man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   This file is part of systemd.
   9
  10   Copyright 2012 Lennart Poettering
  11
  12   systemd is free software; you can redistribute it and/or modify it
  13   under the terms of the GNU Lesser General Public License as published by
  14   the Free Software Foundation; either version 2.1 of the License, or
  15   (at your option) any later version.
  16
  17   systemd is distributed in the hope that it will be useful, but
  18   WITHOUT ANY WARRANTY; without even the implied warranty of
  19   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  20   Lesser General Public License for more details.
  21
  22   You should have received a copy of the GNU Lesser General Public License
  23   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  24 -->
  25
  26   <refentry id="journalctl"
  27             xmlns:xi="http://www.w3.org/2001/XInclude">
  28
  29     <refentryinfo>
  30       <title>journalctl</title>
  31       <productname>systemd</productname>
  32
  33       <authorgroup>
  34         <author>
  35           <contrib>Developer</contrib>
  36           <firstname>Lennart</firstname>
  37           <surname>Poettering</surname>
  38           <email>lennart@poettering.net</email>
  39         </author>
  40       </authorgroup>
  41     </refentryinfo>
  42
  43     <refmeta>
  44       <refentrytitle>journalctl</refentrytitle>
  45       <manvolnum>1</manvolnum>
  46     </refmeta>
  47
  48     <refnamediv>
  49       <refname>journalctl</refname>
  50       <refpurpose>Query the systemd journal</refpurpose>
  51     </refnamediv>
  52
  53     <refsynopsisdiv>
  54       <cmdsynopsis>
  55         <command>journalctl</command>
  56         <arg choice="opt" rep="repeat">OPTIONS</arg>
  57         <arg choice="opt" rep="repeat">MATCHES</arg>
  58       </cmdsynopsis>
  59     </refsynopsisdiv>
  60
  61     <refsect1>
  62       <title>Description</title>
  63
  64       <para><command>journalctl</command> may be used to query the
  65       contents of the
  66       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  67       journal as written by
  68       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  69
  70       <para>If called without parameters, it will show the full
  71       contents of the journal, starting with the oldest entry
  72       collected.</para>
  73
  74       <para>If one or more match arguments are passed, the output is
  75       filtered accordingly. A match is in the format
  76       <literal>FIELD=VALUE</literal>,
  77       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  78       to the components of a structured journal entry. See
  79       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  80       for a list of well-known fields. If multiple matches are
  81       specified matching different fields, the log entries are
  82       filtered by both, i.e. the resulting output will show only
  83       entries matching all the specified matches of this kind. If two
  84       matches apply to the same field, then they are automatically
  85       matched as alternatives, i.e. the resulting output will show
  86       entries matching any of the specified matches for the same
  87       field. Finally, the character <literal>+</literal> may appear
  88       as a separate word between other terms on the command line. This
  89       causes all matches before and after to be combined in a
  90       disjunction (i.e. logical OR).</para>
  91
  92       <para>It is also possible to filter the entries by specifying an
  93       absolute file path as an argument. The file path may be a file or
  94       a symbolic link and the file must exist at the time of the query. If a
  95       file path refers to an executable binary, an <literal>_EXE=</literal>
  96       match for the canonicalized binary path is added to the query. If a
  97       file path refers to an executable script, a <literal>_COMM=</literal>
  98       match for the script name is added to the query. If a file path
  99       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
 100       the kernel name of the device and for each of its ancestor devices is
 101       added to the query. Symbolic links are dereferenced, kernel names are
 102       synthesized, and parent devices are identified from the environment at
 103       the time of the query. In general, a device node is the best proxy for
 104       an actual device, as log entries do not usually contain fields that
 105       identify an actual device. For the resulting log entries to be correct
 106       for the actual device, the relevant parts of the environment at the time
 107       the entry was logged, in particular the actual device corresponding to
 108       the device node, must have been the same as those at the time of the
 109       query. Because device nodes generally change their corresponding devices
 110       across reboots, specifying a device node path causes the resulting
 111       entries to be restricted to those from the current boot.</para>
 112
 113       <para>Additional constraints may be added using options
 114       <option>--boot</option>, <option>--unit=</option>, etc., to
 115       further limit what entries will be shown (logical AND).</para>
 116
 117       <para>Output is interleaved from all accessible journal files,
 118       whether they are rotated or currently being written, and
 119       regardless of whether they belong to the system itself or are
 120       accessible user journals.</para>
 121
 122       <para>The set of journal files which will be used can be
 123       modified using the <option>--user</option>,
 124       <option>--system</option>, <option>--directory</option>, and
 125       <option>--file</option> options, see below.</para>
 126
 127       <para>All users are granted access to their private per-user
 128       journals. However, by default, only root and users who are
 129       members of a few special groups are granted access to the system
 130       journal and the journals of other users. Members of the groups
 131       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 132       <literal>wheel</literal> can read all journal files. Note
 133       that the two latter groups traditionally have additional
 134       privileges specified by the distribution. Members of the
 135       <literal>wheel</literal> group can often perform administrative
 136       tasks.</para>
 137
 138       <para>The output is paged through <command>less</command> by
 139       default, and long lines are "truncated" to screen width. The
 140       hidden part can be viewed by using the left-arrow and
 141       right-arrow keys. Paging can be disabled; see the
 142       <option>--no-pager</option> option and the "Environment" section
 143       below.</para>
 144
 145       <para>When outputting to a tty, lines are colored according to
 146       priority: lines of level ERROR and higher are colored red; lines
 147       of level NOTICE and higher are highlighted; other lines are
 148       displayed normally.</para>
 149     </refsect1>
 150
 151     <refsect1>
 152       <title>Options</title>
 153
 154       <para>The following options are understood:</para>
 155
 156       <variablelist>
 157         <varlistentry>
 158           <term><option>--no-full</option></term>
 159           <term><option>--full</option></term>
 160           <term><option>-l</option></term>
 161
 162           <listitem><para>Ellipsize fields when they do not fit in
 163           available columns.  The default is to show full fields,
 164           allowing them to wrap or be truncated by the pager, if one
 165           is used.</para>
 166
 167           <para>The old options
 168           <option>-l</option>/<option>--full</option> are not useful
 169           anymore, except to undo <option>--no-full</option>.</para>
 170           </listitem>
 171         </varlistentry>
 172
 173         <varlistentry>
 174           <term><option>-a</option></term>
 175           <term><option>--all</option></term>
 176
 177           <listitem><para>Show all fields in full, even if they
 178           include unprintable characters or are very
 179           long.</para></listitem>
 180         </varlistentry>
 181
 182         <varlistentry>
 183           <term><option>-f</option></term>
 184           <term><option>--follow</option></term>
 185
 186           <listitem><para>Show only the most recent journal entries,
 187           and continuously print new entries as they are appended to
 188           the journal.</para></listitem>
 189         </varlistentry>
 190
 191         <varlistentry>
 192           <term><option>-e</option></term>
 193           <term><option>--pager-end</option></term>
 194
 195           <listitem><para>Immediately jump to the end of the journal
 196           inside the implied pager tool. This implies
 197           <option>-n1000</option> to guarantee that the pager will not
 198           buffer logs of unbounded size. This may be overridden with
 199           an explicit <option>-n</option> with some other numeric
 200           value, while <option>-nall</option> will disable this cap.
 201           Note that this option is only supported for the
 202           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 203           pager.</para></listitem>
 204         </varlistentry>
 205
 206         <varlistentry>
 207           <term><option>-n</option></term>
 208           <term><option>--lines=</option></term>
 209
 210           <listitem><para>Show the most recent journal events and
 211           limit the number of events shown. If
 212           <option>--follow</option> is used, this option is
 213           implied. The argument is a positive integer or
 214           <literal>all</literal> to disable line limiting. The default
 215           value is 10 if no argument is given.</para></listitem>
 216         </varlistentry>
 217
 218         <varlistentry>
 219           <term><option>--no-tail</option></term>
 220
 221           <listitem><para>Show all stored output lines, even in follow
 222           mode. Undoes the effect of <option>--lines=</option>.
 223           </para></listitem>
 224         </varlistentry>
 225
 226         <varlistentry>
 227           <term><option>-r</option></term>
 228           <term><option>--reverse</option></term>
 229
 230           <listitem><para>Reverse output so that the newest entries
 231           are displayed first.</para></listitem>
 232         </varlistentry>
 233
 234         <varlistentry>
 235           <term><option>-o</option></term>
 236           <term><option>--output=</option></term>
 237
 238           <listitem><para>Controls the formatting of the journal
 239           entries that are shown. Takes one of the following
 240           options:</para>
 241           <variablelist>
 242             <varlistentry>
 243               <term>
 244                 <option>short</option>
 245               </term>
 246               <listitem>
 247                 <para>is the default and generates an output that is
 248                 mostly identical to the formatting of classic syslog
 249                 files, showing one line per journal entry.</para>
 250               </listitem>
 251             </varlistentry>
 252
 253             <varlistentry>
 254               <term>
 255                 <option>short-full</option>
 256               </term>
 257               <listitem>
 258                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 259                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 260                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 261                 output, and is locale-independent.</para>
 262               </listitem>
 263             </varlistentry>
 264
 265             <varlistentry>
 266               <term>
 267                 <option>short-iso</option>
 268               </term>
 269               <listitem>
 270                 <para>is very similar, but shows ISO 8601 wallclock
 271                 timestamps.</para>
 272               </listitem>
 273             </varlistentry>
 274
 275             <varlistentry>
 276               <term>
 277                 <option>short-iso-precise</option>
 278               </term>
 279               <listitem>
 280                 <para>as for <option>short-iso</option> but includes full
 281                 microsecond precision.</para>
 282               </listitem>
 283             </varlistentry>
 284
 285             <varlistentry>
 286               <term>
 287                 <option>short-precise</option>
 288               </term>
 289               <listitem>
 290                 <para>is very similar, but shows classic syslog timestamps
 291                 with full microsecond precision.</para>
 292               </listitem>
 293             </varlistentry>
 294
 295             <varlistentry>
 296               <term>
 297                 <option>short-monotonic</option>
 298               </term>
 299               <listitem>
 300                 <para>is very similar, but shows monotonic timestamps
 301                 instead of wallclock timestamps.</para>
 302               </listitem>
 303             </varlistentry>
 304
 305             <varlistentry>
 306               <term>
 307                 <option>short-unix</option>
 308               </term>
 309               <listitem>
 310                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 311                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 312               </listitem>
 313             </varlistentry>
 314
 315             <varlistentry>
 316               <term>
 317                 <option>verbose</option>
 318               </term>
 319               <listitem>
 320                 <para>shows the full-structured entry items with all
 321                 fields.</para>
 322               </listitem>
 323             </varlistentry>
 324
 325             <varlistentry>
 326               <term>
 327                 <option>export</option>
 328               </term>
 329               <listitem>
 330                 <para>serializes the journal into a binary (but mostly
 331                 text-based) stream suitable for backups and network
 332                 transfer (see
 333                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 334                 for more information). To import the binary stream back
 335                 into native journald format use
 336                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 337               </listitem>
 338             </varlistentry>
 339
 340             <varlistentry>
 341               <term>
 342                 <option>json</option>
 343               </term>
 344               <listitem>
 345                 <para>formats entries as JSON data structures, one per
 346                 line (see
 347                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink>
 348                 for more information).</para>
 349               </listitem>
 350             </varlistentry>
 351
 352             <varlistentry>
 353               <term>
 354                 <option>json-pretty</option>
 355               </term>
 356               <listitem>
 357                 <para>formats entries as JSON data structures, but
 358                 formats them in multiple lines in order to make them
 359                 more readable by humans.</para>
 360               </listitem>
 361             </varlistentry>
 362
 363             <varlistentry>
 364               <term>
 365                 <option>json-sse</option>
 366               </term>
 367               <listitem>
 368                 <para>formats entries as JSON data structures, but wraps
 369                 them in a format suitable for
 370                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 371                 </para>
 372               </listitem>
 373             </varlistentry>
 374
 375             <varlistentry>
 376               <term>
 377                 <option>cat</option>
 378               </term>
 379               <listitem>
 380                 <para>generates a very terse output, only showing the
 381                 actual message of each journal entry with no metadata,
 382                 not even a timestamp.</para>
 383               </listitem>
 384             </varlistentry>
 385           </variablelist>
 386         </listitem>
 387       </varlistentry>
 388
 389       <varlistentry>
 390         <term><option>--output-fields=</option></term>
 391
 392         <listitem><para>A comma separated list of the fields which should
 393         be included in the output. This only has an effect for the output modes
 394         which would normally show all fields (<option>verbose</option>,
 395         <option>export</option>, <option>json</option>,
 396         <option>json-pretty</option>, and <option>json-sse</option>). The
 397         <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 398         <literal>__MONOTONIC_TIMESTAMP</literal>, and
 399         <literal>_BOOT_ID</literal> fields are always
 400         printed.</para></listitem>
 401       </varlistentry>
 402
 403       <varlistentry>
 404         <term><option>--utc</option></term>
 405
 406         <listitem><para>Express time in Coordinated Universal Time
 407         (UTC).</para></listitem>
 408       </varlistentry>
 409
 410       <varlistentry>
 411         <term><option>--no-hostname</option></term>
 412
 413         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 414         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 415       </varlistentry>
 416
 417       <varlistentry>
 418         <term><option>-x</option></term>
 419         <term><option>--catalog</option></term>
 420
 421         <listitem><para>Augment log lines with explanation texts from
 422         the message catalog. This will add explanatory help texts to
 423         log messages in the output where this is available. These
 424         short help texts will explain the context of an error or log
 425         event, possible solutions, as well as pointers to support
 426         forums, developer documentation, and any other relevant
 427         manuals. Note that help texts are not available for all
 428         messages, but only for selected ones. For more information on
 429         the message catalog, please refer to the
 430         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 431
 432         <para>Note: when attaching <command>journalctl</command>
 433         output to bug reports, please do <emphasis>not</emphasis> use
 434         <option>-x</option>.</para>
 435         </listitem>
 436       </varlistentry>
 437
 438       <varlistentry>
 439         <term><option>-q</option></term>
 440         <term><option>--quiet</option></term>
 441
 442         <listitem><para>Suppresses all informational messages
 443         (i.e. "-- Logs begin at …", "-- Reboot --"),
 444         any warning messages regarding
 445         inaccessible system journals when run as a normal
 446         user.</para></listitem>
 447       </varlistentry>
 448
 449       <varlistentry>
 450         <term><option>-m</option></term>
 451         <term><option>--merge</option></term>
 452
 453         <listitem><para>Show entries interleaved from all available
 454         journals, including remote ones.</para></listitem>
 455       </varlistentry>
 456
 457       <varlistentry>
 458         <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 459         <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 460
 461         <listitem><para>Show messages from a specific boot. This will
 462         add a match for <literal>_BOOT_ID=</literal>.</para>
 463
 464         <para>The argument may be empty, in which case logs for the
 465         current boot will be shown.</para>
 466
 467         <para>If the boot ID is omitted, a positive
 468         <replaceable>offset</replaceable> will look up the boots
 469         starting from the beginning of the journal, and an
 470         equal-or-less-than zero <replaceable>offset</replaceable> will
 471         look up boots starting from the end of the journal. Thus,
 472         <constant>1</constant> means the first boot found in the
 473         journal in chronological order, <constant>2</constant> the
 474         second and so on; while <constant>-0</constant> is the last
 475         boot, <constant>-1</constant> the boot before last, and so
 476         on. An empty <replaceable>offset</replaceable> is equivalent
 477         to specifying <constant>-0</constant>, except when the current
 478         boot is not the last boot (e.g. because
 479         <option>--directory</option> was specified to look at logs
 480         from a different machine).</para>
 481
 482         <para>If the 32-character <replaceable>ID</replaceable> is
 483         specified, it may optionally be followed by
 484         <replaceable>offset</replaceable> which identifies the boot
 485         relative to the one given by boot
 486         <replaceable>ID</replaceable>. Negative values mean earlier
 487         boots and positive values mean later boots. If
 488         <replaceable>offset</replaceable> is not specified, a value of
 489         zero is assumed, and the logs for the boot given by
 490         <replaceable>ID</replaceable> are shown.</para>
 491         </listitem>
 492       </varlistentry>
 493
 494       <varlistentry>
 495         <term><option>--list-boots</option></term>
 496
 497         <listitem><para>Show a tabular list of boot numbers (relative to
 498         the current boot), their IDs, and the timestamps of the first
 499         and last message pertaining to the boot.</para></listitem>
 500       </varlistentry>
 501
 502       <varlistentry>
 503         <term><option>-k</option></term>
 504         <term><option>--dmesg</option></term>
 505
 506         <listitem><para>Show only kernel messages. This implies
 507         <option>-b</option> and adds the match
 508         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 509       </varlistentry>
 510
 511       <varlistentry>
 512         <term><option>-t</option></term>
 513         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 514
 515         <listitem><para>Show messages for the specified syslog
 516         identifier
 517         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 518
 519         <para>This parameter can be specified multiple
 520         times.</para></listitem>
 521       </varlistentry>
 522
 523       <varlistentry>
 524         <term><option>-u</option></term>
 525         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 526
 527         <listitem><para>Show messages for the specified systemd unit
 528         <replaceable>UNIT</replaceable> (such as a service unit), or
 529         for any of the units matched by
 530         <replaceable>PATTERN</replaceable>.  If a pattern is
 531         specified, a list of unit names found in the journal is
 532         compared with the specified pattern and all that match are
 533         used. For each unit name, a match is added for messages from
 534         the unit
 535         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 536         along with additional matches for messages from systemd and
 537         messages about coredumps for the specified unit.</para>
 538
 539         <para>This parameter can be specified multiple times.</para>
 540         </listitem>
 541       </varlistentry>
 542
 543       <varlistentry>
 544         <term><option>--user-unit=</option></term>
 545
 546         <listitem><para>Show messages for the specified user session
 547         unit. This will add a match for messages from the unit
 548         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 549         <literal>_UID=</literal>) and additional matches for messages
 550         from session systemd and messages about coredumps for the
 551         specified unit.</para>
 552
 553         <para>This parameter can be specified multiple times.</para>
 554         </listitem>
 555       </varlistentry>
 556
 557       <varlistentry>
 558         <term><option>-p</option></term>
 559         <term><option>--priority=</option></term>
 560
 561         <listitem><para>Filter output by message priorities or
 562         priority ranges. Takes either a single numeric or textual log
 563         level (i.e. between 0/<literal>emerg</literal> and
 564         7/<literal>debug</literal>), or a range of numeric/text log
 565         levels in the form FROM..TO. The log levels are the usual
 566         syslog log levels as documented in
 567         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 568         i.e. <literal>emerg</literal> (0),
 569         <literal>alert</literal> (1), <literal>crit</literal> (2),
 570         <literal>err</literal> (3), <literal>warning</literal> (4),
 571         <literal>notice</literal> (5), <literal>info</literal> (6),
 572         <literal>debug</literal> (7). If a single log level is
 573         specified, all messages with this log level or a lower (hence
 574         more important) log level are shown. If a range is specified,
 575         all messages within the range are shown, including both the
 576         start and the end value of the range. This will add
 577         <literal>PRIORITY=</literal> matches for the specified
 578         priorities.</para></listitem>
 579       </varlistentry>
 580
 581       <varlistentry>
 582         <term><option>-g</option></term>
 583         <term><option>--grep=</option></term>
 584
 585         <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname>
 586         field matches the specified regular expression. PERL-compatible regular expressions
 587         are used, see
 588         <citerefentry><refentrytitle>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 589         for a detailed description of the syntax.</para></listitem>
 590       </varlistentry>
 591
 592       <varlistentry>
 593         <term><option>-c</option></term>
 594         <term><option>--cursor=</option></term>
 595
 596         <listitem><para>Start showing entries from the location in the
 597         journal specified by the passed cursor.</para></listitem>
 598       </varlistentry>
 599
 600       <varlistentry>
 601         <term><option>--after-cursor=</option></term>
 602
 603         <listitem><para>Start showing entries from the location in the
 604         journal <emphasis>after</emphasis> the location specified by
 605         the passed cursor.  The cursor is shown when the
 606         <option>--show-cursor</option> option is used.</para>
 607         </listitem>
 608       </varlistentry>
 609
 610       <varlistentry>
 611         <term><option>--show-cursor</option></term>
 612
 613         <listitem><para>The cursor is shown after the last entry after
 614         two dashes:</para>
 615         <programlisting>-- cursor: s=0639…</programlisting>
 616         <para>The format of the cursor is private
 617         and subject to change.</para></listitem>
 618       </varlistentry>
 619
 620       <varlistentry>
 621         <term><option>-S</option></term>
 622         <term><option>--since=</option></term>
 623         <term><option>-U</option></term>
 624         <term><option>--until=</option></term>
 625
 626         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 627         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 628         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 629         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 630         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 631         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 632         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 633         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 634         time, respectively. For complete time and date specification, see
 635         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 636         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 637         </para>
 638         </listitem>
 639       </varlistentry>
 640
 641       <varlistentry>
 642         <term><option>-F</option></term>
 643         <term><option>--field=</option></term>
 644
 645         <listitem><para>Print all possible data values the specified
 646         field can take in all entries of the journal.</para></listitem>
 647       </varlistentry>
 648
 649       <varlistentry>
 650         <term><option>-N</option></term>
 651         <term><option>--fields</option></term>
 652
 653         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 654       </varlistentry>
 655
 656       <varlistentry>
 657         <term><option>--system</option></term>
 658         <term><option>--user</option></term>
 659
 660         <listitem><para>Show messages from system services and the
 661         kernel (with <option>--system</option>). Show messages from
 662         service of current user (with <option>--user</option>).  If
 663         neither is specified, show all messages that the user can see.
 664         </para></listitem>
 665       </varlistentry>
 666
 667       <varlistentry>
 668         <term><option>-M</option></term>
 669         <term><option>--machine=</option></term>
 670
 671         <listitem><para>Show messages from a running, local
 672         container. Specify a container name to connect to.</para>
 673         </listitem>
 674       </varlistentry>
 675
 676       <varlistentry>
 677         <term><option>-D <replaceable>DIR</replaceable></option></term>
 678         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 679
 680         <listitem><para>Takes a directory path as argument. If
 681         specified, journalctl will operate on the specified journal
 682         directory <replaceable>DIR</replaceable> instead of the
 683         default runtime and system journal paths.</para></listitem>
 684       </varlistentry>
 685
 686       <varlistentry>
 687         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 688
 689         <listitem><para>Takes a file glob as an argument. If
 690         specified, journalctl will operate on the specified journal
 691         files matching <replaceable>GLOB</replaceable> instead of the
 692         default runtime and system journal paths. May be specified
 693         multiple times, in which case files will be suitably
 694         interleaved.</para></listitem>
 695       </varlistentry>
 696
 697       <varlistentry>
 698         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 699
 700         <listitem><para>Takes a directory path as an argument. If
 701         specified, journalctl will operate on journal directories and catalog file hierarchy
 702         underneath the specified directory instead of the root
 703         directory (e.g. <option>--update-catalog</option> will create
 704         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 705         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 706         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 707         </para></listitem>
 708       </varlistentry>
 709
 710       <varlistentry>
 711         <term><option>--new-id128</option></term>
 712
 713         <listitem><para>Instead of showing journal contents, generate
 714         a new 128-bit ID suitable for identifying messages. This is
 715         intended for usage by developers who need a new identifier for
 716         a new message they introduce and want to make
 717         recognizable. This will print the new ID in four different
 718         formats which can be copied into source code or similar.
 719         </para></listitem>
 720       </varlistentry>
 721
 722       <varlistentry>
 723         <term><option>--header</option></term>
 724
 725         <listitem><para>Instead of showing journal contents, show
 726         internal header information of the journal fields
 727         accessed.</para></listitem>
 728       </varlistentry>
 729
 730       <varlistentry>
 731         <term><option>--disk-usage</option></term>
 732
 733         <listitem><para>Shows the current disk usage of all journal
 734         files. This shows the sum of the disk usage of all archived
 735         and active journal files.</para></listitem>
 736       </varlistentry>
 737
 738       <varlistentry>
 739         <term><option>--vacuum-size=</option></term>
 740         <term><option>--vacuum-time=</option></term>
 741         <term><option>--vacuum-files=</option></term>
 742
 743         <listitem><para>Removes archived journal files until the disk
 744         space they use falls below the specified size (specified with
 745         the usual <literal>K</literal>, <literal>M</literal>,
 746         <literal>G</literal> and <literal>T</literal> suffixes), or all
 747         archived journal files contain no data older than the specified
 748         timespan (specified with the usual <literal>s</literal>,
 749         <literal>m</literal>, <literal>h</literal>,
 750         <literal>days</literal>, <literal>months</literal>,
 751         <literal>weeks</literal> and <literal>years</literal> suffixes),
 752         or no more than the specified number of separate journal files
 753         remain. Note that running <option>--vacuum-size=</option> has
 754         only an indirect effect on the output shown by
 755         <option>--disk-usage</option>, as the latter includes active
 756         journal files, while the vacuuming operation only operates
 757         on archived journal files. Similarly,
 758         <option>--vacuum-files=</option> might not actually reduce the
 759         number of journal files to below the specified number, as it
 760         will not remove active journal
 761         files. <option>--vacuum-size=</option>,
 762         <option>--vacuum-time=</option> and
 763         <option>--vacuum-files=</option> may be combined in a single
 764         invocation to enforce any combination of a size, a time and a
 765         number of files limit on the archived journal
 766         files. Specifying any of these three parameters as zero is
 767         equivalent to not enforcing the specific limit, and is thus
 768         redundant.</para></listitem>
 769       </varlistentry>
 770
 771       <varlistentry>
 772         <term><option>--list-catalog
 773         <optional><replaceable>128-bit-ID…</replaceable></optional>
 774         </option></term>
 775
 776         <listitem><para>List the contents of the message catalog as a
 777         table of message IDs, plus their short description strings.
 778         </para>
 779
 780         <para>If any <replaceable>128-bit-ID</replaceable>s are
 781         specified, only those entries are shown.</para>
 782         </listitem>
 783       </varlistentry>
 784
 785       <varlistentry>
 786         <term><option>--dump-catalog
 787         <optional><replaceable>128-bit-ID…</replaceable></optional>
 788         </option></term>
 789
 790         <listitem><para>Show the contents of the message catalog, with
 791         entries separated by a line consisting of two dashes and the
 792         ID (the format is the same as <filename>.catalog</filename>
 793         files).</para>
 794
 795         <para>If any <replaceable>128-bit-ID</replaceable>s are
 796         specified, only those entries are shown.</para>
 797         </listitem>
 798       </varlistentry>
 799
 800       <varlistentry>
 801         <term><option>--update-catalog</option></term>
 802
 803         <listitem><para>Update the message catalog index. This command
 804         needs to be executed each time new catalog files are
 805         installed, removed, or updated to rebuild the binary catalog
 806         index.</para></listitem>
 807       </varlistentry>
 808
 809       <varlistentry>
 810         <term><option>--setup-keys</option></term>
 811
 812         <listitem><para>Instead of showing journal contents, generate
 813         a new key pair for Forward Secure Sealing (FSS). This will
 814         generate a sealing key and a verification key. The sealing key
 815         is stored in the journal data directory and shall remain on
 816         the host. The verification key should be stored
 817         externally. Refer to the <option>Seal=</option> option in
 818         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 819         for information on Forward Secure Sealing and for a link to a
 820         refereed scholarly paper detailing the cryptographic theory it
 821         is based on.</para></listitem>
 822       </varlistentry>
 823
 824       <varlistentry>
 825         <term><option>--force</option></term>
 826
 827         <listitem><para>When <option>--setup-keys</option> is passed
 828         and Forward Secure Sealing (FSS) has already been configured,
 829         recreate FSS keys.</para></listitem>
 830       </varlistentry>
 831
 832       <varlistentry>
 833         <term><option>--interval=</option></term>
 834
 835         <listitem><para>Specifies the change interval for the sealing
 836         key when generating an FSS key pair with
 837         <option>--setup-keys</option>. Shorter intervals increase CPU
 838         consumption but shorten the time range of undetectable journal
 839         alterations. Defaults to 15min.</para></listitem>
 840       </varlistentry>
 841
 842       <varlistentry>
 843         <term><option>--verify</option></term>
 844
 845         <listitem><para>Check the journal file for internal
 846         consistency. If the file has been generated with FSS enabled and
 847         the FSS verification key has been specified with
 848         <option>--verify-key=</option>, authenticity of the journal file
 849         is verified.</para></listitem>
 850       </varlistentry>
 851
 852       <varlistentry>
 853         <term><option>--verify-key=</option></term>
 854
 855         <listitem><para>Specifies the FSS verification key to use for
 856         the <option>--verify</option> operation.</para></listitem>
 857       </varlistentry>
 858
 859       <varlistentry>
 860         <term><option>--sync</option></term>
 861
 862         <listitem><para>Asks the journal daemon to write all yet
 863         unwritten journal data to the backing file system and
 864         synchronize all journals. This call does not return until the
 865         synchronization operation is complete. This command guarantees
 866         that any log messages written before its invocation are safely
 867         stored on disk at the time it returns.</para></listitem>
 868       </varlistentry>
 869
 870       <varlistentry>
 871         <term><option>--flush</option></term>
 872
 873         <listitem><para>Asks the journal daemon to flush any log data
 874         stored in <filename>/run/log/journal</filename> into
 875         <filename>/var/log/journal</filename>, if persistent storage
 876         is enabled. This call does not return until the operation is
 877         complete. Note that this call is idempotent: the data is only
 878         flushed from <filename>/run/log/journal</filename> into
 879         <filename>/var/log/journal</filename> once during system
 880         runtime, and this command exits cleanly without executing any
 881         operation if this has already happened. This command
 882         effectively guarantees that all data is flushed to
 883         <filename>/var/log/journal</filename> at the time it
 884         returns.</para></listitem>
 885       </varlistentry>
 886
 887       <varlistentry>
 888         <term><option>--rotate</option></term>
 889
 890         <listitem><para>Asks the journal daemon to rotate journal
 891         files. This call does not return until the rotation operation
 892         is complete.</para></listitem>
 893       </varlistentry>
 894
 895       <xi:include href="standard-options.xml" xpointer="help" />
 896       <xi:include href="standard-options.xml" xpointer="version" />
 897       <xi:include href="standard-options.xml" xpointer="no-pager" />
 898     </variablelist>
 899   </refsect1>
 900
 901   <refsect1>
 902     <title>Exit status</title>
 903
 904     <para>On success, 0 is returned; otherwise, a non-zero failure
 905     code is returned.</para>
 906   </refsect1>
 907
 908   <xi:include href="less-variables.xml" />
 909
 910   <refsect1>
 911     <title>Examples</title>
 912
 913     <para>Without arguments, all collected logs are shown
 914     unfiltered:</para>
 915
 916     <programlisting>journalctl</programlisting>
 917
 918     <para>With one match specified, all entries with a field matching
 919     the expression are shown:</para>
 920
 921     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
 922
 923     <para>If two different fields are matched, only entries matching
 924     both expressions at the same time are shown:</para>
 925
 926     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 927
 928     <para>If two matches refer to the same field, all entries matching
 929     either expression are shown:</para>
 930
 931     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 932
 933     <para>If the separator <literal>+</literal> is used, two
 934     expressions may be combined in a logical OR. The following will
 935     show all messages from the Avahi service process with the PID
 936     28097 plus all messages from the D-Bus service (from any of its
 937     processes):</para>
 938
 939     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 940
 941     <para>Show all logs generated by the D-Bus executable:</para>
 942
 943     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 944
 945     <para>Show all kernel logs from previous boot:</para>
 946
 947     <programlisting>journalctl -k -b -1</programlisting>
 948
 949     <para>Show a live log display from a system service
 950     <filename>apache.service</filename>:</para>
 951
 952     <programlisting>journalctl -f -u apache</programlisting>
 953
 954   </refsect1>
 955
 956   <refsect1>
 957     <title>See Also</title>
 958     <para>
 959       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 960       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 961       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 962       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 963       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 964       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 965       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 966       <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 967       <citerefentry><refentrytitle>systemd-journal-upload</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 968     </para>
 969   </refsect1>
 970 </refentry>