man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
   5
   6   <refentry id="journalctl"
   7             xmlns:xi="http://www.w3.org/2001/XInclude">
   8
   9     <refentryinfo>
  10       <title>journalctl</title>
  11       <productname>systemd</productname>
  12     </refentryinfo>
  13
  14     <refmeta>
  15       <refentrytitle>journalctl</refentrytitle>
  16       <manvolnum>1</manvolnum>
  17     </refmeta>
  18
  19     <refnamediv>
  20       <refname>journalctl</refname>
  21       <refpurpose>Query the systemd journal</refpurpose>
  22     </refnamediv>
  23
  24     <refsynopsisdiv>
  25       <cmdsynopsis>
  26         <command>journalctl</command>
  27         <arg choice="opt" rep="repeat">OPTIONS</arg>
  28         <arg choice="opt" rep="repeat">MATCHES</arg>
  29       </cmdsynopsis>
  30     </refsynopsisdiv>
  31
  32     <refsect1>
  33       <title>Description</title>
  34
  35       <para><command>journalctl</command> may be used to query the
  36       contents of the
  37       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  38       journal as written by
  39       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  40
  41       <para>If called without parameters, it will show the full
  42       contents of the journal, starting with the oldest entry
  43       collected.</para>
  44
  45       <para>If one or more match arguments are passed, the output is
  46       filtered accordingly. A match is in the format
  47       <literal>FIELD=VALUE</literal>,
  48       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  49       to the components of a structured journal entry. See
  50       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  51       for a list of well-known fields. If multiple matches are
  52       specified matching different fields, the log entries are
  53       filtered by both, i.e. the resulting output will show only
  54       entries matching all the specified matches of this kind. If two
  55       matches apply to the same field, then they are automatically
  56       matched as alternatives, i.e. the resulting output will show
  57       entries matching any of the specified matches for the same
  58       field. Finally, the character <literal>+</literal> may appear
  59       as a separate word between other terms on the command line. This
  60       causes all matches before and after to be combined in a
  61       disjunction (i.e. logical OR).</para>
  62
  63       <para>It is also possible to filter the entries by specifying an
  64       absolute file path as an argument. The file path may be a file or
  65       a symbolic link and the file must exist at the time of the query. If a
  66       file path refers to an executable binary, an <literal>_EXE=</literal>
  67       match for the canonicalized binary path is added to the query. If a
  68       file path refers to an executable script, a <literal>_COMM=</literal>
  69       match for the script name is added to the query. If a file path
  70       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
  71       the kernel name of the device and for each of its ancestor devices is
  72       added to the query. Symbolic links are dereferenced, kernel names are
  73       synthesized, and parent devices are identified from the environment at
  74       the time of the query. In general, a device node is the best proxy for
  75       an actual device, as log entries do not usually contain fields that
  76       identify an actual device. For the resulting log entries to be correct
  77       for the actual device, the relevant parts of the environment at the time
  78       the entry was logged, in particular the actual device corresponding to
  79       the device node, must have been the same as those at the time of the
  80       query. Because device nodes generally change their corresponding devices
  81       across reboots, specifying a device node path causes the resulting
  82       entries to be restricted to those from the current boot.</para>
  83
  84       <para>Additional constraints may be added using options
  85       <option>--boot</option>, <option>--unit=</option>, etc., to
  86       further limit what entries will be shown (logical AND).</para>
  87
  88       <para>Output is interleaved from all accessible journal files,
  89       whether they are rotated or currently being written, and
  90       regardless of whether they belong to the system itself or are
  91       accessible user journals.</para>
  92
  93       <para>The set of journal files which will be used can be
  94       modified using the <option>--user</option>,
  95       <option>--system</option>, <option>--directory</option>, and
  96       <option>--file</option> options, see below.</para>
  97
  98       <para>All users are granted access to their private per-user
  99       journals. However, by default, only root and users who are
 100       members of a few special groups are granted access to the system
 101       journal and the journals of other users. Members of the groups
 102       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 103       <literal>wheel</literal> can read all journal files. Note
 104       that the two latter groups traditionally have additional
 105       privileges specified by the distribution. Members of the
 106       <literal>wheel</literal> group can often perform administrative
 107       tasks.</para>
 108
 109       <para>The output is paged through <command>less</command> by
 110       default, and long lines are "truncated" to screen width. The
 111       hidden part can be viewed by using the left-arrow and
 112       right-arrow keys. Paging can be disabled; see the
 113       <option>--no-pager</option> option and the "Environment" section
 114       below.</para>
 115
 116       <para>When outputting to a tty, lines are colored according to
 117       priority: lines of level ERROR and higher are colored red; lines
 118       of level NOTICE and higher are highlighted; lines of level DEBUG
 119       are colored lighter grey; other lines are displayed normally.</para>
 120     </refsect1>
 121
 122     <refsect1>
 123       <title>Options</title>
 124
 125       <para>The following options are understood:</para>
 126
 127       <variablelist>
 128         <varlistentry>
 129           <term><option>--no-full</option></term>
 130           <term><option>--full</option></term>
 131           <term><option>-l</option></term>
 132
 133           <listitem><para>Ellipsize fields when they do not fit in
 134           available columns.  The default is to show full fields,
 135           allowing them to wrap or be truncated by the pager, if one
 136           is used.</para>
 137
 138           <para>The old options
 139           <option>-l</option>/<option>--full</option> are not useful
 140           anymore, except to undo <option>--no-full</option>.</para>
 141           </listitem>
 142         </varlistentry>
 143
 144         <varlistentry>
 145           <term><option>-a</option></term>
 146           <term><option>--all</option></term>
 147
 148           <listitem><para>Show all fields in full, even if they include unprintable characters or are very long. By
 149           default, fields with unprintable characters are abbreviated as "blob data". (Note that the pager may escape
 150           unprintable characters again.)</para></listitem>
 151         </varlistentry>
 152
 153         <varlistentry>
 154           <term><option>-f</option></term>
 155           <term><option>--follow</option></term>
 156
 157           <listitem><para>Show only the most recent journal entries,
 158           and continuously print new entries as they are appended to
 159           the journal.</para></listitem>
 160         </varlistentry>
 161
 162         <varlistentry>
 163           <term><option>-e</option></term>
 164           <term><option>--pager-end</option></term>
 165
 166           <listitem><para>Immediately jump to the end of the journal
 167           inside the implied pager tool. This implies
 168           <option>-n1000</option> to guarantee that the pager will not
 169           buffer logs of unbounded size. This may be overridden with
 170           an explicit <option>-n</option> with some other numeric
 171           value, while <option>-nall</option> will disable this cap.
 172           Note that this option is only supported for the
 173           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 174           pager.</para></listitem>
 175         </varlistentry>
 176
 177         <varlistentry>
 178           <term><option>-n</option></term>
 179           <term><option>--lines=</option></term>
 180
 181           <listitem><para>Show the most recent journal events and
 182           limit the number of events shown. If
 183           <option>--follow</option> is used, this option is
 184           implied. The argument is a positive integer or
 185           <literal>all</literal> to disable line limiting. The default
 186           value is 10 if no argument is given.</para></listitem>
 187         </varlistentry>
 188
 189         <varlistentry>
 190           <term><option>--no-tail</option></term>
 191
 192           <listitem><para>Show all stored output lines, even in follow
 193           mode. Undoes the effect of <option>--lines=</option>.
 194           </para></listitem>
 195         </varlistentry>
 196
 197         <varlistentry>
 198           <term><option>-r</option></term>
 199           <term><option>--reverse</option></term>
 200
 201           <listitem><para>Reverse output so that the newest entries
 202           are displayed first.</para></listitem>
 203         </varlistentry>
 204
 205         <varlistentry>
 206           <term><option>-o</option></term>
 207           <term><option>--output=</option></term>
 208
 209           <listitem><para>Controls the formatting of the journal
 210           entries that are shown. Takes one of the following
 211           options:</para>
 212           <variablelist>
 213             <varlistentry>
 214               <term>
 215                 <option>short</option>
 216               </term>
 217               <listitem>
 218                 <para>is the default and generates an output that is
 219                 mostly identical to the formatting of classic syslog
 220                 files, showing one line per journal entry.</para>
 221               </listitem>
 222             </varlistentry>
 223
 224             <varlistentry>
 225               <term>
 226                 <option>short-full</option>
 227               </term>
 228               <listitem>
 229                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 230                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 231                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 232                 output, and is locale-independent.</para>
 233               </listitem>
 234             </varlistentry>
 235
 236             <varlistentry>
 237               <term>
 238                 <option>short-iso</option>
 239               </term>
 240               <listitem>
 241                 <para>is very similar, but shows ISO 8601 wallclock
 242                 timestamps.</para>
 243               </listitem>
 244             </varlistentry>
 245
 246             <varlistentry>
 247               <term>
 248                 <option>short-iso-precise</option>
 249               </term>
 250               <listitem>
 251                 <para>as for <option>short-iso</option> but includes full
 252                 microsecond precision.</para>
 253               </listitem>
 254             </varlistentry>
 255
 256             <varlistentry>
 257               <term>
 258                 <option>short-precise</option>
 259               </term>
 260               <listitem>
 261                 <para>is very similar, but shows classic syslog timestamps
 262                 with full microsecond precision.</para>
 263               </listitem>
 264             </varlistentry>
 265
 266             <varlistentry>
 267               <term>
 268                 <option>short-monotonic</option>
 269               </term>
 270               <listitem>
 271                 <para>is very similar, but shows monotonic timestamps
 272                 instead of wallclock timestamps.</para>
 273               </listitem>
 274             </varlistentry>
 275
 276             <varlistentry>
 277               <term>
 278                 <option>short-unix</option>
 279               </term>
 280               <listitem>
 281                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 282                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 283               </listitem>
 284             </varlistentry>
 285
 286             <varlistentry>
 287               <term>
 288                 <option>verbose</option>
 289               </term>
 290               <listitem>
 291                 <para>shows the full-structured entry items with all
 292                 fields.</para>
 293               </listitem>
 294             </varlistentry>
 295
 296             <varlistentry>
 297               <term>
 298                 <option>export</option>
 299               </term>
 300               <listitem>
 301                 <para>serializes the journal into a binary (but mostly
 302                 text-based) stream suitable for backups and network
 303                 transfer (see
 304                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 305                 for more information). To import the binary stream back
 306                 into native journald format use
 307                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 308               </listitem>
 309             </varlistentry>
 310
 311             <varlistentry>
 312               <term>
 313                 <option>json</option>
 314               </term>
 315               <listitem>
 316                 <para>formats entries as JSON objects, separated by newline characters (see <ulink
 317                 url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink> for more
 318                 information). Field values are generally encoded as JSON strings, with three exceptions:
 319                 <orderedlist>
 320                   <listitem><para>Fields larger than 4096 bytes are encoded as <constant>null</constant> values. (This
 321                   may be turned off by passing <option>--all</option>, but be aware that this may allocate overly long
 322                   JSON objects.) </para></listitem>
 323
 324                   <listitem><para>Journal entries permit non-unique fields within the same log entry. JSON does not allow
 325                   non-unique fields within objects. Due to this, if a non-unique field is encountered a JSON array is
 326                   used as field value, listing all field values as elements.</para></listitem>
 327
 328                   <listitem><para>Fields containing non-printable or non-UTF8 bytes are encoded as arrays containing
 329                   the raw bytes individually formatted as unsigned numbers.</para></listitem>
 330                 </orderedlist>
 331
 332                 Note that this encoding is reversible (with the exception of the size limit).</para>
 333               </listitem>
 334             </varlistentry>
 335
 336             <varlistentry>
 337               <term>
 338                 <option>json-pretty</option>
 339               </term>
 340               <listitem>
 341                 <para>formats entries as JSON data structures, but
 342                 formats them in multiple lines in order to make them
 343                 more readable by humans.</para>
 344               </listitem>
 345             </varlistentry>
 346
 347             <varlistentry>
 348               <term>
 349                 <option>json-sse</option>
 350               </term>
 351               <listitem>
 352                 <para>formats entries as JSON data structures, but wraps
 353                 them in a format suitable for
 354                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 355                 </para>
 356               </listitem>
 357             </varlistentry>
 358
 359             <varlistentry>
 360               <term>
 361                 <option>json-seq</option>
 362               </term>
 363               <listitem>
 364                 <para>formats entries as JSON data structures, but prefixes them with an ASCII Record Separator
 365                 character (0x1E) and suffixes them with an ASCII Line Feed character (0x0A), in accordance with <ulink
 366                 url="https://tools.ietf.org/html/rfc7464">JavaScript Object Notation (JSON) Text Sequences </ulink>
 367                 (<literal>application/json-seq</literal>).
 368                 </para>
 369               </listitem>
 370             </varlistentry>
 371
 372             <varlistentry>
 373               <term>
 374                 <option>cat</option>
 375               </term>
 376               <listitem>
 377                 <para>generates a very terse output, only showing the actual message of each journal entry
 378                 with no metadata, not even a timestamp. If combined with the
 379                 <option>--output-fields=</option> option will output the listed fields for each log record,
 380                 instead of the message.</para>
 381               </listitem>
 382             </varlistentry>
 383
 384             <varlistentry>
 385               <term>
 386                 <option>with-unit</option>
 387               </term>
 388               <listitem>
 389                 <para>similar to short-full, but prefixes the unit and
 390                 user unit names instead of the traditional syslog
 391                 identifier. Useful when using templated instances, as it
 392                 will include the arguments in the unit names.</para>
 393               </listitem>
 394             </varlistentry>
 395           </variablelist>
 396         </listitem>
 397       </varlistentry>
 398
 399       <varlistentry>
 400         <term><option>--output-fields=</option></term>
 401
 402         <listitem><para>A comma separated list of the fields which should be included in the output. This has
 403         an effect only for the output modes which would normally show all fields (<option>verbose</option>,
 404         <option>export</option>, <option>json</option>, <option>json-pretty</option>,
 405         <option>json-sse</option> and <option>json-seq</option>), as well as on <option>cat</option>. For the
 406         former, the <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 407         <literal>__MONOTONIC_TIMESTAMP</literal>, and <literal>_BOOT_ID</literal> fields are always
 408         printed.</para></listitem>
 409       </varlistentry>
 410
 411       <varlistentry>
 412         <term><option>--utc</option></term>
 413
 414         <listitem><para>Express time in Coordinated Universal Time
 415         (UTC).</para></listitem>
 416       </varlistentry>
 417
 418       <varlistentry>
 419         <term><option>--no-hostname</option></term>
 420
 421         <listitem><para>Don't show the hostname field of log messages originating from the local host. This
 422         switch has an effect only on the <option>short</option> family of output modes (see above).
 423         </para>
 424
 425         <para>Note: this option does not remove occurrences of the hostname from log entries themselves, so
 426         it does not prevent the hostname from being visible in the logs.</para>
 427         </listitem>
 428       </varlistentry>
 429
 430       <varlistentry>
 431         <term><option>-x</option></term>
 432         <term><option>--catalog</option></term>
 433
 434         <listitem><para>Augment log lines with explanation texts from
 435         the message catalog. This will add explanatory help texts to
 436         log messages in the output where this is available. These
 437         short help texts will explain the context of an error or log
 438         event, possible solutions, as well as pointers to support
 439         forums, developer documentation, and any other relevant
 440         manuals. Note that help texts are not available for all
 441         messages, but only for selected ones. For more information on
 442         the message catalog, please refer to the
 443         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 444
 445         <para>Note: when attaching <command>journalctl</command>
 446         output to bug reports, please do <emphasis>not</emphasis> use
 447         <option>-x</option>.</para>
 448         </listitem>
 449       </varlistentry>
 450
 451       <varlistentry>
 452         <term><option>-q</option></term>
 453         <term><option>--quiet</option></term>
 454
 455         <listitem><para>Suppresses all informational messages
 456         (i.e. "-- Journal begins at …", "-- Reboot --"),
 457         any warning messages regarding
 458         inaccessible system journals when run as a normal
 459         user.</para></listitem>
 460       </varlistentry>
 461
 462       <varlistentry>
 463         <term><option>-m</option></term>
 464         <term><option>--merge</option></term>
 465
 466         <listitem><para>Show entries interleaved from all available
 467         journals, including remote ones.</para></listitem>
 468       </varlistentry>
 469
 470       <varlistentry>
 471         <term><option>-b <optional><optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional>|<constant>all</constant></optional></option></term>
 472         <term><option>--boot<optional>=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional>|<constant>all</constant></optional></option></term>
 473
 474         <listitem><para>Show messages from a specific boot. This will
 475         add a match for <literal>_BOOT_ID=</literal>.</para>
 476
 477         <para>The argument may be empty, in which case logs for the
 478         current boot will be shown.</para>
 479
 480         <para>If the boot ID is omitted, a positive
 481         <replaceable>offset</replaceable> will look up the boots
 482         starting from the beginning of the journal, and an
 483         equal-or-less-than zero <replaceable>offset</replaceable> will
 484         look up boots starting from the end of the journal. Thus,
 485         <constant>1</constant> means the first boot found in the
 486         journal in chronological order, <constant>2</constant> the
 487         second and so on; while <constant>-0</constant> is the last
 488         boot, <constant>-1</constant> the boot before last, and so
 489         on. An empty <replaceable>offset</replaceable> is equivalent
 490         to specifying <constant>-0</constant>, except when the current
 491         boot is not the last boot (e.g. because
 492         <option>--directory</option> was specified to look at logs
 493         from a different machine).</para>
 494
 495         <para>If the 32-character <replaceable>ID</replaceable> is
 496         specified, it may optionally be followed by
 497         <replaceable>offset</replaceable> which identifies the boot
 498         relative to the one given by boot
 499         <replaceable>ID</replaceable>. Negative values mean earlier
 500         boots and positive values mean later boots. If
 501         <replaceable>offset</replaceable> is not specified, a value of
 502         zero is assumed, and the logs for the boot given by
 503         <replaceable>ID</replaceable> are shown.</para>
 504
 505         <para>The special argument <constant>all</constant> can be
 506         used to negate the effect of an earlier use of
 507         <option>-b</option>.</para>
 508         </listitem>
 509       </varlistentry>
 510
 511       <varlistentry>
 512         <term><option>--list-boots</option></term>
 513
 514         <listitem><para>Show a tabular list of boot numbers (relative to
 515         the current boot), their IDs, and the timestamps of the first
 516         and last message pertaining to the boot.</para></listitem>
 517       </varlistentry>
 518
 519       <varlistentry>
 520         <term><option>-k</option></term>
 521         <term><option>--dmesg</option></term>
 522
 523         <listitem><para>Show only kernel messages. This implies
 524         <option>-b</option> and adds the match
 525         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 526       </varlistentry>
 527
 528       <varlistentry>
 529         <term><option>-t</option></term>
 530         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 531
 532         <listitem><para>Show messages for the specified syslog
 533         identifier
 534         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 535
 536         <para>This parameter can be specified multiple
 537         times.</para></listitem>
 538       </varlistentry>
 539
 540       <varlistentry>
 541         <term><option>-u</option></term>
 542         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 543
 544         <listitem><para>Show messages for the specified systemd unit
 545         <replaceable>UNIT</replaceable> (such as a service unit), or
 546         for any of the units matched by
 547         <replaceable>PATTERN</replaceable>.  If a pattern is
 548         specified, a list of unit names found in the journal is
 549         compared with the specified pattern and all that match are
 550         used. For each unit name, a match is added for messages from
 551         the unit
 552         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 553         along with additional matches for messages from systemd and
 554         messages about coredumps for the specified unit. A match
 555         is also added for <literal>_SYSTEMD_SLICE=<replaceable>UNIT</replaceable></literal>,
 556         such that if the provided <replaceable>UNIT</replaceable> is a
 557         <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 558         unit, all logs of children of the slice will be shown.
 559        </para>
 560
 561         <para>This parameter can be specified multiple times.</para>
 562         </listitem>
 563       </varlistentry>
 564
 565       <varlistentry>
 566         <term><option>--user-unit=</option></term>
 567
 568         <listitem><para>Show messages for the specified user session
 569         unit. This will add a match for messages from the unit
 570         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 571         <literal>_UID=</literal>) and additional matches for messages
 572         from session systemd and messages about coredumps for the
 573         specified unit. A match
 574         is also added for <literal>_SYSTEMD_USER_SLICE=<replaceable>UNIT</replaceable></literal>,
 575         such that if the provided <replaceable>UNIT</replaceable> is a
 576         <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 577         unit, all logs of children of the unit will be shown.</para>
 578
 579         <para>This parameter can be specified multiple times.</para>
 580         </listitem>
 581       </varlistentry>
 582
 583       <varlistentry>
 584         <term><option>-p</option></term>
 585         <term><option>--priority=</option></term>
 586
 587         <listitem><para>Filter output by message priorities or
 588         priority ranges. Takes either a single numeric or textual log
 589         level (i.e. between 0/<literal>emerg</literal> and
 590         7/<literal>debug</literal>), or a range of numeric/text log
 591         levels in the form FROM..TO. The log levels are the usual
 592         syslog log levels as documented in
 593         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 594         i.e. <literal>emerg</literal> (0),
 595         <literal>alert</literal> (1), <literal>crit</literal> (2),
 596         <literal>err</literal> (3), <literal>warning</literal> (4),
 597         <literal>notice</literal> (5), <literal>info</literal> (6),
 598         <literal>debug</literal> (7). If a single log level is
 599         specified, all messages with this log level or a lower (hence
 600         more important) log level are shown. If a range is specified,
 601         all messages within the range are shown, including both the
 602         start and the end value of the range. This will add
 603         <literal>PRIORITY=</literal> matches for the specified
 604         priorities.</para></listitem>
 605       </varlistentry>
 606
 607       <varlistentry>
 608         <term><option>--facility=</option></term>
 609
 610         <listitem><para>Filter output by syslog facility. Takes a comma-separated list of numbers or facility
 611         names. The names are the usual syslog facilities as documented in
 612         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 613         <option>--facility=help</option> may be used to display a list of known facility names and exit.
 614         </para></listitem>
 615       </varlistentry>
 616
 617       <varlistentry>
 618         <term><option>-g</option></term>
 619         <term><option>--grep=</option></term>
 620
 621         <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname>
 622         field matches the specified regular expression. PERL-compatible regular expressions
 623         are used, see
 624         <citerefentry project='url'><refentrytitle url='http://pcre.org/current/doc/html/pcre2pattern.html'>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 625         for a detailed description of the syntax.</para>
 626
 627         <para>If the pattern is all lowercase, matching is case insensitive.
 628         Otherwise, matching is case sensitive. This can be overridden with the
 629         <option>--case-sensitive</option> option, see below.</para>
 630         </listitem>
 631       </varlistentry>
 632
 633       <varlistentry>
 634         <term><option>--case-sensitive<optional>=BOOLEAN</optional></option></term>
 635
 636         <listitem><para>Make pattern matching case sensitive or case insensitive.</para>
 637         </listitem>
 638       </varlistentry>
 639
 640       <varlistentry>
 641         <term><option>-c</option></term>
 642         <term><option>--cursor=</option></term>
 643
 644         <listitem><para>Start showing entries from the location in the
 645         journal specified by the passed cursor.</para></listitem>
 646       </varlistentry>
 647
 648       <varlistentry>
 649         <term><option>--cursor-file=<replaceable>FILE</replaceable></option></term>
 650
 651         <listitem><para>If <replaceable>FILE</replaceable> exists and contains a
 652         cursor, start showing entries <emphasis>after</emphasis> this location.
 653         Otherwise the show entries according the other given options. At the end,
 654         write the cursor of the last entry to <replaceable>FILE</replaceable>. Use
 655         this option to continually read the journal by sequentially calling
 656         <command>journalctl</command>.</para></listitem>
 657       </varlistentry>
 658
 659       <varlistentry>
 660         <term><option>--after-cursor=</option></term>
 661
 662         <listitem><para>Start showing entries from the location in the
 663         journal <emphasis>after</emphasis> the location specified by
 664         the passed cursor.  The cursor is shown when the
 665         <option>--show-cursor</option> option is used.</para>
 666         </listitem>
 667       </varlistentry>
 668
 669       <varlistentry>
 670         <term><option>--show-cursor</option></term>
 671
 672         <listitem><para>The cursor is shown after the last entry after
 673         two dashes:</para>
 674         <programlisting>-- cursor: s=0639…</programlisting>
 675         <para>The format of the cursor is private
 676         and subject to change.</para></listitem>
 677       </varlistentry>
 678
 679       <varlistentry>
 680         <term><option>-S</option></term>
 681         <term><option>--since=</option></term>
 682         <term><option>-U</option></term>
 683         <term><option>--until=</option></term>
 684
 685         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 686         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 687         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 688         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 689         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 690         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 691         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 692         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 693         time, respectively. For complete time and date specification, see
 694         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 695         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 696         </para>
 697         </listitem>
 698       </varlistentry>
 699
 700       <varlistentry>
 701         <term><option>-F</option></term>
 702         <term><option>--field=</option></term>
 703
 704         <listitem><para>Print all possible data values the specified
 705         field can take in all entries of the journal.</para></listitem>
 706       </varlistentry>
 707
 708       <varlistentry>
 709         <term><option>-N</option></term>
 710         <term><option>--fields</option></term>
 711
 712         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 713       </varlistentry>
 714
 715       <varlistentry>
 716         <term><option>--system</option></term>
 717         <term><option>--user</option></term>
 718
 719         <listitem><para>Show messages from system services and the
 720         kernel (with <option>--system</option>). Show messages from
 721         service of current user (with <option>--user</option>).  If
 722         neither is specified, show all messages that the user can see.
 723         </para></listitem>
 724       </varlistentry>
 725
 726       <varlistentry>
 727         <term><option>-M</option></term>
 728         <term><option>--machine=</option></term>
 729
 730         <listitem><para>Show messages from a running, local
 731         container. Specify a container name to connect to.</para>
 732         </listitem>
 733       </varlistentry>
 734
 735       <varlistentry>
 736         <term><option>-D <replaceable>DIR</replaceable></option></term>
 737         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 738
 739         <listitem><para>Takes a directory path as argument. If
 740         specified, journalctl will operate on the specified journal
 741         directory <replaceable>DIR</replaceable> instead of the
 742         default runtime and system journal paths.</para></listitem>
 743       </varlistentry>
 744
 745       <varlistentry>
 746         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 747
 748         <listitem><para>Takes a file glob as an argument. If
 749         specified, journalctl will operate on the specified journal
 750         files matching <replaceable>GLOB</replaceable> instead of the
 751         default runtime and system journal paths. May be specified
 752         multiple times, in which case files will be suitably
 753         interleaved.</para></listitem>
 754       </varlistentry>
 755
 756       <varlistentry>
 757         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 758
 759         <listitem><para>Takes a directory path as an argument. If specified, <command>journalctl</command>
 760         will operate on journal directories and catalog file hierarchy underneath the specified directory
 761         instead of the root directory (e.g. <option>--update-catalog</option> will create
 762         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>, and journal
 763         files under <filename><replaceable>ROOT</replaceable>/run/journal/</filename> or
 764         <filename><replaceable>ROOT</replaceable>/var/log/journal/</filename> will be displayed).
 765         </para></listitem>
 766       </varlistentry>
 767
 768       <varlistentry>
 769         <term><option>--image=<replaceable>IMAGE</replaceable></option></term>
 770
 771         <listitem><para>Takes a path to a disk image file or block device node. If specified,
 772         <command>journalctl</command> will operate on the file system in the indicated disk image. This is
 773         similar to <option>--root=</option> but operates on file systems stored in disk images or block
 774         devices, thus providing an easy way to extract log data from disk images. The disk image should
 775         either contain just a file system or a set of file systems within a GPT partition table, following
 776         the <ulink url="https://systemd.io/DISCOVERABLE_PARTITIONS">Discoverable Partitions
 777         Specification</ulink>. For further information on supported disk images, see
 778         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
 779         switch of the same name.</para></listitem>
 780       </varlistentry>
 781
 782       <varlistentry>
 783         <term><option>--namespace=<replaceable>NAMESPACE</replaceable></option></term>
 784
 785         <listitem><para>Takes a journal namespace identifier string as argument. If not specified the data
 786         collected by the default namespace is shown. If specified shows the log data of the specified
 787         namespace instead. If the namespace is specified as <literal>*</literal> data from all namespaces is
 788         shown, interleaved. If the namespace identifier is prefixed with <literal>+</literal> data from the
 789         specified namespace and the default namespace is shown, interleaved, but no other. For details about
 790         journal namespaces see
 791         <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para></listitem>
 792       </varlistentry>
 793
 794       <varlistentry>
 795         <term><option>--header</option></term>
 796
 797         <listitem><para>Instead of showing journal contents, show
 798         internal header information of the journal fields
 799         accessed.</para></listitem>
 800       </varlistentry>
 801
 802       <varlistentry>
 803         <term><option>--disk-usage</option></term>
 804
 805         <listitem><para>Shows the current disk usage of all journal
 806         files. This shows the sum of the disk usage of all archived
 807         and active journal files.</para></listitem>
 808       </varlistentry>
 809
 810       <varlistentry>
 811         <term><option>--vacuum-size=</option></term>
 812         <term><option>--vacuum-time=</option></term>
 813         <term><option>--vacuum-files=</option></term>
 814
 815         <listitem><para>Removes the oldest archived journal files until the disk space they use falls below the
 816         specified size (specified with the usual <literal>K</literal>, <literal>M</literal>, <literal>G</literal> and
 817         <literal>T</literal> suffixes), or all archived journal files contain no data older than the specified timespan
 818         (specified with the usual <literal>s</literal>, <literal>m</literal>, <literal>h</literal>,
 819         <literal>days</literal>, <literal>months</literal>, <literal>weeks</literal> and <literal>years</literal>
 820         suffixes), or no more than the specified number of separate journal files remain. Note that running
 821         <option>--vacuum-size=</option> has only an indirect effect on the output shown by
 822         <option>--disk-usage</option>, as the latter includes active journal files, while the vacuuming operation only
 823         operates on archived journal files. Similarly, <option>--vacuum-files=</option> might not actually reduce the
 824         number of journal files to below the specified number, as it will not remove active journal
 825         files.</para>
 826
 827         <para><option>--vacuum-size=</option>, <option>--vacuum-time=</option> and <option>--vacuum-files=</option>
 828         may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit
 829         on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing
 830         the specific limit, and is thus redundant.</para>
 831
 832         <para>These three switches may also be combined with <option>--rotate</option> into one command. If so, all
 833         active files are rotated first, and the requested vacuuming operation is executed right after. The rotation has
 834         the effect that all currently active files are archived (and potentially new, empty journal files opened as
 835         replacement), and hence the vacuuming operation has the greatest effect as it can take all log data written so
 836         far into account.</para></listitem>
 837       </varlistentry>
 838
 839       <varlistentry>
 840         <term><option>--list-catalog
 841         <optional><replaceable>128-bit-ID…</replaceable></optional>
 842         </option></term>
 843
 844         <listitem><para>List the contents of the message catalog as a
 845         table of message IDs, plus their short description strings.
 846         </para>
 847
 848         <para>If any <replaceable>128-bit-ID</replaceable>s are
 849         specified, only those entries are shown.</para>
 850         </listitem>
 851       </varlistentry>
 852
 853       <varlistentry>
 854         <term><option>--dump-catalog
 855         <optional><replaceable>128-bit-ID…</replaceable></optional>
 856         </option></term>
 857
 858         <listitem><para>Show the contents of the message catalog, with
 859         entries separated by a line consisting of two dashes and the
 860         ID (the format is the same as <filename>.catalog</filename>
 861         files).</para>
 862
 863         <para>If any <replaceable>128-bit-ID</replaceable>s are
 864         specified, only those entries are shown.</para>
 865         </listitem>
 866       </varlistentry>
 867
 868       <varlistentry>
 869         <term><option>--update-catalog</option></term>
 870
 871         <listitem><para>Update the message catalog index. This command
 872         needs to be executed each time new catalog files are
 873         installed, removed, or updated to rebuild the binary catalog
 874         index.</para></listitem>
 875       </varlistentry>
 876
 877       <varlistentry>
 878         <term><option>--setup-keys</option></term>
 879
 880         <listitem><para>Instead of showing journal contents, generate
 881         a new key pair for Forward Secure Sealing (FSS). This will
 882         generate a sealing key and a verification key. The sealing key
 883         is stored in the journal data directory and shall remain on
 884         the host. The verification key should be stored
 885         externally. Refer to the <option>Seal=</option> option in
 886         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 887         for information on Forward Secure Sealing and for a link to a
 888         refereed scholarly paper detailing the cryptographic theory it
 889         is based on.</para></listitem>
 890       </varlistentry>
 891
 892       <varlistentry>
 893         <term><option>--force</option></term>
 894
 895         <listitem><para>When <option>--setup-keys</option> is passed
 896         and Forward Secure Sealing (FSS) has already been configured,
 897         recreate FSS keys.</para></listitem>
 898       </varlistentry>
 899
 900       <varlistentry>
 901         <term><option>--interval=</option></term>
 902
 903         <listitem><para>Specifies the change interval for the sealing
 904         key when generating an FSS key pair with
 905         <option>--setup-keys</option>. Shorter intervals increase CPU
 906         consumption but shorten the time range of undetectable journal
 907         alterations. Defaults to 15min.</para></listitem>
 908       </varlistentry>
 909
 910       <varlistentry>
 911         <term><option>--verify</option></term>
 912
 913         <listitem><para>Check the journal file for internal
 914         consistency. If the file has been generated with FSS enabled and
 915         the FSS verification key has been specified with
 916         <option>--verify-key=</option>, authenticity of the journal file
 917         is verified.</para></listitem>
 918       </varlistentry>
 919
 920       <varlistentry>
 921         <term><option>--verify-key=</option></term>
 922
 923         <listitem><para>Specifies the FSS verification key to use for
 924         the <option>--verify</option> operation.</para></listitem>
 925       </varlistentry>
 926
 927       <varlistentry>
 928         <term><option>--sync</option></term>
 929
 930         <listitem><para>Asks the journal daemon to write all yet
 931         unwritten journal data to the backing file system and
 932         synchronize all journals. This call does not return until the
 933         synchronization operation is complete. This command guarantees
 934         that any log messages written before its invocation are safely
 935         stored on disk at the time it returns.</para></listitem>
 936       </varlistentry>
 937
 938       <varlistentry>
 939         <term><option>--flush</option></term>
 940
 941         <listitem><para>Asks the journal daemon to flush any log data stored in
 942         <filename>/run/log/journal/</filename> into <filename>/var/log/journal/</filename>, if persistent
 943         storage is enabled. This call does not return until the operation is complete. Note that this call is
 944         idempotent: the data is only flushed from <filename>/run/log/journal/</filename> into
 945         <filename>/var/log/journal/</filename> once during system runtime (but see
 946         <option>--relinquish-var</option> below), and this command exits cleanly without executing any
 947         operation if this has already happened. This command effectively guarantees that all data is flushed
 948         to <filename>/var/log/journal/</filename> at the time it returns.</para></listitem>
 949       </varlistentry>
 950
 951       <varlistentry>
 952         <term><option>--relinquish-var</option></term>
 953
 954         <listitem><para>Asks the journal daemon for the reverse operation to <option>--flush</option>: if
 955         requested the daemon will write further log data to <filename>/run/log/journal/</filename> and stops
 956         writing to <filename>/var/log/journal/</filename>. A subsequent call to <option>--flush</option>
 957         causes the log output to switch back to <filename>/var/log/journal/</filename>, see
 958         above.</para></listitem>
 959       </varlistentry>
 960
 961       <varlistentry>
 962         <term><option>--smart-relinquish-var</option></term>
 963
 964         <listitem><para>Similar to <option>--relinquish-var</option> but executes no operation if the root file
 965         system and <filename>/var/lib/journal/</filename> reside on the same mount point. This operation is
 966         used during system shutdown in order to make the journal daemon stop writing data to
 967         <filename>/var/log/journal/</filename> in case that directory is located on a mount point that needs
 968         to be unmounted.</para></listitem>
 969       </varlistentry>
 970
 971       <varlistentry>
 972         <term><option>--rotate</option></term>
 973
 974         <listitem><para>Asks the journal daemon to rotate journal files. This call does not return until the rotation
 975         operation is complete. Journal file rotation has the effect that all currently active journal files are marked
 976         as archived and renamed, so that they are never written to in future. New (empty) journal files are then
 977         created in their place. This operation may be combined with <option>--vacuum-size=</option>,
 978         <option>--vacuum-time=</option> and <option>--vacuum-file=</option> into a single command, see
 979         above.</para></listitem>
 980       </varlistentry>
 981
 982       <xi:include href="standard-options.xml" xpointer="help" />
 983       <xi:include href="standard-options.xml" xpointer="version" />
 984       <xi:include href="standard-options.xml" xpointer="no-pager" />
 985     </variablelist>
 986   </refsect1>
 987
 988   <refsect1>
 989     <title>Exit status</title>
 990
 991     <para>On success, 0 is returned; otherwise, a non-zero failure
 992     code is returned.</para>
 993   </refsect1>
 994
 995   <xi:include href="less-variables.xml" />
 996
 997   <refsect1>
 998     <title>Examples</title>
 999
1000     <para>Without arguments, all collected logs are shown
1001     unfiltered:</para>
1002
1003     <programlisting>journalctl</programlisting>
1004
1005     <para>With one match specified, all entries with a field matching
1006     the expression are shown:</para>
1007
1008     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service
1009 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting>
1010
1011     <para>If two different fields are matched, only entries matching
1012     both expressions at the same time are shown:</para>
1013
1014     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
1015
1016     <para>If two matches refer to the same field, all entries matching
1017     either expression are shown:</para>
1018
1019     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
1020
1021     <para>If the separator <literal>+</literal> is used, two
1022     expressions may be combined in a logical OR. The following will
1023     show all messages from the Avahi service process with the PID
1024     28097 plus all messages from the D-Bus service (from any of its
1025     processes):</para>
1026
1027     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
1028
1029     <para>To show all fields emitted <emphasis>by</emphasis> a unit and <emphasis>about</emphasis>
1030     the unit, option <option>-u</option>/<option>--unit=</option> should be used.
1031     <command>journalctl -u <replaceable>name</replaceable></command>
1032     expands to a complex filter similar to
1033     <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service
1034   + UNIT=<replaceable>name</replaceable>.service _PID=1
1035   + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0
1036   + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
1037     </programlisting>
1038     (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
1039     for an explanation of those patterns).
1040     </para>
1041
1042     <para>Show all logs generated by the D-Bus executable:</para>
1043
1044     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
1045
1046     <para>Show all kernel logs from previous boot:</para>
1047
1048     <programlisting>journalctl -k -b -1</programlisting>
1049
1050     <para>Show a live log display from a system service
1051     <filename>apache.service</filename>:</para>
1052
1053     <programlisting>journalctl -f -u apache</programlisting>
1054
1055   </refsect1>
1056
1057   <refsect1>
1058     <title>See Also</title>
1059     <para>
1060       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1061       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1062       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1063       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1064       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1065       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1066       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1067       <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1068       <citerefentry><refentrytitle>systemd-journal-upload.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1069     </para>
1070   </refsect1>
1071 </refentry>