man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2012 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="journalctl"
  25           xmlns:xi="http://www.w3.org/2001/XInclude">
  26
  27         <refentryinfo>
  28                 <title>journalctl</title>
  29                 <productname>systemd</productname>
  30
  31                 <authorgroup>
  32                         <author>
  33                                 <contrib>Developer</contrib>
  34                                 <firstname>Lennart</firstname>
  35                                 <surname>Poettering</surname>
  36                                 <email>lennart@poettering.net</email>
  37                         </author>
  38                 </authorgroup>
  39         </refentryinfo>
  40
  41         <refmeta>
  42                 <refentrytitle>journalctl</refentrytitle>
  43                 <manvolnum>1</manvolnum>
  44         </refmeta>
  45
  46         <refnamediv>
  47                 <refname>journalctl</refname>
  48                 <refpurpose>Query the systemd journal</refpurpose>
  49         </refnamediv>
  50
  51         <refsynopsisdiv>
  52                 <cmdsynopsis>
  53                         <command>journalctl</command>
  54                         <arg choice="opt" rep="repeat">OPTIONS</arg>
  55                         <arg choice="opt" rep="repeat">MATCHES</arg>
  56                 </cmdsynopsis>
  57         </refsynopsisdiv>
  58
  59         <refsect1>
  60                 <title>Description</title>
  61
  62                 <para><command>journalctl</command> may be used to
  63                 query the contents of the
  64                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  65                 journal as written by
  66                 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  67
  68                 <para>If called without parameters, it will show the full
  69                 contents of the journal, starting with the oldest
  70                 entry collected.</para>
  71
  72                 <para>If one or more match arguments are passed, the
  73                 output is filtered accordingly. A match is in the
  74                 format <literal>FIELD=VALUE</literal>,
  75                 e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
  76                 referring to the components of a structured journal
  77                 entry. See
  78                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  79                 for a list of well-known fields. If multiple matches
  80                 are specified matching different fields, the log
  81                 entries are filtered by both, i.e. the resulting output
  82                 will show only entries matching all the specified
  83                 matches of this kind. If two matches apply to the same
  84                 field, then they are automatically matched as
  85                 alternatives, i.e. the resulting output will show
  86                 entries matching any of the specified matches for the
  87                 same field. Finally, if the character
  88                 <literal>+</literal> appears as a separate word on the
  89                 command line, all matches before and after are combined
  90                 in a disjunction (i.e. logical OR).</para>
  91
  92                 <para>As shortcuts for a few types of field/value
  93                 matches, file paths may be specified. If a file path
  94                 refers to an executable file, this is equivalent to an
  95                 <literal>_EXE=</literal> match for the canonicalized
  96                 binary path. Similarly, if a path refers to a device
  97                 node, this is equivalent to a
  98                 <literal>_KERNEL_DEVICE=</literal> match for the
  99                 device.</para>
 100
 101                 <para>Output is interleaved from all accessible
 102                 journal files, whether they are rotated or currently
 103                 being written, and regardless of whether they belong to the
 104                 system itself or are accessible user journals.</para>
 105
 106                 <para>All users are granted access to their private
 107                 per-user journals. However, by default, only root and
 108                 users who are members of the <literal>systemd-journal</literal>
 109                 group get access to the system journal and the
 110                 journals of other users.</para>
 111
 112                 <para>The output is paged through
 113                 <command>less</command> by default, and long lines are
 114                 "truncated" to screen width. The hidden part can be
 115                 viewed by using the left-arrow and right-arrow
 116                 keys. Paging can be disabled; see the
 117                 <option>--no-pager</option> option and the "Environment"
 118                 section below.</para>
 119
 120                 <para>When outputing to a tty, lines are colored
 121                 according to priority: lines of level ERROR and higher
 122                 are colored red; lines of level NOTICE and higher are
 123                 highlighted; other lines are displayed normally.
 124                 </para>
 125         </refsect1>
 126
 127         <refsect1>
 128                 <title>Options</title>
 129
 130                 <para>The following options are understood:</para>
 131
 132                 <variablelist>
 133                         <varlistentry>
 134                                 <term><option>-h</option></term>
 135                                 <term><option>--help</option></term>
 136
 137                                 <listitem><para>Prints a short help
 138                                 text and exits.</para></listitem>
 139                         </varlistentry>
 140
 141                         <varlistentry>
 142                                 <term><option>--version</option></term>
 143
 144                                 <listitem><para>Prints a short version
 145                                 string and exits.</para></listitem>
 146                         </varlistentry>
 147
 148                         <varlistentry>
 149                                 <term><option>--no-pager</option></term>
 150
 151                                 <listitem><para>Do not pipe output into a
 152                                 pager.</para></listitem>
 153                         </varlistentry>
 154
 155                         <varlistentry>
 156                                 <term><option>--no-full</option></term>
 157                                 <term><option>--full</option></term>
 158                                 <term><option>-l</option></term>
 159
 160                                 <listitem><para>Ellipsize fields when
 161                                 they do not fit in available columns.
 162                                 The default is to show full fields,
 163                                 allowing them to wrap or be truncated
 164                                 by the pager, if one is used.</para>
 165
 166                                 <para>The old options
 167                                 <option>-l</option>/<option>--full</option>
 168                                 are not useful anymore, except to undo
 169                                 <option>--no-full</option>.</para></listitem>
 170                         </varlistentry>
 171
 172                         <varlistentry>
 173                                 <term><option>-a</option></term>
 174                                 <term><option>--all</option></term>
 175
 176                                 <listitem><para>Show all fields in
 177                                 full, even if they include unprintable
 178                                 characters or are very
 179                                 long.</para></listitem>
 180                         </varlistentry>
 181
 182                         <varlistentry>
 183                                 <term><option>-f</option></term>
 184                                 <term><option>--follow</option></term>
 185
 186                                 <listitem><para>Show only the most recent
 187                                 journal entries, and continuously print
 188                                 new entries as they are appended to
 189                                 the journal.</para></listitem>
 190                         </varlistentry>
 191
 192                         <varlistentry>
 193                                 <term><option>-e</option></term>
 194                                 <term><option>--pager-end</option></term>
 195
 196                                 <listitem><para>Immediately jump to
 197                                 the end of the journal inside the
 198                                 implied pager tool. This implies
 199                                 <option>-n1000</option> to guarantee
 200                                 that the pager will not buffer logs of
 201                                 unbounded size. This may be overridden
 202                                 with an explicit <option>-n</option>
 203                                 with some other numeric value on the
 204                                 command line. Note that this option is
 205                                 only supported for the
 206                                 <citerefentry><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 207                                 pager.</para></listitem>
 208                         </varlistentry>
 209
 210                         <varlistentry>
 211                                 <term><option>-n</option></term>
 212                                 <term><option>--lines=</option></term>
 213
 214                                 <listitem><para>Show the most recent
 215                                 journal events and limit the number of
 216                                 events shown. If
 217                                 <option>--follow</option> is used,
 218                                 this option is implied. The argument,
 219                                 a positive integer, is optional, and
 220                                 defaults to 10. </para></listitem>
 221                         </varlistentry>
 222
 223                         <varlistentry>
 224                                 <term><option>--no-tail</option></term>
 225
 226                                 <listitem><para>Show all stored output
 227                                 lines, even in follow mode. Undoes the
 228                                 effect of
 229                                 <option>--lines=</option>.</para></listitem>
 230                         </varlistentry>
 231
 232                         <varlistentry>
 233                                 <term><option>-r</option></term>
 234                                 <term><option>--reverse</option></term>
 235
 236                                 <listitem><para>Reverse output so that the newest
 237                                 entries are displayed first.</para></listitem>
 238                         </varlistentry>
 239
 240                         <varlistentry>
 241                                 <term><option>-o</option></term>
 242                                 <term><option>--output=</option></term>
 243
 244                                 <listitem><para>Controls the
 245                                 formatting of the journal entries that
 246                                 are shown. Takes one of the following options:
 247                                 </para>
 248                                 <variablelist>
 249                                         <varlistentry>
 250                                                 <term>
 251                                                         <option>short</option>
 252                                                 </term>
 253                                                 <listitem>
 254                                                         <para>is the default
 255                                                         and generates an output
 256                                                         that is mostly identical
 257                                                         to the formatting of
 258                                                         classic syslog files,
 259                                                         showing one line per
 260                                                         journal entry.</para>
 261                                                 </listitem>
 262                                         </varlistentry>
 263
 264                                         <varlistentry>
 265                                                 <term>
 266                                                         <option>short-iso</option>
 267                                                 </term>
 268                                                 <listitem>
 269                                                         <para>is very similar,
 270                                                         but shows ISO 8601
 271                                                         wallclock timestamps.
 272                                                         </para>
 273                                                 </listitem>
 274                                         </varlistentry>
 275
 276                                         <varlistentry>
 277                                                 <term>
 278                                                         <option>short-precise</option>
 279                                                 </term>
 280                                                 <listitem>
 281                                                         <para>is very similar,
 282                                                         but shows timestamps
 283                                                         with full microsecond
 284                                                         precision.
 285                                                         </para>
 286                                                 </listitem>
 287                                         </varlistentry>
 288
 289                                         <varlistentry>
 290                                                 <term>
 291                                                         <option>short-monotonic</option>
 292                                                 </term>
 293                                                 <listitem>
 294                                                         <para>is very similar,
 295                                                         but shows monotonic
 296                                                         timestamps instead of
 297                                                         wallclock timestamps.
 298                                                         </para>
 299                                                 </listitem>
 300                                         </varlistentry>
 301
 302                                         <varlistentry>
 303                                                 <term>
 304                                                         <option>verbose</option>
 305                                                 </term>
 306                                                 <listitem>
 307                                                         <para>shows the
 308                                                         full-structured entry
 309                                                         items with all fields.
 310                                                         </para>
 311                                                 </listitem>
 312                                         </varlistentry>
 313
 314                                         <varlistentry>
 315                                                 <term>
 316                                                         <option>export</option>
 317                                                 </term>
 318                                                 <listitem>
 319                                                         <para>serializes the
 320                                                         journal into a binary
 321                                                         (but mostly text-based)
 322                                                         stream suitable for
 323                                                         backups and network
 324                                                         transfer (see <ulink
 325                                                         url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
 326                                                         Export Format</ulink>
 327                                                         for more
 328                                                         information).</para>
 329                                                 </listitem>
 330                                         </varlistentry>
 331
 332                                         <varlistentry>
 333                                                 <term>
 334                                                         <option>json</option>
 335                                                 </term>
 336                                                 <listitem>
 337                                                         <para>formats entries
 338                                                         as JSON data structures,
 339                                                         one per line (see <ulink
 340                                                         url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
 341                                                         JSON Format</ulink> for
 342                                                         more information).</para>
 343                                                 </listitem>
 344                                         </varlistentry>
 345
 346                                         <varlistentry>
 347                                                 <term>
 348                                                         <option>json-pretty</option>
 349                                                 </term>
 350                                                 <listitem>
 351                                                         <para>formats entries as
 352                                                         JSON data structures,
 353                                                         but formats them in
 354                                                         multiple lines in order
 355                                                         to make them more
 356                                                         readable by humans.</para>
 357                                                 </listitem>
 358                                         </varlistentry>
 359
 360                                         <varlistentry>
 361                                                 <term>
 362                                                         <option>json-sse</option>
 363                                                 </term>
 364                                                 <listitem>
 365                                                         <para>formats entries as
 366                                                         JSON data structures,
 367                                                         but wraps them in a
 368                                                         format suitable for <ulink
 369                                                         url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
 370                                                         Events</ulink>.</para>
 371                                                 </listitem>
 372                                         </varlistentry>
 373
 374                                         <varlistentry>
 375                                                 <term>
 376                                                         <option>cat</option>
 377                                                 </term>
 378                                                 <listitem>
 379                                                         <para>generates a very
 380                                                         terse output, only
 381                                                         showing the actual
 382                                                         message of each journal
 383                                                         entry with no meta data,
 384                                                         not even a timestamp.
 385                                                         </para>
 386                                                 </listitem>
 387                                         </varlistentry>
 388                                 </variablelist>
 389                                 </listitem>
 390                         </varlistentry>
 391
 392                         <varlistentry>
 393                                 <term><option>-x</option></term>
 394                                 <term><option>--catalog</option></term>
 395
 396                                 <listitem><para>Augment log lines with
 397                                 explanation texts from the message
 398                                 catalog. This will add explanatory
 399                                 help texts to log messages in the
 400                                 output where this is available. These
 401                                 short help texts will explain the
 402                                 context of an error or log event,
 403                                 possible solutions, as well as
 404                                 pointers to support forums, developer
 405                                 documentation, and any other relevant
 406                                 manuals. Note that help texts are not
 407                                 available for all messages, but only
 408                                 for selected ones. For more
 409                                 information on the message catalog,
 410                                 please refer to the <ulink
 411                                 url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
 412                                 Catalog Developer
 413                                 Documentation</ulink>.</para>
 414
 415                                 <para>Note: when attaching
 416                                 <command>journalctl</command> output
 417                                 to bug reports, please do
 418                                 <emphasis>not</emphasis> use
 419                                 <option>-x</option>.</para>
 420                                 </listitem>
 421                         </varlistentry>
 422
 423                         <varlistentry>
 424                                 <term><option>-q</option></term>
 425                                 <term><option>--quiet</option></term>
 426
 427                                 <listitem><para>Suppresses any warning
 428                                 messages regarding inaccessible system
 429                                 journals when run as a normal
 430                                 user.</para></listitem>
 431                         </varlistentry>
 432
 433                         <varlistentry>
 434                                 <term><option>-m</option></term>
 435                                 <term><option>--merge</option></term>
 436
 437                                 <listitem><para>Show entries
 438                                 interleaved from all available
 439                                 journals, including remote
 440                                 ones.</para></listitem>
 441                         </varlistentry>
 442
 443                         <varlistentry>
 444                                 <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 445                                 <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 446
 447                                 <listitem><para>Show messages from a specific
 448                                 boot. This will add a match for
 449                                 <literal>_BOOT_ID=</literal>.</para>
 450
 451                                 <para>The argument may be empty, in which case
 452                                 logs for the current boot will be shown.</para>
 453
 454                                 <para>If the boot ID is omitted, a positive
 455                                 <replaceable>offset</replaceable> will look up
 456                                 the boots starting from the beginning of the
 457                                 journal, and a equal-or-less-than zero
 458                                 <replaceable>offset</replaceable> will look up
 459                                 boots starting from the end of the
 460                                 journal. Thus, <constant>1</constant> means the
 461                                 first boot found in the journal in
 462                                 chronological order, <constant>2</constant> the
 463                                 second and so on; while <constant>-0</constant>
 464                                 is the last boot, <constant>-1</constant> the
 465                                 boot before last, and so on. An empty
 466                                 <replaceable>offset</replaceable> is equivalent
 467                                 to specifying <constant>-0</constant>, except
 468                                 when the current boot is not the last boot
 469                                 (e.g. because <option>--directory</option> was
 470                                 specified to look at logs from a different
 471                                 machine).</para>
 472
 473                                 <para>If the 32-character
 474                                 <replaceable>ID</replaceable> is specified, it
 475                                 may optionally be followed by
 476                                 <replaceable>offset</replaceable> which
 477                                 identifies the boot relative to the one given by
 478                                 boot <replaceable>ID</replaceable>. Negative
 479                                 values mean earlier boots and a positive values
 480                                 mean later boots. If
 481                                 <replaceable>offset</replaceable> is not
 482                                 specified, a value of zero is assumed, and the
 483                                 logs for the boot given by
 484                                 <replaceable>ID</replaceable> are shown.
 485                                 </para>
 486
 487                                 </listitem>
 488                         </varlistentry>
 489
 490                         <varlistentry>
 491                                 <term><option>--list-boots</option></term>
 492
 493                                 <listitem><para>Show a tabular list of
 494                                 boot numbers (relative to the current
 495                                 boot), their IDs, and the timestamps
 496                                 of the first and last message
 497                                 pertaining to the boot.
 498                                 </para></listitem>
 499                         </varlistentry>
 500
 501                         <varlistentry>
 502                                 <term><option>-k</option></term>
 503                                 <term><option>--dmesg</option></term>
 504
 505                                 <listitem><para>Show only kernel messages. This
 506                                 implies <option>-b</option> and adds the match
 507                                 <literal>_TRANSPORT=kernel</literal>.
 508                                 </para></listitem>
 509                         </varlistentry>
 510
 511                         <varlistentry>
 512                                 <term><option>-u</option></term>
 513                                 <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 514
 515                                 <listitem><para>Show messages for the
 516                                 specified systemd unit
 517                                 <replaceable>UNIT</replaceable>, or
 518                                 for any of the units matched by
 519                                 <replaceable>PATTERN</replaceable>.
 520                                 If a pattern is specified, a list of
 521                                 unit names found in the journal is
 522                                 compared with the specified pattern
 523                                 and all that match are used. For each
 524                                 unit name a match is added for
 525                                 messages from the unit
 526                                 (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>)
 527                                 along with additional matches for
 528                                 messages from systemd and messages
 529                                 about coredumps for the specified
 530                                 unit.</para>
 531
 532                                 <para>This parameter can be specified
 533                                 multiple times. </para></listitem>
 534                         </varlistentry>
 535
 536                         <varlistentry>
 537                                 <term><option>--user-unit=</option></term>
 538
 539                                 <listitem><para>Show messages for the
 540                                 specified user session unit. This will
 541                                 add a match for messages from the unit
 542                                 (<literal>_SYSTEMD_USER_UNIT=</literal>
 543                                 and <literal>_UID=</literal>) and
 544                                 additional matches for messages from
 545                                 session systemd and messages about
 546                                 coredumps for the specified unit.</para>
 547                                 <para>This parameter can be specified multiple times.
 548                                 </para></listitem>
 549                         </varlistentry>
 550
 551                         <varlistentry>
 552                                 <term><option>-p</option></term>
 553                                 <term><option>--priority=</option></term>
 554
 555                                 <listitem><para>Filter output by
 556                                 message priorities or priority
 557                                 ranges. Takes either a single numeric
 558                                 or textual log level (i.e. between
 559                                 0/<literal>emerg</literal> and
 560                                 7/<literal>debug</literal>), or a
 561                                 range of numeric/text log levels in
 562                                 the form FROM..TO. The log levels are
 563                                 the usual syslog log levels as
 564                                 documented in
 565                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 566                                 i.e. <literal>emerg</literal> (0),
 567                                 <literal>alert</literal> (1),
 568                                 <literal>crit</literal> (2),
 569                                 <literal>err</literal> (3),
 570                                 <literal>warning</literal> (4),
 571                                 <literal>notice</literal> (5),
 572                                 <literal>info</literal> (6),
 573                                 <literal>debug</literal> (7). If a
 574                                 single log level is specified, all
 575                                 messages with this log level or a
 576                                 lower (hence more important) log level
 577                                 are shown. If a range is specified, all
 578                                 messages within the range are shown,
 579                                 including both the start and the end
 580                                 value of the range. This will add
 581                                 <literal>PRIORITY=</literal> matches
 582                                 for the specified
 583                                 priorities.</para></listitem>
 584                         </varlistentry>
 585
 586                         <varlistentry>
 587                                 <term><option>-c</option></term>
 588                                 <term><option>--cursor=</option></term>
 589
 590                                 <listitem><para>Start showing entries
 591                                 from the location in the journal
 592                                 specified by the passed
 593                                 cursor.</para></listitem>
 594                         </varlistentry>
 595
 596                         <varlistentry>
 597                                 <term><option>--after-cursor=</option></term>
 598
 599                                 <listitem><para>Start showing entries
 600                                 from the location in the journal
 601                                 <emphasis>after</emphasis> the
 602                                 location specified by the this cursor.
 603                                 The cursor is shown when the
 604                                 <option>--show-cursor</option> option
 605                                 is used.</para></listitem>
 606                         </varlistentry>
 607
 608                         <varlistentry>
 609                                 <term><option>--show-cursor</option></term>
 610
 611                                 <listitem><para>The cursor is shown after the last
 612                                 entry after two dashes:</para>
 613                                 <programlisting>-- cursor: s=0639...</programlisting>
 614                                 <para>The format of the cursor is private
 615                                 and subject to change.</para></listitem>
 616                         </varlistentry>
 617
 618                         <varlistentry>
 619                                 <term><option>--since=</option></term>
 620                                 <term><option>--until=</option></term>
 621
 622                                 <listitem><para>Start showing entries
 623                                 on or newer than the specified date,
 624                                 or on or older than the specified
 625                                 date, respectively. Date specifications
 626                                 should be of the format
 627                                 <literal>2012-10-30 18:17:16</literal>.
 628                                 If the time part is omitted,
 629                                 <literal>00:00:00</literal> is assumed.
 630                                 If only the seconds component is omitted,
 631                                 <literal>:00</literal> is assumed. If the
 632                                 date component is omitted, the current
 633                                 day is assumed. Alternatively the strings
 634                                 <literal>yesterday</literal>,
 635                                 <literal>today</literal>,
 636                                 <literal>tomorrow</literal> are
 637                                 understood, which refer to 00:00:00 of
 638                                 the day before the current day, the
 639                                 current day, or the day after the
 640                                 current day, respectively. <literal>now</literal>
 641                                 refers to the current time. Finally,
 642                                 relative times may be specified,
 643                                 prefixed with <literal>-</literal> or
 644                                 <literal>+</literal>, referring to
 645                                 times before or after the current
 646                                 time, respectively.</para></listitem>
 647                         </varlistentry>
 648
 649                         <varlistentry>
 650                                 <term><option>-F</option></term>
 651                                 <term><option>--field=</option></term>
 652
 653                                 <listitem><para>Print all possible
 654                                 data values the specified field can
 655                                 take in all entries of the
 656                                 journal.</para></listitem>
 657                         </varlistentry>
 658
 659                         <varlistentry>
 660                                 <term><option>--system</option></term>
 661                                 <term><option>--user</option></term>
 662
 663                                 <listitem><para>Show messages from
 664                                 system services and the kernel (with
 665                                 <option>--system</option>). Show
 666                                 messages from service of current user
 667                                 (with <option>--user</option>).
 668                                 If neither is specified, show all
 669                                 messages that the user can see.
 670                                 </para></listitem>
 671                         </varlistentry>
 672
 673                         <varlistentry>
 674                                 <term><option>-M</option></term>
 675                                 <term><option>--machine=</option></term>
 676
 677                                 <listitem><para>Show messages from a
 678                                 running, local container. Specify a
 679                                 container name to connect
 680                                 to.</para></listitem>
 681                         </varlistentry>
 682
 683                         <varlistentry>
 684                                 <term><option>-D <replaceable>DIR</replaceable></option></term>
 685                                 <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 686
 687                                 <listitem><para>Takes a directory path
 688                                 as argument. If specified, journalctl
 689                                 will operate on the specified journal
 690                                 directory
 691                                 <replaceable>DIR</replaceable> instead
 692                                 of the default runtime and system
 693                                 journal paths.</para></listitem>
 694                         </varlistentry>
 695
 696                         <varlistentry>
 697                                 <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 698
 699                                 <listitem><para>Takes a file glob as an
 700                                 argument. If specified, journalctl will
 701                                 operate on the specified journal files
 702                                 matching <replaceable>GLOB</replaceable>
 703                                 instead of the default runtime and
 704                                 system journal paths. May be specified
 705                                 multiple times, in which case files will
 706                                 be suitably interleaved.</para></listitem>
 707                         </varlistentry>
 708
 709                         <varlistentry>
 710                                 <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 711
 712                                 <listitem><para>Takes a directory path
 713                                 as an argument. If specified, journalctl
 714                                 will operate on catalog file hierarchy
 715                                 underneath the specified directory
 716                                 instead of the root directory
 717                                 (e.g. <option>--update-catalog</option>
 718                                 will create
 719                                 <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).
 720                                 </para></listitem>
 721                         </varlistentry>
 722
 723                         <varlistentry>
 724                                 <term><option>--new-id128</option></term>
 725
 726                                 <listitem><para>Instead of showing
 727                                 journal contents, generate a new 128-bit
 728                                 ID suitable for identifying
 729                                 messages. This is intended for usage
 730                                 by developers who need a new
 731                                 identifier for a new message they
 732                                 introduce and want to make
 733                                 recognizable. This will print the new ID in
 734                                 three different formats which can be
 735                                 copied into source code or
 736                                 similar.</para></listitem>
 737                         </varlistentry>
 738
 739                         <varlistentry>
 740                                 <term><option>--header</option></term>
 741
 742                                 <listitem><para>Instead of showing
 743                                 journal contents, show internal header
 744                                 information of the journal fields
 745                                 accessed.</para></listitem>
 746                         </varlistentry>
 747
 748                         <varlistentry>
 749                                 <term><option>--disk-usage</option></term>
 750
 751                                 <listitem><para>Shows the current disk
 752                                 usage of all
 753                                 journal files.</para></listitem>
 754                         </varlistentry>
 755
 756                         <varlistentry>
 757                                 <term><option>--list-catalog
 758                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 759                                 </option></term>
 760
 761                                 <listitem><para>List the contents of
 762                                 the message catalog as a table of
 763                                 message IDs, plus their short
 764                                 description strings.</para>
 765
 766                                 <para>If any
 767                                 <replaceable>128-bit-ID</replaceable>s are
 768                                 specified, only those entries are shown.
 769                                 </para>
 770                                 </listitem>
 771                         </varlistentry>
 772
 773                         <varlistentry>
 774                                 <term><option>--dump-catalog
 775                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 776                                 </option></term>
 777
 778                                 <listitem><para>Show the contents of
 779                                 the message catalog, with entries
 780                                 separated by a line consisting of two
 781                                 dashes and the ID (the format is the
 782                                 same as <filename>.catalog</filename>
 783                                 files).</para>
 784
 785                                 <para>If any
 786                                 <replaceable>128-bit-ID</replaceable>s are
 787                                 specified, only those entries are shown.
 788                                 </para>
 789                                 </listitem>
 790                         </varlistentry>
 791
 792                         <varlistentry>
 793                                 <term><option>--update-catalog</option></term>
 794
 795                                 <listitem><para>Update the message
 796                                 catalog index. This command needs to
 797                                 be executed each time new catalog
 798                                 files are installed, removed, or
 799                                 updated to rebuild the binary catalog
 800                                 index.</para></listitem>
 801                         </varlistentry>
 802
 803                         <varlistentry>
 804                                 <term><option>--setup-keys</option></term>
 805
 806                                 <listitem><para>Instead of showing
 807                                 journal contents, generate a new key
 808                                 pair for Forward Secure Sealing
 809                                 (FSS). This will generate a sealing
 810                                 key and a verification key. The
 811                                 sealing key is stored in the journal
 812                                 data directory and shall remain on the
 813                                 host. The verification key should be
 814                                 stored externally. Refer to the
 815                                 <option>Seal=</option> option in
 816                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 817                                 for information on Forward Secure
 818                                 Sealing and for a link to a refereed
 819                                 scholarly paper detailing the
 820                                 cryptographic theory it is based on.
 821                                 </para></listitem>
 822                         </varlistentry>
 823
 824                         <varlistentry>
 825                                 <term><option>--force</option></term>
 826
 827                                 <listitem><para>When
 828                                 <option>--setup-keys</option> is passed and
 829                                 Forward Secure Sealing (FSS) has already been
 830                                 configured, recreate FSS keys.</para></listitem>
 831                         </varlistentry>
 832
 833                         <varlistentry>
 834                                 <term><option>--interval=</option></term>
 835
 836                                 <listitem><para>Specifies the change
 837                                 interval for the sealing key when
 838                                 generating an FSS key pair with
 839                                 <option>--setup-keys</option>. Shorter
 840                                 intervals increase CPU consumption but
 841                                 shorten the time range of
 842                                 undetectable journal
 843                                 alterations. Defaults to
 844                                 15min.</para></listitem>
 845                         </varlistentry>
 846
 847                         <varlistentry>
 848                                 <term><option>--verify</option></term>
 849
 850                                 <listitem><para>Check the journal file
 851                                 for internal consistency. If the
 852                                 file has been generated with FSS
 853                                 enabled and the FSS verification key
 854                                 has been specified with
 855                                 <option>--verify-key=</option>,
 856                                 authenticity of the journal file is
 857                                 verified.</para></listitem>
 858                         </varlistentry>
 859
 860                         <varlistentry>
 861                                 <term><option>--verify-key=</option></term>
 862
 863                                 <listitem><para>Specifies the FSS
 864                                 verification key to use for the
 865                                 <option>--verify</option>
 866                                 operation.</para></listitem>
 867                         </varlistentry>
 868
 869                 </variablelist>
 870         </refsect1>
 871
 872         <refsect1>
 873                 <title>Exit status</title>
 874
 875                 <para>On success, 0 is returned; otherwise, a non-zero
 876                 failure code is returned.</para>
 877         </refsect1>
 878
 879         <xi:include href="less-variables.xml" />
 880
 881         <refsect1>
 882                 <title>Examples</title>
 883
 884                 <para>Without arguments, all collected logs are shown
 885                 unfiltered:</para>
 886
 887                 <programlisting>journalctl</programlisting>
 888
 889                 <para>With one match specified, all entries with a field matching the expression are shown:</para>
 890
 891                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
 892
 893                 <para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>
 894
 895                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 896
 897                 <para>If two matches refer to the same field, all entries matching either expression are shown:</para>
 898
 899                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 900
 901                 <para>If the separator <literal>+</literal> is used,
 902                 two expressions may be combined in a logical OR. The
 903                 following will show all messages from the Avahi
 904                 service process with the PID 28097 plus all messages
 905                 from the D-Bus service (from any of its
 906                 processes):</para>
 907
 908                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 909
 910                 <para>Show all logs generated by the D-Bus executable:</para>
 911
 912                 <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 913
 914                 <para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>
 915
 916                 <programlisting>journalctl /dev/sda</programlisting>
 917
 918                 <para>Show all kernel logs from previous boot:</para>
 919
 920                 <programlisting>journalctl -k -b -1</programlisting>
 921
 922         </refsect1>
 923
 924         <refsect1>
 925                 <title>See Also</title>
 926                 <para>
 927                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 928                         <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 929                         <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 930                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 931                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 932                 </para>
 933         </refsect1>
 934
 935 </refentry>