man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2012 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="journalctl"
  25           xmlns:xi="http://www.w3.org/2001/XInclude">
  26
  27         <refentryinfo>
  28                 <title>journalctl</title>
  29                 <productname>systemd</productname>
  30
  31                 <authorgroup>
  32                         <author>
  33                                 <contrib>Developer</contrib>
  34                                 <firstname>Lennart</firstname>
  35                                 <surname>Poettering</surname>
  36                                 <email>lennart@poettering.net</email>
  37                         </author>
  38                 </authorgroup>
  39         </refentryinfo>
  40
  41         <refmeta>
  42                 <refentrytitle>journalctl</refentrytitle>
  43                 <manvolnum>1</manvolnum>
  44         </refmeta>
  45
  46         <refnamediv>
  47                 <refname>journalctl</refname>
  48                 <refpurpose>Query the systemd journal</refpurpose>
  49         </refnamediv>
  50
  51         <refsynopsisdiv>
  52                 <cmdsynopsis>
  53                         <command>journalctl</command>
  54                         <arg choice="opt" rep="repeat">OPTIONS</arg>
  55                         <arg choice="opt" rep="repeat">MATCHES</arg>
  56                 </cmdsynopsis>
  57         </refsynopsisdiv>
  58
  59         <refsect1>
  60                 <title>Description</title>
  61
  62                 <para><command>journalctl</command> may be used to
  63                 query the contents of the
  64                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  65                 journal as written by
  66                 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  67
  68                 <para>If called without parameters, it will show the full
  69                 contents of the journal, starting with the oldest
  70                 entry collected.</para>
  71
  72                 <para>If one or more match arguments are passed, the
  73                 output is filtered accordingly. A match is in the
  74                 format <literal>FIELD=VALUE</literal>,
  75                 e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
  76                 referring to the components of a structured journal
  77                 entry. See
  78                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  79                 for a list of well-known fields. If multiple matches
  80                 are specified matching different fields, the log
  81                 entries are filtered by both, i.e. the resulting output
  82                 will show only entries matching all the specified
  83                 matches of this kind. If two matches apply to the same
  84                 field, then they are automatically matched as
  85                 alternatives, i.e. the resulting output will show
  86                 entries matching any of the specified matches for the
  87                 same field. Finally, the character
  88                 <literal>+</literal> may appears as a separate word
  89                 between other terms on the command line. This causes
  90                 all matches before and after to be combined in a
  91                 disjunction (i.e. logical OR).</para>
  92
  93                 <para>As shortcuts for a few types of field/value
  94                 matches, file paths may be specified. If a file path
  95                 refers to an executable file, this is equivalent to an
  96                 <literal>_EXE=</literal> match for the canonicalized
  97                 binary path. Similarly, if a path refers to a device
  98                 node, this is equivalent to a
  99                 <literal>_KERNEL_DEVICE=</literal> match for the
 100                 device.</para>
 101
 102                 <para>Additional constraints may be added using options
 103                 <option>--boot</option>, <option>--unit=</option>,
 104                 etc, to further limit what entries will be shown
 105                 (logical AND).</para>
 106
 107                 <para>Output is interleaved from all accessible
 108                 journal files, whether they are rotated or currently
 109                 being written, and regardless of whether they belong to the
 110                 system itself or are accessible user journals.</para>
 111
 112                 <para>The set of journal files which will be used
 113                 can be modified using the <option>--user</option>,
 114                 <option>--system</option>, <option>--directory</option>,
 115                 and <option>--file</option> options, see below.</para>
 116
 117                 <para>All users are granted access to their private
 118                 per-user journals. However, by default, only root and
 119                 users who are members of the <literal>systemd-journal</literal>
 120                 group get access to the system journal and the
 121                 journals of other users.</para>
 122
 123                 <para>The output is paged through
 124                 <command>less</command> by default, and long lines are
 125                 "truncated" to screen width. The hidden part can be
 126                 viewed by using the left-arrow and right-arrow
 127                 keys. Paging can be disabled; see the
 128                 <option>--no-pager</option> option and the "Environment"
 129                 section below.</para>
 130
 131                 <para>When outputting to a tty, lines are colored
 132                 according to priority: lines of level ERROR and higher
 133                 are colored red; lines of level NOTICE and higher are
 134                 highlighted; other lines are displayed normally.
 135                 </para>
 136         </refsect1>
 137
 138         <refsect1>
 139                 <title>Options</title>
 140
 141                 <para>The following options are understood:</para>
 142
 143                 <variablelist>
 144                         <varlistentry>
 145                                 <term><option>--no-full</option></term>
 146                                 <term><option>--full</option></term>
 147                                 <term><option>-l</option></term>
 148
 149                                 <listitem><para>Ellipsize fields when
 150                                 they do not fit in available columns.
 151                                 The default is to show full fields,
 152                                 allowing them to wrap or be truncated
 153                                 by the pager, if one is used.</para>
 154
 155                                 <para>The old options
 156                                 <option>-l</option>/<option>--full</option>
 157                                 are not useful anymore, except to undo
 158                                 <option>--no-full</option>.</para></listitem>
 159                         </varlistentry>
 160
 161                         <varlistentry>
 162                                 <term><option>-a</option></term>
 163                                 <term><option>--all</option></term>
 164
 165                                 <listitem><para>Show all fields in
 166                                 full, even if they include unprintable
 167                                 characters or are very
 168                                 long.</para></listitem>
 169                         </varlistentry>
 170
 171                         <varlistentry>
 172                                 <term><option>-f</option></term>
 173                                 <term><option>--follow</option></term>
 174
 175                                 <listitem><para>Show only the most recent
 176                                 journal entries, and continuously print
 177                                 new entries as they are appended to
 178                                 the journal.</para></listitem>
 179                         </varlistentry>
 180
 181                         <varlistentry>
 182                                 <term><option>-e</option></term>
 183                                 <term><option>--pager-end</option></term>
 184
 185                                 <listitem><para>Immediately jump to
 186                                 the end of the journal inside the
 187                                 implied pager tool. This implies
 188                                 <option>-n1000</option> to guarantee
 189                                 that the pager will not buffer logs of
 190                                 unbounded size. This may be overridden
 191                                 with an explicit <option>-n</option>
 192                                 with some other numeric value on the
 193                                 command line. Note that this option is
 194                                 only supported for the
 195                                 <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 196                                 pager.</para></listitem>
 197                         </varlistentry>
 198
 199                         <varlistentry>
 200                                 <term><option>-n</option></term>
 201                                 <term><option>--lines=</option></term>
 202
 203                                 <listitem><para>Show the most recent
 204                                 journal events and limit the number of
 205                                 events shown. If
 206                                 <option>--follow</option> is used,
 207                                 this option is implied. The argument,
 208                                 a positive integer, is optional, and
 209                                 defaults to 10. </para></listitem>
 210                         </varlistentry>
 211
 212                         <varlistentry>
 213                                 <term><option>--no-tail</option></term>
 214
 215                                 <listitem><para>Show all stored output
 216                                 lines, even in follow mode. Undoes the
 217                                 effect of
 218                                 <option>--lines=</option>.</para></listitem>
 219                         </varlistentry>
 220
 221                         <varlistentry>
 222                                 <term><option>-r</option></term>
 223                                 <term><option>--reverse</option></term>
 224
 225                                 <listitem><para>Reverse output so that the newest
 226                                 entries are displayed first.</para></listitem>
 227                         </varlistentry>
 228
 229                         <varlistentry>
 230                                 <term><option>-o</option></term>
 231                                 <term><option>--output=</option></term>
 232
 233                                 <listitem><para>Controls the
 234                                 formatting of the journal entries that
 235                                 are shown. Takes one of the following options:
 236                                 </para>
 237                                 <variablelist>
 238                                         <varlistentry>
 239                                                 <term>
 240                                                         <option>short</option>
 241                                                 </term>
 242                                                 <listitem>
 243                                                         <para>is the default
 244                                                         and generates an output
 245                                                         that is mostly identical
 246                                                         to the formatting of
 247                                                         classic syslog files,
 248                                                         showing one line per
 249                                                         journal entry.</para>
 250                                                 </listitem>
 251                                         </varlistentry>
 252
 253                                         <varlistentry>
 254                                                 <term>
 255                                                         <option>short-iso</option>
 256                                                 </term>
 257                                                 <listitem>
 258                                                         <para>is very similar,
 259                                                         but shows ISO 8601
 260                                                         wallclock timestamps.
 261                                                         </para>
 262                                                 </listitem>
 263                                         </varlistentry>
 264
 265                                         <varlistentry>
 266                                                 <term>
 267                                                         <option>short-precise</option>
 268                                                 </term>
 269                                                 <listitem>
 270                                                         <para>is very similar,
 271                                                         but shows timestamps
 272                                                         with full microsecond
 273                                                         precision.
 274                                                         </para>
 275                                                 </listitem>
 276                                         </varlistentry>
 277
 278                                         <varlistentry>
 279                                                 <term>
 280                                                         <option>short-monotonic</option>
 281                                                 </term>
 282                                                 <listitem>
 283                                                         <para>is very similar,
 284                                                         but shows monotonic
 285                                                         timestamps instead of
 286                                                         wallclock timestamps.
 287                                                         </para>
 288                                                 </listitem>
 289                                         </varlistentry>
 290
 291                                         <varlistentry>
 292                                                 <term>
 293                                                         <option>verbose</option>
 294                                                 </term>
 295                                                 <listitem>
 296                                                         <para>shows the
 297                                                         full-structured entry
 298                                                         items with all fields.
 299                                                         </para>
 300                                                 </listitem>
 301                                         </varlistentry>
 302
 303                                         <varlistentry>
 304                                                 <term>
 305                                                         <option>export</option>
 306                                                 </term>
 307                                                 <listitem>
 308                                                         <para>serializes the
 309                                                         journal into a binary
 310                                                         (but mostly text-based)
 311                                                         stream suitable for
 312                                                         backups and network
 313                                                         transfer (see <ulink
 314                                                         url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
 315                                                         Export Format</ulink>
 316                                                         for more
 317                                                         information).</para>
 318                                                 </listitem>
 319                                         </varlistentry>
 320
 321                                         <varlistentry>
 322                                                 <term>
 323                                                         <option>json</option>
 324                                                 </term>
 325                                                 <listitem>
 326                                                         <para>formats entries
 327                                                         as JSON data structures,
 328                                                         one per line (see <ulink
 329                                                         url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
 330                                                         JSON Format</ulink> for
 331                                                         more information).</para>
 332                                                 </listitem>
 333                                         </varlistentry>
 334
 335                                         <varlistentry>
 336                                                 <term>
 337                                                         <option>json-pretty</option>
 338                                                 </term>
 339                                                 <listitem>
 340                                                         <para>formats entries as
 341                                                         JSON data structures,
 342                                                         but formats them in
 343                                                         multiple lines in order
 344                                                         to make them more
 345                                                         readable by humans.</para>
 346                                                 </listitem>
 347                                         </varlistentry>
 348
 349                                         <varlistentry>
 350                                                 <term>
 351                                                         <option>json-sse</option>
 352                                                 </term>
 353                                                 <listitem>
 354                                                         <para>formats entries as
 355                                                         JSON data structures,
 356                                                         but wraps them in a
 357                                                         format suitable for <ulink
 358                                                         url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
 359                                                         Events</ulink>.</para>
 360                                                 </listitem>
 361                                         </varlistentry>
 362
 363                                         <varlistentry>
 364                                                 <term>
 365                                                         <option>cat</option>
 366                                                 </term>
 367                                                 <listitem>
 368                                                         <para>generates a very
 369                                                         terse output, only
 370                                                         showing the actual
 371                                                         message of each journal
 372                                                         entry with no metadata,
 373                                                         not even a timestamp.
 374                                                         </para>
 375                                                 </listitem>
 376                                         </varlistentry>
 377                                 </variablelist>
 378                                 </listitem>
 379                         </varlistentry>
 380
 381                         <varlistentry>
 382                                 <term><option>-x</option></term>
 383                                 <term><option>--catalog</option></term>
 384
 385                                 <listitem><para>Augment log lines with
 386                                 explanation texts from the message
 387                                 catalog. This will add explanatory
 388                                 help texts to log messages in the
 389                                 output where this is available. These
 390                                 short help texts will explain the
 391                                 context of an error or log event,
 392                                 possible solutions, as well as
 393                                 pointers to support forums, developer
 394                                 documentation, and any other relevant
 395                                 manuals. Note that help texts are not
 396                                 available for all messages, but only
 397                                 for selected ones. For more
 398                                 information on the message catalog,
 399                                 please refer to the <ulink
 400                                 url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
 401                                 Catalog Developer
 402                                 Documentation</ulink>.</para>
 403
 404                                 <para>Note: when attaching
 405                                 <command>journalctl</command> output
 406                                 to bug reports, please do
 407                                 <emphasis>not</emphasis> use
 408                                 <option>-x</option>.</para>
 409                                 </listitem>
 410                         </varlistentry>
 411
 412                         <varlistentry>
 413                                 <term><option>-q</option></term>
 414                                 <term><option>--quiet</option></term>
 415
 416                                 <listitem><para>Suppresses any warning
 417                                 messages regarding inaccessible system
 418                                 journals when run as a normal
 419                                 user.</para></listitem>
 420                         </varlistentry>
 421
 422                         <varlistentry>
 423                                 <term><option>-m</option></term>
 424                                 <term><option>--merge</option></term>
 425
 426                                 <listitem><para>Show entries
 427                                 interleaved from all available
 428                                 journals, including remote
 429                                 ones.</para></listitem>
 430                         </varlistentry>
 431
 432                         <varlistentry>
 433                                 <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 434                                 <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 435
 436                                 <listitem><para>Show messages from a specific
 437                                 boot. This will add a match for
 438                                 <literal>_BOOT_ID=</literal>.</para>
 439
 440                                 <para>The argument may be empty, in which case
 441                                 logs for the current boot will be shown.</para>
 442
 443                                 <para>If the boot ID is omitted, a positive
 444                                 <replaceable>offset</replaceable> will look up
 445                                 the boots starting from the beginning of the
 446                                 journal, and a equal-or-less-than zero
 447                                 <replaceable>offset</replaceable> will look up
 448                                 boots starting from the end of the
 449                                 journal. Thus, <constant>1</constant> means the
 450                                 first boot found in the journal in
 451                                 chronological order, <constant>2</constant> the
 452                                 second and so on; while <constant>-0</constant>
 453                                 is the last boot, <constant>-1</constant> the
 454                                 boot before last, and so on. An empty
 455                                 <replaceable>offset</replaceable> is equivalent
 456                                 to specifying <constant>-0</constant>, except
 457                                 when the current boot is not the last boot
 458                                 (e.g. because <option>--directory</option> was
 459                                 specified to look at logs from a different
 460                                 machine).</para>
 461
 462                                 <para>If the 32-character
 463                                 <replaceable>ID</replaceable> is specified, it
 464                                 may optionally be followed by
 465                                 <replaceable>offset</replaceable> which
 466                                 identifies the boot relative to the one given by
 467                                 boot <replaceable>ID</replaceable>. Negative
 468                                 values mean earlier boots and a positive values
 469                                 mean later boots. If
 470                                 <replaceable>offset</replaceable> is not
 471                                 specified, a value of zero is assumed, and the
 472                                 logs for the boot given by
 473                                 <replaceable>ID</replaceable> are shown.
 474                                 </para>
 475
 476                                 </listitem>
 477                         </varlistentry>
 478
 479                         <varlistentry>
 480                                 <term><option>--list-boots</option></term>
 481
 482                                 <listitem><para>Show a tabular list of
 483                                 boot numbers (relative to the current
 484                                 boot), their IDs, and the timestamps
 485                                 of the first and last message
 486                                 pertaining to the boot.
 487                                 </para></listitem>
 488                         </varlistentry>
 489
 490                         <varlistentry>
 491                                 <term><option>-k</option></term>
 492                                 <term><option>--dmesg</option></term>
 493
 494                                 <listitem><para>Show only kernel messages. This
 495                                 implies <option>-b</option> and adds the match
 496                                 <literal>_TRANSPORT=kernel</literal>.
 497                                 </para></listitem>
 498                         </varlistentry>
 499
 500                         <varlistentry>
 501                                 <term><option>-t</option></term>
 502                                 <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 503
 504                                 <listitem><para>Show messages for the
 505                                 specified syslog identifier
 506                                 <replaceable>SYSLOG_IDENTIFIER</replaceable>, or
 507                                 for any of the messages with a <literal>SYSLOG_IDENTIFIER</literal>
 508                                 matched by <replaceable>PATTERN</replaceable>.</para>
 509
 510                                 <para>This parameter can be specified
 511                                 multiple times.</para></listitem>
 512                         </varlistentry>
 513
 514                         <varlistentry>
 515                                 <term><option>-u</option></term>
 516                                 <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 517
 518                                 <listitem><para>Show messages for the
 519                                 specified systemd unit
 520                                 <replaceable>UNIT</replaceable> (such
 521                                 as a service unit), or for any of the
 522                                 units matched by
 523                                 <replaceable>PATTERN</replaceable>.
 524                                 If a pattern is specified, a list of
 525                                 unit names found in the journal is
 526                                 compared with the specified pattern
 527                                 and all that match are used. For each
 528                                 unit name, a match is added for
 529                                 messages from the unit
 530                                 (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 531                                 along with additional matches for
 532                                 messages from systemd and messages
 533                                 about coredumps for the specified
 534                                 unit.</para>
 535
 536                                 <para>This parameter can be specified
 537                                 multiple times.</para></listitem>
 538                         </varlistentry>
 539
 540                         <varlistentry>
 541                                 <term><option>--user-unit=</option></term>
 542
 543                                 <listitem><para>Show messages for the
 544                                 specified user session unit. This will
 545                                 add a match for messages from the unit
 546                                 (<literal>_SYSTEMD_USER_UNIT=</literal>
 547                                 and <literal>_UID=</literal>) and
 548                                 additional matches for messages from
 549                                 session systemd and messages about
 550                                 coredumps for the specified unit.</para>
 551                                 <para>This parameter can be specified multiple times.
 552                                 </para></listitem>
 553                         </varlistentry>
 554
 555                         <varlistentry>
 556                                 <term><option>-p</option></term>
 557                                 <term><option>--priority=</option></term>
 558
 559                                 <listitem><para>Filter output by
 560                                 message priorities or priority
 561                                 ranges. Takes either a single numeric
 562                                 or textual log level (i.e. between
 563                                 0/<literal>emerg</literal> and
 564                                 7/<literal>debug</literal>), or a
 565                                 range of numeric/text log levels in
 566                                 the form FROM..TO. The log levels are
 567                                 the usual syslog log levels as
 568                                 documented in
 569                                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 570                                 i.e. <literal>emerg</literal> (0),
 571                                 <literal>alert</literal> (1),
 572                                 <literal>crit</literal> (2),
 573                                 <literal>err</literal> (3),
 574                                 <literal>warning</literal> (4),
 575                                 <literal>notice</literal> (5),
 576                                 <literal>info</literal> (6),
 577                                 <literal>debug</literal> (7). If a
 578                                 single log level is specified, all
 579                                 messages with this log level or a
 580                                 lower (hence more important) log level
 581                                 are shown. If a range is specified, all
 582                                 messages within the range are shown,
 583                                 including both the start and the end
 584                                 value of the range. This will add
 585                                 <literal>PRIORITY=</literal> matches
 586                                 for the specified
 587                                 priorities.</para></listitem>
 588                         </varlistentry>
 589
 590                         <varlistentry>
 591                                 <term><option>-c</option></term>
 592                                 <term><option>--cursor=</option></term>
 593
 594                                 <listitem><para>Start showing entries
 595                                 from the location in the journal
 596                                 specified by the passed
 597                                 cursor.</para></listitem>
 598                         </varlistentry>
 599
 600                         <varlistentry>
 601                                 <term><option>--after-cursor=</option></term>
 602
 603                                 <listitem><para>Start showing entries
 604                                 from the location in the journal
 605                                 <emphasis>after</emphasis> the
 606                                 location specified by the this cursor.
 607                                 The cursor is shown when the
 608                                 <option>--show-cursor</option> option
 609                                 is used.</para></listitem>
 610                         </varlistentry>
 611
 612                         <varlistentry>
 613                                 <term><option>--show-cursor</option></term>
 614
 615                                 <listitem><para>The cursor is shown after the last
 616                                 entry after two dashes:</para>
 617                                 <programlisting>-- cursor: s=0639...</programlisting>
 618                                 <para>The format of the cursor is private
 619                                 and subject to change.</para></listitem>
 620                         </varlistentry>
 621
 622                         <varlistentry>
 623                                 <term><option>--since=</option></term>
 624                                 <term><option>--until=</option></term>
 625
 626                                 <listitem><para>Start showing entries
 627                                 on or newer than the specified date,
 628                                 or on or older than the specified
 629                                 date, respectively. Date specifications
 630                                 should be of the format
 631                                 <literal>2012-10-30 18:17:16</literal>.
 632                                 If the time part is omitted,
 633                                 <literal>00:00:00</literal> is assumed.
 634                                 If only the seconds component is omitted,
 635                                 <literal>:00</literal> is assumed. If the
 636                                 date component is omitted, the current
 637                                 day is assumed. Alternatively the strings
 638                                 <literal>yesterday</literal>,
 639                                 <literal>today</literal>,
 640                                 <literal>tomorrow</literal> are
 641                                 understood, which refer to 00:00:00 of
 642                                 the day before the current day, the
 643                                 current day, or the day after the
 644                                 current day, respectively. <literal>now</literal>
 645                                 refers to the current time. Finally,
 646                                 relative times may be specified,
 647                                 prefixed with <literal>-</literal> or
 648                                 <literal>+</literal>, referring to
 649                                 times before or after the current
 650                                 time, respectively.</para></listitem>
 651                         </varlistentry>
 652
 653                         <varlistentry>
 654                                 <term><option>-F</option></term>
 655                                 <term><option>--field=</option></term>
 656
 657                                 <listitem><para>Print all possible
 658                                 data values the specified field can
 659                                 take in all entries of the
 660                                 journal.</para></listitem>
 661                         </varlistentry>
 662
 663                         <varlistentry>
 664                                 <term><option>--system</option></term>
 665                                 <term><option>--user</option></term>
 666
 667                                 <listitem><para>Show messages from
 668                                 system services and the kernel (with
 669                                 <option>--system</option>). Show
 670                                 messages from service of current user
 671                                 (with <option>--user</option>).
 672                                 If neither is specified, show all
 673                                 messages that the user can see.
 674                                 </para></listitem>
 675                         </varlistentry>
 676
 677                         <varlistentry>
 678                                 <term><option>-M</option></term>
 679                                 <term><option>--machine=</option></term>
 680
 681                                 <listitem><para>Show messages from a
 682                                 running, local container. Specify a
 683                                 container name to connect
 684                                 to.</para></listitem>
 685                         </varlistentry>
 686
 687                         <varlistentry>
 688                                 <term><option>-D <replaceable>DIR</replaceable></option></term>
 689                                 <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 690
 691                                 <listitem><para>Takes a directory path
 692                                 as argument. If specified, journalctl
 693                                 will operate on the specified journal
 694                                 directory
 695                                 <replaceable>DIR</replaceable> instead
 696                                 of the default runtime and system
 697                                 journal paths.</para></listitem>
 698                         </varlistentry>
 699
 700                         <varlistentry>
 701                                 <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 702
 703                                 <listitem><para>Takes a file glob as an
 704                                 argument. If specified, journalctl will
 705                                 operate on the specified journal files
 706                                 matching <replaceable>GLOB</replaceable>
 707                                 instead of the default runtime and
 708                                 system journal paths. May be specified
 709                                 multiple times, in which case files will
 710                                 be suitably interleaved.</para></listitem>
 711                         </varlistentry>
 712
 713                         <varlistentry>
 714                                 <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 715
 716                                 <listitem><para>Takes a directory path
 717                                 as an argument. If specified, journalctl
 718                                 will operate on catalog file hierarchy
 719                                 underneath the specified directory
 720                                 instead of the root directory
 721                                 (e.g. <option>--update-catalog</option>
 722                                 will create
 723                                 <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).
 724                                 </para></listitem>
 725                         </varlistentry>
 726
 727                         <varlistentry>
 728                                 <term><option>--new-id128</option></term>
 729
 730                                 <listitem><para>Instead of showing
 731                                 journal contents, generate a new 128-bit
 732                                 ID suitable for identifying
 733                                 messages. This is intended for usage
 734                                 by developers who need a new
 735                                 identifier for a new message they
 736                                 introduce and want to make
 737                                 recognizable. This will print the new ID in
 738                                 three different formats which can be
 739                                 copied into source code or
 740                                 similar.</para></listitem>
 741                         </varlistentry>
 742
 743                         <varlistentry>
 744                                 <term><option>--header</option></term>
 745
 746                                 <listitem><para>Instead of showing
 747                                 journal contents, show internal header
 748                                 information of the journal fields
 749                                 accessed.</para></listitem>
 750                         </varlistentry>
 751
 752                         <varlistentry>
 753                                 <term><option>--disk-usage</option></term>
 754
 755                                 <listitem><para>Shows the current disk
 756                                 usage of all
 757                                 journal files.</para></listitem>
 758                         </varlistentry>
 759
 760                         <varlistentry>
 761                                 <term><option>--list-catalog
 762                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 763                                 </option></term>
 764
 765                                 <listitem><para>List the contents of
 766                                 the message catalog as a table of
 767                                 message IDs, plus their short
 768                                 description strings.</para>
 769
 770                                 <para>If any
 771                                 <replaceable>128-bit-ID</replaceable>s are
 772                                 specified, only those entries are shown.
 773                                 </para>
 774                                 </listitem>
 775                         </varlistentry>
 776
 777                         <varlistentry>
 778                                 <term><option>--dump-catalog
 779                                 <optional><replaceable>128-bit-ID...</replaceable></optional>
 780                                 </option></term>
 781
 782                                 <listitem><para>Show the contents of
 783                                 the message catalog, with entries
 784                                 separated by a line consisting of two
 785                                 dashes and the ID (the format is the
 786                                 same as <filename>.catalog</filename>
 787                                 files).</para>
 788
 789                                 <para>If any
 790                                 <replaceable>128-bit-ID</replaceable>s are
 791                                 specified, only those entries are shown.
 792                                 </para>
 793                                 </listitem>
 794                         </varlistentry>
 795
 796                         <varlistentry>
 797                                 <term><option>--update-catalog</option></term>
 798
 799                                 <listitem><para>Update the message
 800                                 catalog index. This command needs to
 801                                 be executed each time new catalog
 802                                 files are installed, removed, or
 803                                 updated to rebuild the binary catalog
 804                                 index.</para></listitem>
 805                         </varlistentry>
 806
 807                         <varlistentry>
 808                                 <term><option>--setup-keys</option></term>
 809
 810                                 <listitem><para>Instead of showing
 811                                 journal contents, generate a new key
 812                                 pair for Forward Secure Sealing
 813                                 (FSS). This will generate a sealing
 814                                 key and a verification key. The
 815                                 sealing key is stored in the journal
 816                                 data directory and shall remain on the
 817                                 host. The verification key should be
 818                                 stored externally. Refer to the
 819                                 <option>Seal=</option> option in
 820                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 821                                 for information on Forward Secure
 822                                 Sealing and for a link to a refereed
 823                                 scholarly paper detailing the
 824                                 cryptographic theory it is based on.
 825                                 </para></listitem>
 826                         </varlistentry>
 827
 828                         <varlistentry>
 829                                 <term><option>--force</option></term>
 830
 831                                 <listitem><para>When
 832                                 <option>--setup-keys</option> is passed and
 833                                 Forward Secure Sealing (FSS) has already been
 834                                 configured, recreate FSS keys.</para></listitem>
 835                         </varlistentry>
 836
 837                         <varlistentry>
 838                                 <term><option>--interval=</option></term>
 839
 840                                 <listitem><para>Specifies the change
 841                                 interval for the sealing key when
 842                                 generating an FSS key pair with
 843                                 <option>--setup-keys</option>. Shorter
 844                                 intervals increase CPU consumption but
 845                                 shorten the time range of
 846                                 undetectable journal
 847                                 alterations. Defaults to
 848                                 15min.</para></listitem>
 849                         </varlistentry>
 850
 851                         <varlistentry>
 852                                 <term><option>--verify</option></term>
 853
 854                                 <listitem><para>Check the journal file
 855                                 for internal consistency. If the
 856                                 file has been generated with FSS
 857                                 enabled and the FSS verification key
 858                                 has been specified with
 859                                 <option>--verify-key=</option>,
 860                                 authenticity of the journal file is
 861                                 verified.</para></listitem>
 862                         </varlistentry>
 863
 864                         <varlistentry>
 865                                 <term><option>--verify-key=</option></term>
 866
 867                                 <listitem><para>Specifies the FSS
 868                                 verification key to use for the
 869                                 <option>--verify</option>
 870                                 operation.</para></listitem>
 871                         </varlistentry>
 872
 873                         <xi:include href="standard-options.xml" xpointer="help" />
 874                         <xi:include href="standard-options.xml" xpointer="version" />
 875                         <xi:include href="standard-options.xml" xpointer="no-pager" />
 876                 </variablelist>
 877         </refsect1>
 878
 879         <refsect1>
 880                 <title>Exit status</title>
 881
 882                 <para>On success, 0 is returned; otherwise, a non-zero
 883                 failure code is returned.</para>
 884         </refsect1>
 885
 886         <xi:include href="less-variables.xml" />
 887
 888         <refsect1>
 889                 <title>Examples</title>
 890
 891                 <para>Without arguments, all collected logs are shown
 892                 unfiltered:</para>
 893
 894                 <programlisting>journalctl</programlisting>
 895
 896                 <para>With one match specified, all entries with a field matching the expression are shown:</para>
 897
 898                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
 899
 900                 <para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>
 901
 902                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 903
 904                 <para>If two matches refer to the same field, all entries matching either expression are shown:</para>
 905
 906                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 907
 908                 <para>If the separator <literal>+</literal> is used,
 909                 two expressions may be combined in a logical OR. The
 910                 following will show all messages from the Avahi
 911                 service process with the PID 28097 plus all messages
 912                 from the D-Bus service (from any of its
 913                 processes):</para>
 914
 915                 <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 916
 917                 <para>Show all logs generated by the D-Bus executable:</para>
 918
 919                 <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 920
 921                 <para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>
 922
 923                 <programlisting>journalctl /dev/sda</programlisting>
 924
 925                 <para>Show all kernel logs from previous boot:</para>
 926
 927                 <programlisting>journalctl -k -b -1</programlisting>
 928
 929                 <para>Show a live log display from a system service <filename>apache.service</filename>:</para>
 930
 931                 <programlisting>journalctl -f -u apache</programlisting>
 932
 933         </refsect1>
 934
 935         <refsect1>
 936                 <title>See Also</title>
 937                 <para>
 938                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 939                         <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 940                         <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 941                         <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 942                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 943                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 944                 </para>
 945         </refsect1>
 946
 947 </refentry>