messages within the range are shown, + including both the start and the end + value of the range. + + @@ -233,6 +311,73 @@ similar. + + + + Instead of showing + journal contents show internal header + information of the journal fields + accessed. + + + + + + Shows the current disk + usage of all + journal files. + + + + + + Instead of showing + journal contents generate a new key + pair for Forward Secure Sealing + (FSS). This will generate a sealing + key and a verification key. The + sealing key is stored in the journal + data directory and shall remain on the + host. The verification key should be + stored externally. + + + + + + Specifies the change + interval for the sealing key, when + generating an FSS key pair with + . Shorter + intervals increase CPU consumption but + shorten the time range of + undetectable journal + alterations. Defaults to + 15min. + + + + + + Check the journal file + for internal consistency. If the + file has been generated with FSS + enabled, and the FSS verification key + has been specified with + + authenticity of the journal file is + verified. + + + + + + Specifies the FSS + verification key to use for the + + operation. + + @@ -259,6 +404,45 @@ + + Examples + + Without arguments all collected logs are shown + unfiltered: + + journalctl + + With one match specified all entries with a field matching the expression are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service + + If two different fields are matched only entries matching both expressions at the same time are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + + If two matches refer to the same field all entries matching either expression are shown: + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service + + If the separator "+" is used + two expressions may be combined in a logical OR. The + following will show all messages from the Avahi + service process with the PID 28097 plus all messages + from the D-Bus service (from any of its + processes): + + journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service + + Show all logs generated by the D-Bus executable: + + journalctl /usr/bin/dbus-daemon + + Show all logs of the kernel device node /dev/sda: + + journalctl /dev/sda + + + See Also