man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   This file is part of systemd.
   9
  10   Copyright 2012 Lennart Poettering
  11 -->
  12
  13   <refentry id="journalctl"
  14             xmlns:xi="http://www.w3.org/2001/XInclude">
  15
  16     <refentryinfo>
  17       <title>journalctl</title>
  18       <productname>systemd</productname>
  19
  20       <authorgroup>
  21         <author>
  22           <contrib>Developer</contrib>
  23           <firstname>Lennart</firstname>
  24           <surname>Poettering</surname>
  25           <email>lennart@poettering.net</email>
  26         </author>
  27       </authorgroup>
  28     </refentryinfo>
  29
  30     <refmeta>
  31       <refentrytitle>journalctl</refentrytitle>
  32       <manvolnum>1</manvolnum>
  33     </refmeta>
  34
  35     <refnamediv>
  36       <refname>journalctl</refname>
  37       <refpurpose>Query the systemd journal</refpurpose>
  38     </refnamediv>
  39
  40     <refsynopsisdiv>
  41       <cmdsynopsis>
  42         <command>journalctl</command>
  43         <arg choice="opt" rep="repeat">OPTIONS</arg>
  44         <arg choice="opt" rep="repeat">MATCHES</arg>
  45       </cmdsynopsis>
  46     </refsynopsisdiv>
  47
  48     <refsect1>
  49       <title>Description</title>
  50
  51       <para><command>journalctl</command> may be used to query the
  52       contents of the
  53       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  54       journal as written by
  55       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  56
  57       <para>If called without parameters, it will show the full
  58       contents of the journal, starting with the oldest entry
  59       collected.</para>
  60
  61       <para>If one or more match arguments are passed, the output is
  62       filtered accordingly. A match is in the format
  63       <literal>FIELD=VALUE</literal>,
  64       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  65       to the components of a structured journal entry. See
  66       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  67       for a list of well-known fields. If multiple matches are
  68       specified matching different fields, the log entries are
  69       filtered by both, i.e. the resulting output will show only
  70       entries matching all the specified matches of this kind. If two
  71       matches apply to the same field, then they are automatically
  72       matched as alternatives, i.e. the resulting output will show
  73       entries matching any of the specified matches for the same
  74       field. Finally, the character <literal>+</literal> may appear
  75       as a separate word between other terms on the command line. This
  76       causes all matches before and after to be combined in a
  77       disjunction (i.e. logical OR).</para>
  78
  79       <para>It is also possible to filter the entries by specifying an
  80       absolute file path as an argument. The file path may be a file or
  81       a symbolic link and the file must exist at the time of the query. If a
  82       file path refers to an executable binary, an <literal>_EXE=</literal>
  83       match for the canonicalized binary path is added to the query. If a
  84       file path refers to an executable script, a <literal>_COMM=</literal>
  85       match for the script name is added to the query. If a file path
  86       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
  87       the kernel name of the device and for each of its ancestor devices is
  88       added to the query. Symbolic links are dereferenced, kernel names are
  89       synthesized, and parent devices are identified from the environment at
  90       the time of the query. In general, a device node is the best proxy for
  91       an actual device, as log entries do not usually contain fields that
  92       identify an actual device. For the resulting log entries to be correct
  93       for the actual device, the relevant parts of the environment at the time
  94       the entry was logged, in particular the actual device corresponding to
  95       the device node, must have been the same as those at the time of the
  96       query. Because device nodes generally change their corresponding devices
  97       across reboots, specifying a device node path causes the resulting
  98       entries to be restricted to those from the current boot.</para>
  99
 100       <para>Additional constraints may be added using options
 101       <option>--boot</option>, <option>--unit=</option>, etc., to
 102       further limit what entries will be shown (logical AND).</para>
 103
 104       <para>Output is interleaved from all accessible journal files,
 105       whether they are rotated or currently being written, and
 106       regardless of whether they belong to the system itself or are
 107       accessible user journals.</para>
 108
 109       <para>The set of journal files which will be used can be
 110       modified using the <option>--user</option>,
 111       <option>--system</option>, <option>--directory</option>, and
 112       <option>--file</option> options, see below.</para>
 113
 114       <para>All users are granted access to their private per-user
 115       journals. However, by default, only root and users who are
 116       members of a few special groups are granted access to the system
 117       journal and the journals of other users. Members of the groups
 118       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 119       <literal>wheel</literal> can read all journal files. Note
 120       that the two latter groups traditionally have additional
 121       privileges specified by the distribution. Members of the
 122       <literal>wheel</literal> group can often perform administrative
 123       tasks.</para>
 124
 125       <para>The output is paged through <command>less</command> by
 126       default, and long lines are "truncated" to screen width. The
 127       hidden part can be viewed by using the left-arrow and
 128       right-arrow keys. Paging can be disabled; see the
 129       <option>--no-pager</option> option and the "Environment" section
 130       below.</para>
 131
 132       <para>When outputting to a tty, lines are colored according to
 133       priority: lines of level ERROR and higher are colored red; lines
 134       of level NOTICE and higher are highlighted; other lines are
 135       displayed normally.</para>
 136     </refsect1>
 137
 138     <refsect1>
 139       <title>Options</title>
 140
 141       <para>The following options are understood:</para>
 142
 143       <variablelist>
 144         <varlistentry>
 145           <term><option>--no-full</option></term>
 146           <term><option>--full</option></term>
 147           <term><option>-l</option></term>
 148
 149           <listitem><para>Ellipsize fields when they do not fit in
 150           available columns.  The default is to show full fields,
 151           allowing them to wrap or be truncated by the pager, if one
 152           is used.</para>
 153
 154           <para>The old options
 155           <option>-l</option>/<option>--full</option> are not useful
 156           anymore, except to undo <option>--no-full</option>.</para>
 157           </listitem>
 158         </varlistentry>
 159
 160         <varlistentry>
 161           <term><option>-a</option></term>
 162           <term><option>--all</option></term>
 163
 164           <listitem><para>Show all fields in full, even if they
 165           include unprintable characters or are very
 166           long.</para></listitem>
 167         </varlistentry>
 168
 169         <varlistentry>
 170           <term><option>-f</option></term>
 171           <term><option>--follow</option></term>
 172
 173           <listitem><para>Show only the most recent journal entries,
 174           and continuously print new entries as they are appended to
 175           the journal.</para></listitem>
 176         </varlistentry>
 177
 178         <varlistentry>
 179           <term><option>-e</option></term>
 180           <term><option>--pager-end</option></term>
 181
 182           <listitem><para>Immediately jump to the end of the journal
 183           inside the implied pager tool. This implies
 184           <option>-n1000</option> to guarantee that the pager will not
 185           buffer logs of unbounded size. This may be overridden with
 186           an explicit <option>-n</option> with some other numeric
 187           value, while <option>-nall</option> will disable this cap.
 188           Note that this option is only supported for the
 189           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 190           pager.</para></listitem>
 191         </varlistentry>
 192
 193         <varlistentry>
 194           <term><option>-n</option></term>
 195           <term><option>--lines=</option></term>
 196
 197           <listitem><para>Show the most recent journal events and
 198           limit the number of events shown. If
 199           <option>--follow</option> is used, this option is
 200           implied. The argument is a positive integer or
 201           <literal>all</literal> to disable line limiting. The default
 202           value is 10 if no argument is given.</para></listitem>
 203         </varlistentry>
 204
 205         <varlistentry>
 206           <term><option>--no-tail</option></term>
 207
 208           <listitem><para>Show all stored output lines, even in follow
 209           mode. Undoes the effect of <option>--lines=</option>.
 210           </para></listitem>
 211         </varlistentry>
 212
 213         <varlistentry>
 214           <term><option>-r</option></term>
 215           <term><option>--reverse</option></term>
 216
 217           <listitem><para>Reverse output so that the newest entries
 218           are displayed first.</para></listitem>
 219         </varlistentry>
 220
 221         <varlistentry>
 222           <term><option>-o</option></term>
 223           <term><option>--output=</option></term>
 224
 225           <listitem><para>Controls the formatting of the journal
 226           entries that are shown. Takes one of the following
 227           options:</para>
 228           <variablelist>
 229             <varlistentry>
 230               <term>
 231                 <option>short</option>
 232               </term>
 233               <listitem>
 234                 <para>is the default and generates an output that is
 235                 mostly identical to the formatting of classic syslog
 236                 files, showing one line per journal entry.</para>
 237               </listitem>
 238             </varlistentry>
 239
 240             <varlistentry>
 241               <term>
 242                 <option>short-full</option>
 243               </term>
 244               <listitem>
 245                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 246                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 247                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 248                 output, and is locale-independent.</para>
 249               </listitem>
 250             </varlistentry>
 251
 252             <varlistentry>
 253               <term>
 254                 <option>short-iso</option>
 255               </term>
 256               <listitem>
 257                 <para>is very similar, but shows ISO 8601 wallclock
 258                 timestamps.</para>
 259               </listitem>
 260             </varlistentry>
 261
 262             <varlistentry>
 263               <term>
 264                 <option>short-iso-precise</option>
 265               </term>
 266               <listitem>
 267                 <para>as for <option>short-iso</option> but includes full
 268                 microsecond precision.</para>
 269               </listitem>
 270             </varlistentry>
 271
 272             <varlistentry>
 273               <term>
 274                 <option>short-precise</option>
 275               </term>
 276               <listitem>
 277                 <para>is very similar, but shows classic syslog timestamps
 278                 with full microsecond precision.</para>
 279               </listitem>
 280             </varlistentry>
 281
 282             <varlistentry>
 283               <term>
 284                 <option>short-monotonic</option>
 285               </term>
 286               <listitem>
 287                 <para>is very similar, but shows monotonic timestamps
 288                 instead of wallclock timestamps.</para>
 289               </listitem>
 290             </varlistentry>
 291
 292             <varlistentry>
 293               <term>
 294                 <option>short-unix</option>
 295               </term>
 296               <listitem>
 297                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 298                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 299               </listitem>
 300             </varlistentry>
 301
 302             <varlistentry>
 303               <term>
 304                 <option>verbose</option>
 305               </term>
 306               <listitem>
 307                 <para>shows the full-structured entry items with all
 308                 fields.</para>
 309               </listitem>
 310             </varlistentry>
 311
 312             <varlistentry>
 313               <term>
 314                 <option>export</option>
 315               </term>
 316               <listitem>
 317                 <para>serializes the journal into a binary (but mostly
 318                 text-based) stream suitable for backups and network
 319                 transfer (see
 320                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 321                 for more information). To import the binary stream back
 322                 into native journald format use
 323                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 324               </listitem>
 325             </varlistentry>
 326
 327             <varlistentry>
 328               <term>
 329                 <option>json</option>
 330               </term>
 331               <listitem>
 332                 <para>formats entries as JSON data structures, one per
 333                 line (see
 334                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink>
 335                 for more information).</para>
 336               </listitem>
 337             </varlistentry>
 338
 339             <varlistentry>
 340               <term>
 341                 <option>json-pretty</option>
 342               </term>
 343               <listitem>
 344                 <para>formats entries as JSON data structures, but
 345                 formats them in multiple lines in order to make them
 346                 more readable by humans.</para>
 347               </listitem>
 348             </varlistentry>
 349
 350             <varlistentry>
 351               <term>
 352                 <option>json-sse</option>
 353               </term>
 354               <listitem>
 355                 <para>formats entries as JSON data structures, but wraps
 356                 them in a format suitable for
 357                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 358                 </para>
 359               </listitem>
 360             </varlistentry>
 361
 362             <varlistentry>
 363               <term>
 364                 <option>cat</option>
 365               </term>
 366               <listitem>
 367                 <para>generates a very terse output, only showing the
 368                 actual message of each journal entry with no metadata,
 369                 not even a timestamp.</para>
 370               </listitem>
 371             </varlistentry>
 372           </variablelist>
 373         </listitem>
 374       </varlistentry>
 375
 376       <varlistentry>
 377         <term><option>--output-fields=</option></term>
 378
 379         <listitem><para>A comma separated list of the fields which should
 380         be included in the output. This only has an effect for the output modes
 381         which would normally show all fields (<option>verbose</option>,
 382         <option>export</option>, <option>json</option>,
 383         <option>json-pretty</option>, and <option>json-sse</option>). The
 384         <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 385         <literal>__MONOTONIC_TIMESTAMP</literal>, and
 386         <literal>_BOOT_ID</literal> fields are always
 387         printed.</para></listitem>
 388       </varlistentry>
 389
 390       <varlistentry>
 391         <term><option>--utc</option></term>
 392
 393         <listitem><para>Express time in Coordinated Universal Time
 394         (UTC).</para></listitem>
 395       </varlistentry>
 396
 397       <varlistentry>
 398         <term><option>--no-hostname</option></term>
 399
 400         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 401         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 402       </varlistentry>
 403
 404       <varlistentry>
 405         <term><option>-x</option></term>
 406         <term><option>--catalog</option></term>
 407
 408         <listitem><para>Augment log lines with explanation texts from
 409         the message catalog. This will add explanatory help texts to
 410         log messages in the output where this is available. These
 411         short help texts will explain the context of an error or log
 412         event, possible solutions, as well as pointers to support
 413         forums, developer documentation, and any other relevant
 414         manuals. Note that help texts are not available for all
 415         messages, but only for selected ones. For more information on
 416         the message catalog, please refer to the
 417         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 418
 419         <para>Note: when attaching <command>journalctl</command>
 420         output to bug reports, please do <emphasis>not</emphasis> use
 421         <option>-x</option>.</para>
 422         </listitem>
 423       </varlistentry>
 424
 425       <varlistentry>
 426         <term><option>-q</option></term>
 427         <term><option>--quiet</option></term>
 428
 429         <listitem><para>Suppresses all informational messages
 430         (i.e. "-- Logs begin at …", "-- Reboot --"),
 431         any warning messages regarding
 432         inaccessible system journals when run as a normal
 433         user.</para></listitem>
 434       </varlistentry>
 435
 436       <varlistentry>
 437         <term><option>-m</option></term>
 438         <term><option>--merge</option></term>
 439
 440         <listitem><para>Show entries interleaved from all available
 441         journals, including remote ones.</para></listitem>
 442       </varlistentry>
 443
 444       <varlistentry>
 445         <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 446         <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 447
 448         <listitem><para>Show messages from a specific boot. This will
 449         add a match for <literal>_BOOT_ID=</literal>.</para>
 450
 451         <para>The argument may be empty, in which case logs for the
 452         current boot will be shown.</para>
 453
 454         <para>If the boot ID is omitted, a positive
 455         <replaceable>offset</replaceable> will look up the boots
 456         starting from the beginning of the journal, and an
 457         equal-or-less-than zero <replaceable>offset</replaceable> will
 458         look up boots starting from the end of the journal. Thus,
 459         <constant>1</constant> means the first boot found in the
 460         journal in chronological order, <constant>2</constant> the
 461         second and so on; while <constant>-0</constant> is the last
 462         boot, <constant>-1</constant> the boot before last, and so
 463         on. An empty <replaceable>offset</replaceable> is equivalent
 464         to specifying <constant>-0</constant>, except when the current
 465         boot is not the last boot (e.g. because
 466         <option>--directory</option> was specified to look at logs
 467         from a different machine).</para>
 468
 469         <para>If the 32-character <replaceable>ID</replaceable> is
 470         specified, it may optionally be followed by
 471         <replaceable>offset</replaceable> which identifies the boot
 472         relative to the one given by boot
 473         <replaceable>ID</replaceable>. Negative values mean earlier
 474         boots and positive values mean later boots. If
 475         <replaceable>offset</replaceable> is not specified, a value of
 476         zero is assumed, and the logs for the boot given by
 477         <replaceable>ID</replaceable> are shown.</para>
 478         </listitem>
 479       </varlistentry>
 480
 481       <varlistentry>
 482         <term><option>--list-boots</option></term>
 483
 484         <listitem><para>Show a tabular list of boot numbers (relative to
 485         the current boot), their IDs, and the timestamps of the first
 486         and last message pertaining to the boot.</para></listitem>
 487       </varlistentry>
 488
 489       <varlistentry>
 490         <term><option>-k</option></term>
 491         <term><option>--dmesg</option></term>
 492
 493         <listitem><para>Show only kernel messages. This implies
 494         <option>-b</option> and adds the match
 495         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 496       </varlistentry>
 497
 498       <varlistentry>
 499         <term><option>-t</option></term>
 500         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 501
 502         <listitem><para>Show messages for the specified syslog
 503         identifier
 504         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 505
 506         <para>This parameter can be specified multiple
 507         times.</para></listitem>
 508       </varlistentry>
 509
 510       <varlistentry>
 511         <term><option>-u</option></term>
 512         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 513
 514         <listitem><para>Show messages for the specified systemd unit
 515         <replaceable>UNIT</replaceable> (such as a service unit), or
 516         for any of the units matched by
 517         <replaceable>PATTERN</replaceable>.  If a pattern is
 518         specified, a list of unit names found in the journal is
 519         compared with the specified pattern and all that match are
 520         used. For each unit name, a match is added for messages from
 521         the unit
 522         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 523         along with additional matches for messages from systemd and
 524         messages about coredumps for the specified unit.</para>
 525
 526         <para>This parameter can be specified multiple times.</para>
 527         </listitem>
 528       </varlistentry>
 529
 530       <varlistentry>
 531         <term><option>--user-unit=</option></term>
 532
 533         <listitem><para>Show messages for the specified user session
 534         unit. This will add a match for messages from the unit
 535         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 536         <literal>_UID=</literal>) and additional matches for messages
 537         from session systemd and messages about coredumps for the
 538         specified unit.</para>
 539
 540         <para>This parameter can be specified multiple times.</para>
 541         </listitem>
 542       </varlistentry>
 543
 544       <varlistentry>
 545         <term><option>-p</option></term>
 546         <term><option>--priority=</option></term>
 547
 548         <listitem><para>Filter output by message priorities or
 549         priority ranges. Takes either a single numeric or textual log
 550         level (i.e. between 0/<literal>emerg</literal> and
 551         7/<literal>debug</literal>), or a range of numeric/text log
 552         levels in the form FROM..TO. The log levels are the usual
 553         syslog log levels as documented in
 554         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 555         i.e. <literal>emerg</literal> (0),
 556         <literal>alert</literal> (1), <literal>crit</literal> (2),
 557         <literal>err</literal> (3), <literal>warning</literal> (4),
 558         <literal>notice</literal> (5), <literal>info</literal> (6),
 559         <literal>debug</literal> (7). If a single log level is
 560         specified, all messages with this log level or a lower (hence
 561         more important) log level are shown. If a range is specified,
 562         all messages within the range are shown, including both the
 563         start and the end value of the range. This will add
 564         <literal>PRIORITY=</literal> matches for the specified
 565         priorities.</para></listitem>
 566       </varlistentry>
 567
 568       <varlistentry>
 569         <term><option>-g</option></term>
 570         <term><option>--grep=</option></term>
 571
 572         <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname>
 573         field matches the specified regular expression. PERL-compatible regular expressions
 574         are used, see
 575         <citerefentry><refentrytitle>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 576         for a detailed description of the syntax.</para>
 577
 578         <para>If the pattern is all lowercase, matching is case insensitive.
 579         Otherwise, matching is case sensitive. This can be overridden with the
 580         <option>--case-sensitive</option> option, see below.</para>
 581         </listitem>
 582       </varlistentry>
 583
 584       <varlistentry>
 585         <term><option>--case-sensitive<optional>=BOOLEAN</optional></option></term>
 586
 587         <listitem><para>Make pattern matching case sensitive or case insenstive.</para>
 588         </listitem>
 589       </varlistentry>
 590
 591       <varlistentry>
 592         <term><option>-c</option></term>
 593         <term><option>--cursor=</option></term>
 594
 595         <listitem><para>Start showing entries from the location in the
 596         journal specified by the passed cursor.</para></listitem>
 597       </varlistentry>
 598
 599       <varlistentry>
 600         <term><option>--after-cursor=</option></term>
 601
 602         <listitem><para>Start showing entries from the location in the
 603         journal <emphasis>after</emphasis> the location specified by
 604         the passed cursor.  The cursor is shown when the
 605         <option>--show-cursor</option> option is used.</para>
 606         </listitem>
 607       </varlistentry>
 608
 609       <varlistentry>
 610         <term><option>--show-cursor</option></term>
 611
 612         <listitem><para>The cursor is shown after the last entry after
 613         two dashes:</para>
 614         <programlisting>-- cursor: s=0639…</programlisting>
 615         <para>The format of the cursor is private
 616         and subject to change.</para></listitem>
 617       </varlistentry>
 618
 619       <varlistentry>
 620         <term><option>-S</option></term>
 621         <term><option>--since=</option></term>
 622         <term><option>-U</option></term>
 623         <term><option>--until=</option></term>
 624
 625         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 626         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 627         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 628         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 629         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 630         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 631         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 632         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 633         time, respectively. For complete time and date specification, see
 634         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 635         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 636         </para>
 637         </listitem>
 638       </varlistentry>
 639
 640       <varlistentry>
 641         <term><option>-F</option></term>
 642         <term><option>--field=</option></term>
 643
 644         <listitem><para>Print all possible data values the specified
 645         field can take in all entries of the journal.</para></listitem>
 646       </varlistentry>
 647
 648       <varlistentry>
 649         <term><option>-N</option></term>
 650         <term><option>--fields</option></term>
 651
 652         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 653       </varlistentry>
 654
 655       <varlistentry>
 656         <term><option>--system</option></term>
 657         <term><option>--user</option></term>
 658
 659         <listitem><para>Show messages from system services and the
 660         kernel (with <option>--system</option>). Show messages from
 661         service of current user (with <option>--user</option>).  If
 662         neither is specified, show all messages that the user can see.
 663         </para></listitem>
 664       </varlistentry>
 665
 666       <varlistentry>
 667         <term><option>-M</option></term>
 668         <term><option>--machine=</option></term>
 669
 670         <listitem><para>Show messages from a running, local
 671         container. Specify a container name to connect to.</para>
 672         </listitem>
 673       </varlistentry>
 674
 675       <varlistentry>
 676         <term><option>-D <replaceable>DIR</replaceable></option></term>
 677         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 678
 679         <listitem><para>Takes a directory path as argument. If
 680         specified, journalctl will operate on the specified journal
 681         directory <replaceable>DIR</replaceable> instead of the
 682         default runtime and system journal paths.</para></listitem>
 683       </varlistentry>
 684
 685       <varlistentry>
 686         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 687
 688         <listitem><para>Takes a file glob as an argument. If
 689         specified, journalctl will operate on the specified journal
 690         files matching <replaceable>GLOB</replaceable> instead of the
 691         default runtime and system journal paths. May be specified
 692         multiple times, in which case files will be suitably
 693         interleaved.</para></listitem>
 694       </varlistentry>
 695
 696       <varlistentry>
 697         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 698
 699         <listitem><para>Takes a directory path as an argument. If
 700         specified, journalctl will operate on journal directories and catalog file hierarchy
 701         underneath the specified directory instead of the root
 702         directory (e.g. <option>--update-catalog</option> will create
 703         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 704         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 705         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 706         </para></listitem>
 707       </varlistentry>
 708
 709       <varlistentry>
 710         <term><option>--new-id128</option></term>
 711
 712         <listitem><para>Instead of showing journal contents, generate
 713         a new 128-bit ID suitable for identifying messages. This is
 714         intended for usage by developers who need a new identifier for
 715         a new message they introduce and want to make
 716         recognizable. This will print the new ID in four different
 717         formats which can be copied into source code or similar.
 718         </para></listitem>
 719       </varlistentry>
 720
 721       <varlistentry>
 722         <term><option>--header</option></term>
 723
 724         <listitem><para>Instead of showing journal contents, show
 725         internal header information of the journal fields
 726         accessed.</para></listitem>
 727       </varlistentry>
 728
 729       <varlistentry>
 730         <term><option>--disk-usage</option></term>
 731
 732         <listitem><para>Shows the current disk usage of all journal
 733         files. This shows the sum of the disk usage of all archived
 734         and active journal files.</para></listitem>
 735       </varlistentry>
 736
 737       <varlistentry>
 738         <term><option>--vacuum-size=</option></term>
 739         <term><option>--vacuum-time=</option></term>
 740         <term><option>--vacuum-files=</option></term>
 741
 742         <listitem><para>Removes the oldest archived journal files until the disk
 743         space they use falls below the specified size (specified with
 744         the usual <literal>K</literal>, <literal>M</literal>,
 745         <literal>G</literal> and <literal>T</literal> suffixes), or all
 746         archived journal files contain no data older than the specified
 747         timespan (specified with the usual <literal>s</literal>,
 748         <literal>m</literal>, <literal>h</literal>,
 749         <literal>days</literal>, <literal>months</literal>,
 750         <literal>weeks</literal> and <literal>years</literal> suffixes),
 751         or no more than the specified number of separate journal files
 752         remain. Note that running <option>--vacuum-size=</option> has
 753         only an indirect effect on the output shown by
 754         <option>--disk-usage</option>, as the latter includes active
 755         journal files, while the vacuuming operation only operates
 756         on archived journal files. Similarly,
 757         <option>--vacuum-files=</option> might not actually reduce the
 758         number of journal files to below the specified number, as it
 759         will not remove active journal
 760         files. <option>--vacuum-size=</option>,
 761         <option>--vacuum-time=</option> and
 762         <option>--vacuum-files=</option> may be combined in a single
 763         invocation to enforce any combination of a size, a time and a
 764         number of files limit on the archived journal
 765         files. Specifying any of these three parameters as zero is
 766         equivalent to not enforcing the specific limit, and is thus
 767         redundant.</para></listitem>
 768       </varlistentry>
 769
 770       <varlistentry>
 771         <term><option>--list-catalog
 772         <optional><replaceable>128-bit-ID…</replaceable></optional>
 773         </option></term>
 774
 775         <listitem><para>List the contents of the message catalog as a
 776         table of message IDs, plus their short description strings.
 777         </para>
 778
 779         <para>If any <replaceable>128-bit-ID</replaceable>s are
 780         specified, only those entries are shown.</para>
 781         </listitem>
 782       </varlistentry>
 783
 784       <varlistentry>
 785         <term><option>--dump-catalog
 786         <optional><replaceable>128-bit-ID…</replaceable></optional>
 787         </option></term>
 788
 789         <listitem><para>Show the contents of the message catalog, with
 790         entries separated by a line consisting of two dashes and the
 791         ID (the format is the same as <filename>.catalog</filename>
 792         files).</para>
 793
 794         <para>If any <replaceable>128-bit-ID</replaceable>s are
 795         specified, only those entries are shown.</para>
 796         </listitem>
 797       </varlistentry>
 798
 799       <varlistentry>
 800         <term><option>--update-catalog</option></term>
 801
 802         <listitem><para>Update the message catalog index. This command
 803         needs to be executed each time new catalog files are
 804         installed, removed, or updated to rebuild the binary catalog
 805         index.</para></listitem>
 806       </varlistentry>
 807
 808       <varlistentry>
 809         <term><option>--setup-keys</option></term>
 810
 811         <listitem><para>Instead of showing journal contents, generate
 812         a new key pair for Forward Secure Sealing (FSS). This will
 813         generate a sealing key and a verification key. The sealing key
 814         is stored in the journal data directory and shall remain on
 815         the host. The verification key should be stored
 816         externally. Refer to the <option>Seal=</option> option in
 817         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 818         for information on Forward Secure Sealing and for a link to a
 819         refereed scholarly paper detailing the cryptographic theory it
 820         is based on.</para></listitem>
 821       </varlistentry>
 822
 823       <varlistentry>
 824         <term><option>--force</option></term>
 825
 826         <listitem><para>When <option>--setup-keys</option> is passed
 827         and Forward Secure Sealing (FSS) has already been configured,
 828         recreate FSS keys.</para></listitem>
 829       </varlistentry>
 830
 831       <varlistentry>
 832         <term><option>--interval=</option></term>
 833
 834         <listitem><para>Specifies the change interval for the sealing
 835         key when generating an FSS key pair with
 836         <option>--setup-keys</option>. Shorter intervals increase CPU
 837         consumption but shorten the time range of undetectable journal
 838         alterations. Defaults to 15min.</para></listitem>
 839       </varlistentry>
 840
 841       <varlistentry>
 842         <term><option>--verify</option></term>
 843
 844         <listitem><para>Check the journal file for internal
 845         consistency. If the file has been generated with FSS enabled and
 846         the FSS verification key has been specified with
 847         <option>--verify-key=</option>, authenticity of the journal file
 848         is verified.</para></listitem>
 849       </varlistentry>
 850
 851       <varlistentry>
 852         <term><option>--verify-key=</option></term>
 853
 854         <listitem><para>Specifies the FSS verification key to use for
 855         the <option>--verify</option> operation.</para></listitem>
 856       </varlistentry>
 857
 858       <varlistentry>
 859         <term><option>--sync</option></term>
 860
 861         <listitem><para>Asks the journal daemon to write all yet
 862         unwritten journal data to the backing file system and
 863         synchronize all journals. This call does not return until the
 864         synchronization operation is complete. This command guarantees
 865         that any log messages written before its invocation are safely
 866         stored on disk at the time it returns.</para></listitem>
 867       </varlistentry>
 868
 869       <varlistentry>
 870         <term><option>--flush</option></term>
 871
 872         <listitem><para>Asks the journal daemon to flush any log data
 873         stored in <filename>/run/log/journal</filename> into
 874         <filename>/var/log/journal</filename>, if persistent storage
 875         is enabled. This call does not return until the operation is
 876         complete. Note that this call is idempotent: the data is only
 877         flushed from <filename>/run/log/journal</filename> into
 878         <filename>/var/log/journal</filename> once during system
 879         runtime, and this command exits cleanly without executing any
 880         operation if this has already happened. This command
 881         effectively guarantees that all data is flushed to
 882         <filename>/var/log/journal</filename> at the time it
 883         returns.</para></listitem>
 884       </varlistentry>
 885
 886       <varlistentry>
 887         <term><option>--rotate</option></term>
 888
 889         <listitem><para>Asks the journal daemon to rotate journal
 890         files. This call does not return until the rotation operation
 891         is complete.</para></listitem>
 892       </varlistentry>
 893
 894       <xi:include href="standard-options.xml" xpointer="help" />
 895       <xi:include href="standard-options.xml" xpointer="version" />
 896       <xi:include href="standard-options.xml" xpointer="no-pager" />
 897     </variablelist>
 898   </refsect1>
 899
 900   <refsect1>
 901     <title>Exit status</title>
 902
 903     <para>On success, 0 is returned; otherwise, a non-zero failure
 904     code is returned.</para>
 905   </refsect1>
 906
 907   <xi:include href="less-variables.xml" />
 908
 909   <refsect1>
 910     <title>Examples</title>
 911
 912     <para>Without arguments, all collected logs are shown
 913     unfiltered:</para>
 914
 915     <programlisting>journalctl</programlisting>
 916
 917     <para>With one match specified, all entries with a field matching
 918     the expression are shown:</para>
 919
 920     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service
 921 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting>
 922
 923     <para>If two different fields are matched, only entries matching
 924     both expressions at the same time are shown:</para>
 925
 926     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 927
 928     <para>If two matches refer to the same field, all entries matching
 929     either expression are shown:</para>
 930
 931     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 932
 933     <para>If the separator <literal>+</literal> is used, two
 934     expressions may be combined in a logical OR. The following will
 935     show all messages from the Avahi service process with the PID
 936     28097 plus all messages from the D-Bus service (from any of its
 937     processes):</para>
 938
 939     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 940
 941     <para>To show all fields emited <emphasis>by</emphasis> a unit and <emphasis>about</emphasis>
 942     the unit, option <option>-u</option>/<option>--unit=</option> should be used.
 943     <command>journalctl -u <replaceable>name</replaceable></command>
 944     expands to a complex filter similar to
 945     <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service
 946   + UNIT=<replaceable>name</replaceable>.service _PID=1
 947   + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0
 948   + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
 949     </programlisting>
 950     (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 951     for an explanation of those patterns).
 952     </para>
 953
 954     <para>Show all logs generated by the D-Bus executable:</para>
 955
 956     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 957
 958     <para>Show all kernel logs from previous boot:</para>
 959
 960     <programlisting>journalctl -k -b -1</programlisting>
 961
 962     <para>Show a live log display from a system service
 963     <filename>apache.service</filename>:</para>
 964
 965     <programlisting>journalctl -f -u apache</programlisting>
 966
 967   </refsect1>
 968
 969   <refsect1>
 970     <title>See Also</title>
 971     <para>
 972       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 973       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 974       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 975       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 976       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 977       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 978       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 979       <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 980       <citerefentry><refentrytitle>systemd-journal-upload</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 981     </para>
 982   </refsect1>
 983 </refentry>