man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   This file is part of systemd.
   9
  10   Copyright 2012 Lennart Poettering
  11 -->
  12
  13   <refentry id="journalctl"
  14             xmlns:xi="http://www.w3.org/2001/XInclude">
  15
  16     <refentryinfo>
  17       <title>journalctl</title>
  18       <productname>systemd</productname>
  19
  20       <authorgroup>
  21         <author>
  22           <contrib>Developer</contrib>
  23           <firstname>Lennart</firstname>
  24           <surname>Poettering</surname>
  25           <email>lennart@poettering.net</email>
  26         </author>
  27       </authorgroup>
  28     </refentryinfo>
  29
  30     <refmeta>
  31       <refentrytitle>journalctl</refentrytitle>
  32       <manvolnum>1</manvolnum>
  33     </refmeta>
  34
  35     <refnamediv>
  36       <refname>journalctl</refname>
  37       <refpurpose>Query the systemd journal</refpurpose>
  38     </refnamediv>
  39
  40     <refsynopsisdiv>
  41       <cmdsynopsis>
  42         <command>journalctl</command>
  43         <arg choice="opt" rep="repeat">OPTIONS</arg>
  44         <arg choice="opt" rep="repeat">MATCHES</arg>
  45       </cmdsynopsis>
  46     </refsynopsisdiv>
  47
  48     <refsect1>
  49       <title>Description</title>
  50
  51       <para><command>journalctl</command> may be used to query the
  52       contents of the
  53       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  54       journal as written by
  55       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  56
  57       <para>If called without parameters, it will show the full
  58       contents of the journal, starting with the oldest entry
  59       collected.</para>
  60
  61       <para>If one or more match arguments are passed, the output is
  62       filtered accordingly. A match is in the format
  63       <literal>FIELD=VALUE</literal>,
  64       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  65       to the components of a structured journal entry. See
  66       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  67       for a list of well-known fields. If multiple matches are
  68       specified matching different fields, the log entries are
  69       filtered by both, i.e. the resulting output will show only
  70       entries matching all the specified matches of this kind. If two
  71       matches apply to the same field, then they are automatically
  72       matched as alternatives, i.e. the resulting output will show
  73       entries matching any of the specified matches for the same
  74       field. Finally, the character <literal>+</literal> may appear
  75       as a separate word between other terms on the command line. This
  76       causes all matches before and after to be combined in a
  77       disjunction (i.e. logical OR).</para>
  78
  79       <para>It is also possible to filter the entries by specifying an
  80       absolute file path as an argument. The file path may be a file or
  81       a symbolic link and the file must exist at the time of the query. If a
  82       file path refers to an executable binary, an <literal>_EXE=</literal>
  83       match for the canonicalized binary path is added to the query. If a
  84       file path refers to an executable script, a <literal>_COMM=</literal>
  85       match for the script name is added to the query. If a file path
  86       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
  87       the kernel name of the device and for each of its ancestor devices is
  88       added to the query. Symbolic links are dereferenced, kernel names are
  89       synthesized, and parent devices are identified from the environment at
  90       the time of the query. In general, a device node is the best proxy for
  91       an actual device, as log entries do not usually contain fields that
  92       identify an actual device. For the resulting log entries to be correct
  93       for the actual device, the relevant parts of the environment at the time
  94       the entry was logged, in particular the actual device corresponding to
  95       the device node, must have been the same as those at the time of the
  96       query. Because device nodes generally change their corresponding devices
  97       across reboots, specifying a device node path causes the resulting
  98       entries to be restricted to those from the current boot.</para>
  99
 100       <para>Additional constraints may be added using options
 101       <option>--boot</option>, <option>--unit=</option>, etc., to
 102       further limit what entries will be shown (logical AND).</para>
 103
 104       <para>Output is interleaved from all accessible journal files,
 105       whether they are rotated or currently being written, and
 106       regardless of whether they belong to the system itself or are
 107       accessible user journals.</para>
 108
 109       <para>The set of journal files which will be used can be
 110       modified using the <option>--user</option>,
 111       <option>--system</option>, <option>--directory</option>, and
 112       <option>--file</option> options, see below.</para>
 113
 114       <para>All users are granted access to their private per-user
 115       journals. However, by default, only root and users who are
 116       members of a few special groups are granted access to the system
 117       journal and the journals of other users. Members of the groups
 118       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 119       <literal>wheel</literal> can read all journal files. Note
 120       that the two latter groups traditionally have additional
 121       privileges specified by the distribution. Members of the
 122       <literal>wheel</literal> group can often perform administrative
 123       tasks.</para>
 124
 125       <para>The output is paged through <command>less</command> by
 126       default, and long lines are "truncated" to screen width. The
 127       hidden part can be viewed by using the left-arrow and
 128       right-arrow keys. Paging can be disabled; see the
 129       <option>--no-pager</option> option and the "Environment" section
 130       below.</para>
 131
 132       <para>When outputting to a tty, lines are colored according to
 133       priority: lines of level ERROR and higher are colored red; lines
 134       of level NOTICE and higher are highlighted; other lines are
 135       displayed normally.</para>
 136     </refsect1>
 137
 138     <refsect1>
 139       <title>Options</title>
 140
 141       <para>The following options are understood:</para>
 142
 143       <variablelist>
 144         <varlistentry>
 145           <term><option>--no-full</option></term>
 146           <term><option>--full</option></term>
 147           <term><option>-l</option></term>
 148
 149           <listitem><para>Ellipsize fields when they do not fit in
 150           available columns.  The default is to show full fields,
 151           allowing them to wrap or be truncated by the pager, if one
 152           is used.</para>
 153
 154           <para>The old options
 155           <option>-l</option>/<option>--full</option> are not useful
 156           anymore, except to undo <option>--no-full</option>.</para>
 157           </listitem>
 158         </varlistentry>
 159
 160         <varlistentry>
 161           <term><option>-a</option></term>
 162           <term><option>--all</option></term>
 163
 164           <listitem><para>Show all fields in full, even if they
 165           include unprintable characters or are very
 166           long.</para></listitem>
 167         </varlistentry>
 168
 169         <varlistentry>
 170           <term><option>-f</option></term>
 171           <term><option>--follow</option></term>
 172
 173           <listitem><para>Show only the most recent journal entries,
 174           and continuously print new entries as they are appended to
 175           the journal.</para></listitem>
 176         </varlistentry>
 177
 178         <varlistentry>
 179           <term><option>-e</option></term>
 180           <term><option>--pager-end</option></term>
 181
 182           <listitem><para>Immediately jump to the end of the journal
 183           inside the implied pager tool. This implies
 184           <option>-n1000</option> to guarantee that the pager will not
 185           buffer logs of unbounded size. This may be overridden with
 186           an explicit <option>-n</option> with some other numeric
 187           value, while <option>-nall</option> will disable this cap.
 188           Note that this option is only supported for the
 189           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 190           pager.</para></listitem>
 191         </varlistentry>
 192
 193         <varlistentry>
 194           <term><option>-n</option></term>
 195           <term><option>--lines=</option></term>
 196
 197           <listitem><para>Show the most recent journal events and
 198           limit the number of events shown. If
 199           <option>--follow</option> is used, this option is
 200           implied. The argument is a positive integer or
 201           <literal>all</literal> to disable line limiting. The default
 202           value is 10 if no argument is given.</para></listitem>
 203         </varlistentry>
 204
 205         <varlistentry>
 206           <term><option>--no-tail</option></term>
 207
 208           <listitem><para>Show all stored output lines, even in follow
 209           mode. Undoes the effect of <option>--lines=</option>.
 210           </para></listitem>
 211         </varlistentry>
 212
 213         <varlistentry>
 214           <term><option>-r</option></term>
 215           <term><option>--reverse</option></term>
 216
 217           <listitem><para>Reverse output so that the newest entries
 218           are displayed first.</para></listitem>
 219         </varlistentry>
 220
 221         <varlistentry>
 222           <term><option>-o</option></term>
 223           <term><option>--output=</option></term>
 224
 225           <listitem><para>Controls the formatting of the journal
 226           entries that are shown. Takes one of the following
 227           options:</para>
 228           <variablelist>
 229             <varlistentry>
 230               <term>
 231                 <option>short</option>
 232               </term>
 233               <listitem>
 234                 <para>is the default and generates an output that is
 235                 mostly identical to the formatting of classic syslog
 236                 files, showing one line per journal entry.</para>
 237               </listitem>
 238             </varlistentry>
 239
 240             <varlistentry>
 241               <term>
 242                 <option>short-full</option>
 243               </term>
 244               <listitem>
 245                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 246                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 247                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 248                 output, and is locale-independent.</para>
 249               </listitem>
 250             </varlistentry>
 251
 252             <varlistentry>
 253               <term>
 254                 <option>short-iso</option>
 255               </term>
 256               <listitem>
 257                 <para>is very similar, but shows ISO 8601 wallclock
 258                 timestamps.</para>
 259               </listitem>
 260             </varlistentry>
 261
 262             <varlistentry>
 263               <term>
 264                 <option>short-iso-precise</option>
 265               </term>
 266               <listitem>
 267                 <para>as for <option>short-iso</option> but includes full
 268                 microsecond precision.</para>
 269               </listitem>
 270             </varlistentry>
 271
 272             <varlistentry>
 273               <term>
 274                 <option>short-precise</option>
 275               </term>
 276               <listitem>
 277                 <para>is very similar, but shows classic syslog timestamps
 278                 with full microsecond precision.</para>
 279               </listitem>
 280             </varlistentry>
 281
 282             <varlistentry>
 283               <term>
 284                 <option>short-monotonic</option>
 285               </term>
 286               <listitem>
 287                 <para>is very similar, but shows monotonic timestamps
 288                 instead of wallclock timestamps.</para>
 289               </listitem>
 290             </varlistentry>
 291
 292             <varlistentry>
 293               <term>
 294                 <option>short-unix</option>
 295               </term>
 296               <listitem>
 297                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 298                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 299               </listitem>
 300             </varlistentry>
 301
 302             <varlistentry>
 303               <term>
 304                 <option>verbose</option>
 305               </term>
 306               <listitem>
 307                 <para>shows the full-structured entry items with all
 308                 fields.</para>
 309               </listitem>
 310             </varlistentry>
 311
 312             <varlistentry>
 313               <term>
 314                 <option>export</option>
 315               </term>
 316               <listitem>
 317                 <para>serializes the journal into a binary (but mostly
 318                 text-based) stream suitable for backups and network
 319                 transfer (see
 320                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 321                 for more information). To import the binary stream back
 322                 into native journald format use
 323                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 324               </listitem>
 325             </varlistentry>
 326
 327             <varlistentry>
 328               <term>
 329                 <option>json</option>
 330               </term>
 331               <listitem>
 332                 <para>formats entries as JSON data structures, one per
 333                 line (see
 334                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink>
 335                 for more information).</para>
 336               </listitem>
 337             </varlistentry>
 338
 339             <varlistentry>
 340               <term>
 341                 <option>json-pretty</option>
 342               </term>
 343               <listitem>
 344                 <para>formats entries as JSON data structures, but
 345                 formats them in multiple lines in order to make them
 346                 more readable by humans.</para>
 347               </listitem>
 348             </varlistentry>
 349
 350             <varlistentry>
 351               <term>
 352                 <option>json-sse</option>
 353               </term>
 354               <listitem>
 355                 <para>formats entries as JSON data structures, but wraps
 356                 them in a format suitable for
 357                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 358                 </para>
 359               </listitem>
 360             </varlistentry>
 361
 362             <varlistentry>
 363               <term>
 364                 <option>cat</option>
 365               </term>
 366               <listitem>
 367                 <para>generates a very terse output, only showing the
 368                 actual message of each journal entry with no metadata,
 369                 not even a timestamp.</para>
 370               </listitem>
 371             </varlistentry>
 372
 373             <varlistentry>
 374               <term>
 375                 <option>with-unit</option>
 376               </term>
 377               <listitem>
 378                 <para>similar to short-full, but prefixes the unit and
 379                 user unit names instead of the traditional syslog
 380                 identifier. Useful when using templated instances, as it
 381                 will include the arguments in the unit names.</para>
 382               </listitem>
 383             </varlistentry>
 384           </variablelist>
 385         </listitem>
 386       </varlistentry>
 387
 388       <varlistentry>
 389         <term><option>--output-fields=</option></term>
 390
 391         <listitem><para>A comma separated list of the fields which should
 392         be included in the output. This only has an effect for the output modes
 393         which would normally show all fields (<option>verbose</option>,
 394         <option>export</option>, <option>json</option>,
 395         <option>json-pretty</option>, and <option>json-sse</option>). The
 396         <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 397         <literal>__MONOTONIC_TIMESTAMP</literal>, and
 398         <literal>_BOOT_ID</literal> fields are always
 399         printed.</para></listitem>
 400       </varlistentry>
 401
 402       <varlistentry>
 403         <term><option>--utc</option></term>
 404
 405         <listitem><para>Express time in Coordinated Universal Time
 406         (UTC).</para></listitem>
 407       </varlistentry>
 408
 409       <varlistentry>
 410         <term><option>--no-hostname</option></term>
 411
 412         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 413         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 414       </varlistentry>
 415
 416       <varlistentry>
 417         <term><option>-x</option></term>
 418         <term><option>--catalog</option></term>
 419
 420         <listitem><para>Augment log lines with explanation texts from
 421         the message catalog. This will add explanatory help texts to
 422         log messages in the output where this is available. These
 423         short help texts will explain the context of an error or log
 424         event, possible solutions, as well as pointers to support
 425         forums, developer documentation, and any other relevant
 426         manuals. Note that help texts are not available for all
 427         messages, but only for selected ones. For more information on
 428         the message catalog, please refer to the
 429         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 430
 431         <para>Note: when attaching <command>journalctl</command>
 432         output to bug reports, please do <emphasis>not</emphasis> use
 433         <option>-x</option>.</para>
 434         </listitem>
 435       </varlistentry>
 436
 437       <varlistentry>
 438         <term><option>-q</option></term>
 439         <term><option>--quiet</option></term>
 440
 441         <listitem><para>Suppresses all informational messages
 442         (i.e. "-- Logs begin at …", "-- Reboot --"),
 443         any warning messages regarding
 444         inaccessible system journals when run as a normal
 445         user.</para></listitem>
 446       </varlistentry>
 447
 448       <varlistentry>
 449         <term><option>-m</option></term>
 450         <term><option>--merge</option></term>
 451
 452         <listitem><para>Show entries interleaved from all available
 453         journals, including remote ones.</para></listitem>
 454       </varlistentry>
 455
 456       <varlistentry>
 457         <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 458         <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 459
 460         <listitem><para>Show messages from a specific boot. This will
 461         add a match for <literal>_BOOT_ID=</literal>.</para>
 462
 463         <para>The argument may be empty, in which case logs for the
 464         current boot will be shown.</para>
 465
 466         <para>If the boot ID is omitted, a positive
 467         <replaceable>offset</replaceable> will look up the boots
 468         starting from the beginning of the journal, and an
 469         equal-or-less-than zero <replaceable>offset</replaceable> will
 470         look up boots starting from the end of the journal. Thus,
 471         <constant>1</constant> means the first boot found in the
 472         journal in chronological order, <constant>2</constant> the
 473         second and so on; while <constant>-0</constant> is the last
 474         boot, <constant>-1</constant> the boot before last, and so
 475         on. An empty <replaceable>offset</replaceable> is equivalent
 476         to specifying <constant>-0</constant>, except when the current
 477         boot is not the last boot (e.g. because
 478         <option>--directory</option> was specified to look at logs
 479         from a different machine).</para>
 480
 481         <para>If the 32-character <replaceable>ID</replaceable> is
 482         specified, it may optionally be followed by
 483         <replaceable>offset</replaceable> which identifies the boot
 484         relative to the one given by boot
 485         <replaceable>ID</replaceable>. Negative values mean earlier
 486         boots and positive values mean later boots. If
 487         <replaceable>offset</replaceable> is not specified, a value of
 488         zero is assumed, and the logs for the boot given by
 489         <replaceable>ID</replaceable> are shown.</para>
 490         </listitem>
 491       </varlistentry>
 492
 493       <varlistentry>
 494         <term><option>--list-boots</option></term>
 495
 496         <listitem><para>Show a tabular list of boot numbers (relative to
 497         the current boot), their IDs, and the timestamps of the first
 498         and last message pertaining to the boot.</para></listitem>
 499       </varlistentry>
 500
 501       <varlistentry>
 502         <term><option>-k</option></term>
 503         <term><option>--dmesg</option></term>
 504
 505         <listitem><para>Show only kernel messages. This implies
 506         <option>-b</option> and adds the match
 507         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 508       </varlistentry>
 509
 510       <varlistentry>
 511         <term><option>-t</option></term>
 512         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 513
 514         <listitem><para>Show messages for the specified syslog
 515         identifier
 516         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 517
 518         <para>This parameter can be specified multiple
 519         times.</para></listitem>
 520       </varlistentry>
 521
 522       <varlistentry>
 523         <term><option>-u</option></term>
 524         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 525
 526         <listitem><para>Show messages for the specified systemd unit
 527         <replaceable>UNIT</replaceable> (such as a service unit), or
 528         for any of the units matched by
 529         <replaceable>PATTERN</replaceable>.  If a pattern is
 530         specified, a list of unit names found in the journal is
 531         compared with the specified pattern and all that match are
 532         used. For each unit name, a match is added for messages from
 533         the unit
 534         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 535         along with additional matches for messages from systemd and
 536         messages about coredumps for the specified unit.</para>
 537
 538         <para>This parameter can be specified multiple times.</para>
 539         </listitem>
 540       </varlistentry>
 541
 542       <varlistentry>
 543         <term><option>--user-unit=</option></term>
 544
 545         <listitem><para>Show messages for the specified user session
 546         unit. This will add a match for messages from the unit
 547         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 548         <literal>_UID=</literal>) and additional matches for messages
 549         from session systemd and messages about coredumps for the
 550         specified unit.</para>
 551
 552         <para>This parameter can be specified multiple times.</para>
 553         </listitem>
 554       </varlistentry>
 555
 556       <varlistentry>
 557         <term><option>-p</option></term>
 558         <term><option>--priority=</option></term>
 559
 560         <listitem><para>Filter output by message priorities or
 561         priority ranges. Takes either a single numeric or textual log
 562         level (i.e. between 0/<literal>emerg</literal> and
 563         7/<literal>debug</literal>), or a range of numeric/text log
 564         levels in the form FROM..TO. The log levels are the usual
 565         syslog log levels as documented in
 566         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 567         i.e. <literal>emerg</literal> (0),
 568         <literal>alert</literal> (1), <literal>crit</literal> (2),
 569         <literal>err</literal> (3), <literal>warning</literal> (4),
 570         <literal>notice</literal> (5), <literal>info</literal> (6),
 571         <literal>debug</literal> (7). If a single log level is
 572         specified, all messages with this log level or a lower (hence
 573         more important) log level are shown. If a range is specified,
 574         all messages within the range are shown, including both the
 575         start and the end value of the range. This will add
 576         <literal>PRIORITY=</literal> matches for the specified
 577         priorities.</para></listitem>
 578       </varlistentry>
 579
 580       <varlistentry>
 581         <term><option>-g</option></term>
 582         <term><option>--grep=</option></term>
 583
 584         <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname>
 585         field matches the specified regular expression. PERL-compatible regular expressions
 586         are used, see
 587         <citerefentry><refentrytitle>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 588         for a detailed description of the syntax.</para>
 589
 590         <para>If the pattern is all lowercase, matching is case insensitive.
 591         Otherwise, matching is case sensitive. This can be overridden with the
 592         <option>--case-sensitive</option> option, see below.</para>
 593         </listitem>
 594       </varlistentry>
 595
 596       <varlistentry>
 597         <term><option>--case-sensitive<optional>=BOOLEAN</optional></option></term>
 598
 599         <listitem><para>Make pattern matching case sensitive or case insenstive.</para>
 600         </listitem>
 601       </varlistentry>
 602
 603       <varlistentry>
 604         <term><option>-c</option></term>
 605         <term><option>--cursor=</option></term>
 606
 607         <listitem><para>Start showing entries from the location in the
 608         journal specified by the passed cursor.</para></listitem>
 609       </varlistentry>
 610
 611       <varlistentry>
 612         <term><option>--after-cursor=</option></term>
 613
 614         <listitem><para>Start showing entries from the location in the
 615         journal <emphasis>after</emphasis> the location specified by
 616         the passed cursor.  The cursor is shown when the
 617         <option>--show-cursor</option> option is used.</para>
 618         </listitem>
 619       </varlistentry>
 620
 621       <varlistentry>
 622         <term><option>--show-cursor</option></term>
 623
 624         <listitem><para>The cursor is shown after the last entry after
 625         two dashes:</para>
 626         <programlisting>-- cursor: s=0639…</programlisting>
 627         <para>The format of the cursor is private
 628         and subject to change.</para></listitem>
 629       </varlistentry>
 630
 631       <varlistentry>
 632         <term><option>-S</option></term>
 633         <term><option>--since=</option></term>
 634         <term><option>-U</option></term>
 635         <term><option>--until=</option></term>
 636
 637         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 638         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 639         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 640         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 641         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 642         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 643         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 644         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 645         time, respectively. For complete time and date specification, see
 646         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 647         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 648         </para>
 649         </listitem>
 650       </varlistentry>
 651
 652       <varlistentry>
 653         <term><option>-F</option></term>
 654         <term><option>--field=</option></term>
 655
 656         <listitem><para>Print all possible data values the specified
 657         field can take in all entries of the journal.</para></listitem>
 658       </varlistentry>
 659
 660       <varlistentry>
 661         <term><option>-N</option></term>
 662         <term><option>--fields</option></term>
 663
 664         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 665       </varlistentry>
 666
 667       <varlistentry>
 668         <term><option>--system</option></term>
 669         <term><option>--user</option></term>
 670
 671         <listitem><para>Show messages from system services and the
 672         kernel (with <option>--system</option>). Show messages from
 673         service of current user (with <option>--user</option>).  If
 674         neither is specified, show all messages that the user can see.
 675         </para></listitem>
 676       </varlistentry>
 677
 678       <varlistentry>
 679         <term><option>-M</option></term>
 680         <term><option>--machine=</option></term>
 681
 682         <listitem><para>Show messages from a running, local
 683         container. Specify a container name to connect to.</para>
 684         </listitem>
 685       </varlistentry>
 686
 687       <varlistentry>
 688         <term><option>-D <replaceable>DIR</replaceable></option></term>
 689         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 690
 691         <listitem><para>Takes a directory path as argument. If
 692         specified, journalctl will operate on the specified journal
 693         directory <replaceable>DIR</replaceable> instead of the
 694         default runtime and system journal paths.</para></listitem>
 695       </varlistentry>
 696
 697       <varlistentry>
 698         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 699
 700         <listitem><para>Takes a file glob as an argument. If
 701         specified, journalctl will operate on the specified journal
 702         files matching <replaceable>GLOB</replaceable> instead of the
 703         default runtime and system journal paths. May be specified
 704         multiple times, in which case files will be suitably
 705         interleaved.</para></listitem>
 706       </varlistentry>
 707
 708       <varlistentry>
 709         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 710
 711         <listitem><para>Takes a directory path as an argument. If
 712         specified, journalctl will operate on journal directories and catalog file hierarchy
 713         underneath the specified directory instead of the root
 714         directory (e.g. <option>--update-catalog</option> will create
 715         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 716         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 717         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 718         </para></listitem>
 719       </varlistentry>
 720
 721       <varlistentry>
 722         <term><option>--new-id128</option></term>
 723
 724         <listitem><para>Instead of showing journal contents, generate
 725         a new 128-bit ID suitable for identifying messages. This is
 726         intended for usage by developers who need a new identifier for
 727         a new message they introduce and want to make
 728         recognizable. This will print the new ID in four different
 729         formats which can be copied into source code or similar.
 730         </para></listitem>
 731       </varlistentry>
 732
 733       <varlistentry>
 734         <term><option>--header</option></term>
 735
 736         <listitem><para>Instead of showing journal contents, show
 737         internal header information of the journal fields
 738         accessed.</para></listitem>
 739       </varlistentry>
 740
 741       <varlistentry>
 742         <term><option>--disk-usage</option></term>
 743
 744         <listitem><para>Shows the current disk usage of all journal
 745         files. This shows the sum of the disk usage of all archived
 746         and active journal files.</para></listitem>
 747       </varlistentry>
 748
 749       <varlistentry>
 750         <term><option>--vacuum-size=</option></term>
 751         <term><option>--vacuum-time=</option></term>
 752         <term><option>--vacuum-files=</option></term>
 753
 754         <listitem><para>Removes the oldest archived journal files until the disk
 755         space they use falls below the specified size (specified with
 756         the usual <literal>K</literal>, <literal>M</literal>,
 757         <literal>G</literal> and <literal>T</literal> suffixes), or all
 758         archived journal files contain no data older than the specified
 759         timespan (specified with the usual <literal>s</literal>,
 760         <literal>m</literal>, <literal>h</literal>,
 761         <literal>days</literal>, <literal>months</literal>,
 762         <literal>weeks</literal> and <literal>years</literal> suffixes),
 763         or no more than the specified number of separate journal files
 764         remain. Note that running <option>--vacuum-size=</option> has
 765         only an indirect effect on the output shown by
 766         <option>--disk-usage</option>, as the latter includes active
 767         journal files, while the vacuuming operation only operates
 768         on archived journal files. Similarly,
 769         <option>--vacuum-files=</option> might not actually reduce the
 770         number of journal files to below the specified number, as it
 771         will not remove active journal
 772         files. <option>--vacuum-size=</option>,
 773         <option>--vacuum-time=</option> and
 774         <option>--vacuum-files=</option> may be combined in a single
 775         invocation to enforce any combination of a size, a time and a
 776         number of files limit on the archived journal
 777         files. Specifying any of these three parameters as zero is
 778         equivalent to not enforcing the specific limit, and is thus
 779         redundant.</para></listitem>
 780       </varlistentry>
 781
 782       <varlistentry>
 783         <term><option>--list-catalog
 784         <optional><replaceable>128-bit-ID…</replaceable></optional>
 785         </option></term>
 786
 787         <listitem><para>List the contents of the message catalog as a
 788         table of message IDs, plus their short description strings.
 789         </para>
 790
 791         <para>If any <replaceable>128-bit-ID</replaceable>s are
 792         specified, only those entries are shown.</para>
 793         </listitem>
 794       </varlistentry>
 795
 796       <varlistentry>
 797         <term><option>--dump-catalog
 798         <optional><replaceable>128-bit-ID…</replaceable></optional>
 799         </option></term>
 800
 801         <listitem><para>Show the contents of the message catalog, with
 802         entries separated by a line consisting of two dashes and the
 803         ID (the format is the same as <filename>.catalog</filename>
 804         files).</para>
 805
 806         <para>If any <replaceable>128-bit-ID</replaceable>s are
 807         specified, only those entries are shown.</para>
 808         </listitem>
 809       </varlistentry>
 810
 811       <varlistentry>
 812         <term><option>--update-catalog</option></term>
 813
 814         <listitem><para>Update the message catalog index. This command
 815         needs to be executed each time new catalog files are
 816         installed, removed, or updated to rebuild the binary catalog
 817         index.</para></listitem>
 818       </varlistentry>
 819
 820       <varlistentry>
 821         <term><option>--setup-keys</option></term>
 822
 823         <listitem><para>Instead of showing journal contents, generate
 824         a new key pair for Forward Secure Sealing (FSS). This will
 825         generate a sealing key and a verification key. The sealing key
 826         is stored in the journal data directory and shall remain on
 827         the host. The verification key should be stored
 828         externally. Refer to the <option>Seal=</option> option in
 829         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 830         for information on Forward Secure Sealing and for a link to a
 831         refereed scholarly paper detailing the cryptographic theory it
 832         is based on.</para></listitem>
 833       </varlistentry>
 834
 835       <varlistentry>
 836         <term><option>--force</option></term>
 837
 838         <listitem><para>When <option>--setup-keys</option> is passed
 839         and Forward Secure Sealing (FSS) has already been configured,
 840         recreate FSS keys.</para></listitem>
 841       </varlistentry>
 842
 843       <varlistentry>
 844         <term><option>--interval=</option></term>
 845
 846         <listitem><para>Specifies the change interval for the sealing
 847         key when generating an FSS key pair with
 848         <option>--setup-keys</option>. Shorter intervals increase CPU
 849         consumption but shorten the time range of undetectable journal
 850         alterations. Defaults to 15min.</para></listitem>
 851       </varlistentry>
 852
 853       <varlistentry>
 854         <term><option>--verify</option></term>
 855
 856         <listitem><para>Check the journal file for internal
 857         consistency. If the file has been generated with FSS enabled and
 858         the FSS verification key has been specified with
 859         <option>--verify-key=</option>, authenticity of the journal file
 860         is verified.</para></listitem>
 861       </varlistentry>
 862
 863       <varlistentry>
 864         <term><option>--verify-key=</option></term>
 865
 866         <listitem><para>Specifies the FSS verification key to use for
 867         the <option>--verify</option> operation.</para></listitem>
 868       </varlistentry>
 869
 870       <varlistentry>
 871         <term><option>--sync</option></term>
 872
 873         <listitem><para>Asks the journal daemon to write all yet
 874         unwritten journal data to the backing file system and
 875         synchronize all journals. This call does not return until the
 876         synchronization operation is complete. This command guarantees
 877         that any log messages written before its invocation are safely
 878         stored on disk at the time it returns.</para></listitem>
 879       </varlistentry>
 880
 881       <varlistentry>
 882         <term><option>--flush</option></term>
 883
 884         <listitem><para>Asks the journal daemon to flush any log data
 885         stored in <filename>/run/log/journal</filename> into
 886         <filename>/var/log/journal</filename>, if persistent storage
 887         is enabled. This call does not return until the operation is
 888         complete. Note that this call is idempotent: the data is only
 889         flushed from <filename>/run/log/journal</filename> into
 890         <filename>/var/log/journal</filename> once during system
 891         runtime, and this command exits cleanly without executing any
 892         operation if this has already happened. This command
 893         effectively guarantees that all data is flushed to
 894         <filename>/var/log/journal</filename> at the time it
 895         returns.</para></listitem>
 896       </varlistentry>
 897
 898       <varlistentry>
 899         <term><option>--rotate</option></term>
 900
 901         <listitem><para>Asks the journal daemon to rotate journal
 902         files. This call does not return until the rotation operation
 903         is complete.</para></listitem>
 904       </varlistentry>
 905
 906       <xi:include href="standard-options.xml" xpointer="help" />
 907       <xi:include href="standard-options.xml" xpointer="version" />
 908       <xi:include href="standard-options.xml" xpointer="no-pager" />
 909     </variablelist>
 910   </refsect1>
 911
 912   <refsect1>
 913     <title>Exit status</title>
 914
 915     <para>On success, 0 is returned; otherwise, a non-zero failure
 916     code is returned.</para>
 917   </refsect1>
 918
 919   <xi:include href="less-variables.xml" />
 920
 921   <refsect1>
 922     <title>Examples</title>
 923
 924     <para>Without arguments, all collected logs are shown
 925     unfiltered:</para>
 926
 927     <programlisting>journalctl</programlisting>
 928
 929     <para>With one match specified, all entries with a field matching
 930     the expression are shown:</para>
 931
 932     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service
 933 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting>
 934
 935     <para>If two different fields are matched, only entries matching
 936     both expressions at the same time are shown:</para>
 937
 938     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 939
 940     <para>If two matches refer to the same field, all entries matching
 941     either expression are shown:</para>
 942
 943     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 944
 945     <para>If the separator <literal>+</literal> is used, two
 946     expressions may be combined in a logical OR. The following will
 947     show all messages from the Avahi service process with the PID
 948     28097 plus all messages from the D-Bus service (from any of its
 949     processes):</para>
 950
 951     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 952
 953     <para>To show all fields emitted <emphasis>by</emphasis> a unit and <emphasis>about</emphasis>
 954     the unit, option <option>-u</option>/<option>--unit=</option> should be used.
 955     <command>journalctl -u <replaceable>name</replaceable></command>
 956     expands to a complex filter similar to
 957     <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service
 958   + UNIT=<replaceable>name</replaceable>.service _PID=1
 959   + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0
 960   + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
 961     </programlisting>
 962     (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 963     for an explanation of those patterns).
 964     </para>
 965
 966     <para>Show all logs generated by the D-Bus executable:</para>
 967
 968     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 969
 970     <para>Show all kernel logs from previous boot:</para>
 971
 972     <programlisting>journalctl -k -b -1</programlisting>
 973
 974     <para>Show a live log display from a system service
 975     <filename>apache.service</filename>:</para>
 976
 977     <programlisting>journalctl -f -u apache</programlisting>
 978
 979   </refsect1>
 980
 981   <refsect1>
 982     <title>See Also</title>
 983     <para>
 984       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 985       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 986       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 987       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 988       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 989       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 990       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 991       <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 992       <citerefentry><refentrytitle>systemd-journal-upload.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 993     </para>
 994   </refsect1>
 995 </refentry>