man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2012 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24   <refentry id="journalctl"
  25             xmlns:xi="http://www.w3.org/2001/XInclude">
  26
  27     <refentryinfo>
  28       <title>journalctl</title>
  29       <productname>systemd</productname>
  30
  31       <authorgroup>
  32         <author>
  33           <contrib>Developer</contrib>
  34           <firstname>Lennart</firstname>
  35           <surname>Poettering</surname>
  36           <email>lennart@poettering.net</email>
  37         </author>
  38       </authorgroup>
  39     </refentryinfo>
  40
  41     <refmeta>
  42       <refentrytitle>journalctl</refentrytitle>
  43       <manvolnum>1</manvolnum>
  44     </refmeta>
  45
  46     <refnamediv>
  47       <refname>journalctl</refname>
  48       <refpurpose>Query the systemd journal</refpurpose>
  49     </refnamediv>
  50
  51     <refsynopsisdiv>
  52       <cmdsynopsis>
  53         <command>journalctl</command>
  54         <arg choice="opt" rep="repeat">OPTIONS</arg>
  55         <arg choice="opt" rep="repeat">MATCHES</arg>
  56       </cmdsynopsis>
  57     </refsynopsisdiv>
  58
  59     <refsect1>
  60       <title>Description</title>
  61
  62       <para><command>journalctl</command> may be used to query the
  63       contents of the
  64       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  65       journal as written by
  66       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  67
  68       <para>If called without parameters, it will show the full
  69       contents of the journal, starting with the oldest entry
  70       collected.</para>
  71
  72       <para>If one or more match arguments are passed, the output is
  73       filtered accordingly. A match is in the format
  74       <literal>FIELD=VALUE</literal>,
  75       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  76       to the components of a structured journal entry. See
  77       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  78       for a list of well-known fields. If multiple matches are
  79       specified matching different fields, the log entries are
  80       filtered by both, i.e. the resulting output will show only
  81       entries matching all the specified matches of this kind. If two
  82       matches apply to the same field, then they are automatically
  83       matched as alternatives, i.e. the resulting output will show
  84       entries matching any of the specified matches for the same
  85       field. Finally, the character <literal>+</literal> may appear
  86       as a separate word between other terms on the command line. This
  87       causes all matches before and after to be combined in a
  88       disjunction (i.e. logical OR).</para>
  89
  90       <para>It is also possible to filter the entries by specifying an
  91       absolute file path as an argument. The file path may be a file or
  92       a symbolic link and the file must exist at the time of the query. If a
  93       file path refers to an executable binary, an <literal>_EXE=</literal>
  94       match for the canonicalized binary path is added to the query. If a
  95       file path refers to an executable script, a <literal>_COMM=</literal>
  96       match for the script name is added to the query. If a file path
  97       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
  98       the kernel name of the device and for each of its ancestor devices is
  99       added to the query. Symbolic links are dereferenced, kernel names are
 100       synthesized, and parent devices are identified from the environment at
 101       the time of the query. In general, a device node is the best proxy for
 102       an actual device, as log entries do not usually contain fields that
 103       identify an actual device. For the resulting log entries to be correct
 104       for the actual device, the relevant parts of the environment at the time
 105       the entry was logged, in particular the actual device corresponding to
 106       the device node, must have been the same as those at the time of the
 107       query. Because device nodes generally change their corresponding devices
 108       across reboots, specifying a device node path causes the resulting
 109       entries to be restricted to those from the current boot.</para>
 110
 111       <para>Additional constraints may be added using options
 112       <option>--boot</option>, <option>--unit=</option>, etc., to
 113       further limit what entries will be shown (logical AND).</para>
 114
 115       <para>Output is interleaved from all accessible journal files,
 116       whether they are rotated or currently being written, and
 117       regardless of whether they belong to the system itself or are
 118       accessible user journals.</para>
 119
 120       <para>The set of journal files which will be used can be
 121       modified using the <option>--user</option>,
 122       <option>--system</option>, <option>--directory</option>, and
 123       <option>--file</option> options, see below.</para>
 124
 125       <para>All users are granted access to their private per-user
 126       journals. However, by default, only root and users who are
 127       members of a few special groups are granted access to the system
 128       journal and the journals of other users. Members of the groups
 129       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 130       <literal>wheel</literal> can read all journal files. Note
 131       that the two latter groups traditionally have additional
 132       privileges specified by the distribution. Members of the
 133       <literal>wheel</literal> group can often perform administrative
 134       tasks.</para>
 135
 136       <para>The output is paged through <command>less</command> by
 137       default, and long lines are "truncated" to screen width. The
 138       hidden part can be viewed by using the left-arrow and
 139       right-arrow keys. Paging can be disabled; see the
 140       <option>--no-pager</option> option and the "Environment" section
 141       below.</para>
 142
 143       <para>When outputting to a tty, lines are colored according to
 144       priority: lines of level ERROR and higher are colored red; lines
 145       of level NOTICE and higher are highlighted; other lines are
 146       displayed normally.</para>
 147     </refsect1>
 148
 149     <refsect1>
 150       <title>Options</title>
 151
 152       <para>The following options are understood:</para>
 153
 154       <variablelist>
 155         <varlistentry>
 156           <term><option>--no-full</option></term>
 157           <term><option>--full</option></term>
 158           <term><option>-l</option></term>
 159
 160           <listitem><para>Ellipsize fields when they do not fit in
 161           available columns.  The default is to show full fields,
 162           allowing them to wrap or be truncated by the pager, if one
 163           is used.</para>
 164
 165           <para>The old options
 166           <option>-l</option>/<option>--full</option> are not useful
 167           anymore, except to undo <option>--no-full</option>.</para>
 168           </listitem>
 169         </varlistentry>
 170
 171         <varlistentry>
 172           <term><option>-a</option></term>
 173           <term><option>--all</option></term>
 174
 175           <listitem><para>Show all fields in full, even if they
 176           include unprintable characters or are very
 177           long.</para></listitem>
 178         </varlistentry>
 179
 180         <varlistentry>
 181           <term><option>-f</option></term>
 182           <term><option>--follow</option></term>
 183
 184           <listitem><para>Show only the most recent journal entries,
 185           and continuously print new entries as they are appended to
 186           the journal.</para></listitem>
 187         </varlistentry>
 188
 189         <varlistentry>
 190           <term><option>-e</option></term>
 191           <term><option>--pager-end</option></term>
 192
 193           <listitem><para>Immediately jump to the end of the journal
 194           inside the implied pager tool. This implies
 195           <option>-n1000</option> to guarantee that the pager will not
 196           buffer logs of unbounded size. This may be overridden with
 197           an explicit <option>-n</option> with some other numeric
 198           value, while <option>-nall</option> will disable this cap.
 199           Note that this option is only supported for the
 200           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 201           pager.</para></listitem>
 202         </varlistentry>
 203
 204         <varlistentry>
 205           <term><option>-n</option></term>
 206           <term><option>--lines=</option></term>
 207
 208           <listitem><para>Show the most recent journal events and
 209           limit the number of events shown. If
 210           <option>--follow</option> is used, this option is
 211           implied. The argument is a positive integer or
 212           <literal>all</literal> to disable line limiting. The default
 213           value is 10 if no argument is given.</para></listitem>
 214         </varlistentry>
 215
 216         <varlistentry>
 217           <term><option>--no-tail</option></term>
 218
 219           <listitem><para>Show all stored output lines, even in follow
 220           mode. Undoes the effect of <option>--lines=</option>.
 221           </para></listitem>
 222         </varlistentry>
 223
 224         <varlistentry>
 225           <term><option>-r</option></term>
 226           <term><option>--reverse</option></term>
 227
 228           <listitem><para>Reverse output so that the newest entries
 229           are displayed first.</para></listitem>
 230         </varlistentry>
 231
 232         <varlistentry>
 233           <term><option>-o</option></term>
 234           <term><option>--output=</option></term>
 235
 236           <listitem><para>Controls the formatting of the journal
 237           entries that are shown. Takes one of the following
 238           options:</para>
 239           <variablelist>
 240             <varlistentry>
 241               <term>
 242                 <option>short</option>
 243               </term>
 244               <listitem>
 245                 <para>is the default and generates an output that is
 246                 mostly identical to the formatting of classic syslog
 247                 files, showing one line per journal entry.</para>
 248               </listitem>
 249             </varlistentry>
 250
 251             <varlistentry>
 252               <term>
 253                 <option>short-full</option>
 254               </term>
 255               <listitem>
 256                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 257                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 258                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 259                 output, and is locale-independent.</para>
 260               </listitem>
 261             </varlistentry>
 262
 263             <varlistentry>
 264               <term>
 265                 <option>short-iso</option>
 266               </term>
 267               <listitem>
 268                 <para>is very similar, but shows ISO 8601 wallclock
 269                 timestamps.</para>
 270               </listitem>
 271             </varlistentry>
 272
 273             <varlistentry>
 274               <term>
 275                 <option>short-iso-precise</option>
 276               </term>
 277               <listitem>
 278                 <para>as for <option>short-iso</option> but includes full
 279                 microsecond precision.</para>
 280               </listitem>
 281             </varlistentry>
 282
 283             <varlistentry>
 284               <term>
 285                 <option>short-precise</option>
 286               </term>
 287               <listitem>
 288                 <para>is very similar, but shows classic syslog timestamps
 289                 with full microsecond precision.</para>
 290               </listitem>
 291             </varlistentry>
 292
 293             <varlistentry>
 294               <term>
 295                 <option>short-monotonic</option>
 296               </term>
 297               <listitem>
 298                 <para>is very similar, but shows monotonic timestamps
 299                 instead of wallclock timestamps.</para>
 300               </listitem>
 301             </varlistentry>
 302
 303             <varlistentry>
 304               <term>
 305                 <option>short-unix</option>
 306               </term>
 307               <listitem>
 308                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 309                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 310               </listitem>
 311             </varlistentry>
 312
 313             <varlistentry>
 314               <term>
 315                 <option>verbose</option>
 316               </term>
 317               <listitem>
 318                 <para>shows the full-structured entry items with all
 319                 fields.</para>
 320               </listitem>
 321             </varlistentry>
 322
 323             <varlistentry>
 324               <term>
 325                 <option>export</option>
 326               </term>
 327               <listitem>
 328                 <para>serializes the journal into a binary (but mostly
 329                 text-based) stream suitable for backups and network
 330                 transfer (see
 331                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 332                 for more information). To import the binary stream back
 333                 into native journald format use
 334                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 335               </listitem>
 336             </varlistentry>
 337
 338             <varlistentry>
 339               <term>
 340                 <option>json</option>
 341               </term>
 342               <listitem>
 343                 <para>formats entries as JSON data structures, one per
 344                 line (see
 345                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink>
 346                 for more information).</para>
 347               </listitem>
 348             </varlistentry>
 349
 350             <varlistentry>
 351               <term>
 352                 <option>json-pretty</option>
 353               </term>
 354               <listitem>
 355                 <para>formats entries as JSON data structures, but
 356                 formats them in multiple lines in order to make them
 357                 more readable by humans.</para>
 358               </listitem>
 359             </varlistentry>
 360
 361             <varlistentry>
 362               <term>
 363                 <option>json-sse</option>
 364               </term>
 365               <listitem>
 366                 <para>formats entries as JSON data structures, but wraps
 367                 them in a format suitable for
 368                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 369                 </para>
 370               </listitem>
 371             </varlistentry>
 372
 373             <varlistentry>
 374               <term>
 375                 <option>cat</option>
 376               </term>
 377               <listitem>
 378                 <para>generates a very terse output, only showing the
 379                 actual message of each journal entry with no metadata,
 380                 not even a timestamp.</para>
 381               </listitem>
 382             </varlistentry>
 383           </variablelist>
 384         </listitem>
 385       </varlistentry>
 386
 387       <varlistentry>
 388         <term><option>--output-fields=</option></term>
 389
 390         <listitem><para>A comma separated list of the fields which should
 391         be included in the output. This only has an effect for the output modes
 392         which would normally show all fields (<option>verbose</option>,
 393         <option>export</option>, <option>json</option>,
 394         <option>json-pretty</option>, and <option>json-sse</option>). The
 395         <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 396         <literal>__MONOTONIC_TIMESTAMP</literal>, and
 397         <literal>_BOOT_ID</literal> fields are always
 398         printed.</para></listitem>
 399       </varlistentry>
 400
 401       <varlistentry>
 402         <term><option>--utc</option></term>
 403
 404         <listitem><para>Express time in Coordinated Universal Time
 405         (UTC).</para></listitem>
 406       </varlistentry>
 407
 408       <varlistentry>
 409         <term><option>--no-hostname</option></term>
 410
 411         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 412         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 413       </varlistentry>
 414
 415       <varlistentry>
 416         <term><option>-x</option></term>
 417         <term><option>--catalog</option></term>
 418
 419         <listitem><para>Augment log lines with explanation texts from
 420         the message catalog. This will add explanatory help texts to
 421         log messages in the output where this is available. These
 422         short help texts will explain the context of an error or log
 423         event, possible solutions, as well as pointers to support
 424         forums, developer documentation, and any other relevant
 425         manuals. Note that help texts are not available for all
 426         messages, but only for selected ones. For more information on
 427         the message catalog, please refer to the
 428         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 429
 430         <para>Note: when attaching <command>journalctl</command>
 431         output to bug reports, please do <emphasis>not</emphasis> use
 432         <option>-x</option>.</para>
 433         </listitem>
 434       </varlistentry>
 435
 436       <varlistentry>
 437         <term><option>-q</option></term>
 438         <term><option>--quiet</option></term>
 439
 440         <listitem><para>Suppresses all info messages
 441         (i.e. "-- Logs begin at …", "-- Reboot --"),
 442         any warning messages regarding
 443         inaccessible system journals when run as a normal
 444         user.</para></listitem>
 445       </varlistentry>
 446
 447       <varlistentry>
 448         <term><option>-m</option></term>
 449         <term><option>--merge</option></term>
 450
 451         <listitem><para>Show entries interleaved from all available
 452         journals, including remote ones.</para></listitem>
 453       </varlistentry>
 454
 455       <varlistentry>
 456         <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 457         <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 458
 459         <listitem><para>Show messages from a specific boot. This will
 460         add a match for <literal>_BOOT_ID=</literal>.</para>
 461
 462         <para>The argument may be empty, in which case logs for the
 463         current boot will be shown.</para>
 464
 465         <para>If the boot ID is omitted, a positive
 466         <replaceable>offset</replaceable> will look up the boots
 467         starting from the beginning of the journal, and an
 468         equal-or-less-than zero <replaceable>offset</replaceable> will
 469         look up boots starting from the end of the journal. Thus,
 470         <constant>1</constant> means the first boot found in the
 471         journal in chronological order, <constant>2</constant> the
 472         second and so on; while <constant>-0</constant> is the last
 473         boot, <constant>-1</constant> the boot before last, and so
 474         on. An empty <replaceable>offset</replaceable> is equivalent
 475         to specifying <constant>-0</constant>, except when the current
 476         boot is not the last boot (e.g. because
 477         <option>--directory</option> was specified to look at logs
 478         from a different machine).</para>
 479
 480         <para>If the 32-character <replaceable>ID</replaceable> is
 481         specified, it may optionally be followed by
 482         <replaceable>offset</replaceable> which identifies the boot
 483         relative to the one given by boot
 484         <replaceable>ID</replaceable>. Negative values mean earlier
 485         boots and positive values mean later boots. If
 486         <replaceable>offset</replaceable> is not specified, a value of
 487         zero is assumed, and the logs for the boot given by
 488         <replaceable>ID</replaceable> are shown.</para>
 489         </listitem>
 490       </varlistentry>
 491
 492       <varlistentry>
 493         <term><option>--list-boots</option></term>
 494
 495         <listitem><para>Show a tabular list of boot numbers (relative to
 496         the current boot), their IDs, and the timestamps of the first
 497         and last message pertaining to the boot.</para></listitem>
 498       </varlistentry>
 499
 500       <varlistentry>
 501         <term><option>-k</option></term>
 502         <term><option>--dmesg</option></term>
 503
 504         <listitem><para>Show only kernel messages. This implies
 505         <option>-b</option> and adds the match
 506         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 507       </varlistentry>
 508
 509       <varlistentry>
 510         <term><option>-t</option></term>
 511         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 512
 513         <listitem><para>Show messages for the specified syslog
 514         identifier
 515         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 516
 517         <para>This parameter can be specified multiple
 518         times.</para></listitem>
 519       </varlistentry>
 520
 521       <varlistentry>
 522         <term><option>-u</option></term>
 523         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 524
 525         <listitem><para>Show messages for the specified systemd unit
 526         <replaceable>UNIT</replaceable> (such as a service unit), or
 527         for any of the units matched by
 528         <replaceable>PATTERN</replaceable>.  If a pattern is
 529         specified, a list of unit names found in the journal is
 530         compared with the specified pattern and all that match are
 531         used. For each unit name, a match is added for messages from
 532         the unit
 533         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 534         along with additional matches for messages from systemd and
 535         messages about coredumps for the specified unit.</para>
 536
 537         <para>This parameter can be specified multiple times.</para>
 538         </listitem>
 539       </varlistentry>
 540
 541       <varlistentry>
 542         <term><option>--user-unit=</option></term>
 543
 544         <listitem><para>Show messages for the specified user session
 545         unit. This will add a match for messages from the unit
 546         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 547         <literal>_UID=</literal>) and additional matches for messages
 548         from session systemd and messages about coredumps for the
 549         specified unit.</para>
 550
 551         <para>This parameter can be specified multiple times.</para>
 552         </listitem>
 553       </varlistentry>
 554
 555       <varlistentry>
 556         <term><option>-p</option></term>
 557         <term><option>--priority=</option></term>
 558
 559         <listitem><para>Filter output by message priorities or
 560         priority ranges. Takes either a single numeric or textual log
 561         level (i.e. between 0/<literal>emerg</literal> and
 562         7/<literal>debug</literal>), or a range of numeric/text log
 563         levels in the form FROM..TO. The log levels are the usual
 564         syslog log levels as documented in
 565         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 566         i.e. <literal>emerg</literal> (0),
 567         <literal>alert</literal> (1), <literal>crit</literal> (2),
 568         <literal>err</literal> (3), <literal>warning</literal> (4),
 569         <literal>notice</literal> (5), <literal>info</literal> (6),
 570         <literal>debug</literal> (7). If a single log level is
 571         specified, all messages with this log level or a lower (hence
 572         more important) log level are shown. If a range is specified,
 573         all messages within the range are shown, including both the
 574         start and the end value of the range. This will add
 575         <literal>PRIORITY=</literal> matches for the specified
 576         priorities.</para></listitem>
 577       </varlistentry>
 578
 579       <varlistentry>
 580         <term><option>-c</option></term>
 581         <term><option>--cursor=</option></term>
 582
 583         <listitem><para>Start showing entries from the location in the
 584         journal specified by the passed cursor.</para></listitem>
 585       </varlistentry>
 586
 587       <varlistentry>
 588         <term><option>--after-cursor=</option></term>
 589
 590         <listitem><para>Start showing entries from the location in the
 591         journal <emphasis>after</emphasis> the location specified by
 592         the passed cursor.  The cursor is shown when the
 593         <option>--show-cursor</option> option is used.</para>
 594         </listitem>
 595       </varlistentry>
 596
 597       <varlistentry>
 598         <term><option>--show-cursor</option></term>
 599
 600         <listitem><para>The cursor is shown after the last entry after
 601         two dashes:</para>
 602         <programlisting>-- cursor: s=0639…</programlisting>
 603         <para>The format of the cursor is private
 604         and subject to change.</para></listitem>
 605       </varlistentry>
 606
 607       <varlistentry>
 608         <term><option>-S</option></term>
 609         <term><option>--since=</option></term>
 610         <term><option>-U</option></term>
 611         <term><option>--until=</option></term>
 612
 613         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 614         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 615         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 616         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 617         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 618         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 619         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 620         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 621         time, respectively. For complete time and date specification, see
 622         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 623         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 624         </para>
 625         </listitem>
 626       </varlistentry>
 627
 628       <varlistentry>
 629         <term><option>-F</option></term>
 630         <term><option>--field=</option></term>
 631
 632         <listitem><para>Print all possible data values the specified
 633         field can take in all entries of the journal.</para></listitem>
 634       </varlistentry>
 635
 636       <varlistentry>
 637         <term><option>-N</option></term>
 638         <term><option>--fields</option></term>
 639
 640         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 641       </varlistentry>
 642
 643       <varlistentry>
 644         <term><option>--system</option></term>
 645         <term><option>--user</option></term>
 646
 647         <listitem><para>Show messages from system services and the
 648         kernel (with <option>--system</option>). Show messages from
 649         service of current user (with <option>--user</option>).  If
 650         neither is specified, show all messages that the user can see.
 651         </para></listitem>
 652       </varlistentry>
 653
 654       <varlistentry>
 655         <term><option>-M</option></term>
 656         <term><option>--machine=</option></term>
 657
 658         <listitem><para>Show messages from a running, local
 659         container. Specify a container name to connect to.</para>
 660         </listitem>
 661       </varlistentry>
 662
 663       <varlistentry>
 664         <term><option>-D <replaceable>DIR</replaceable></option></term>
 665         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 666
 667         <listitem><para>Takes a directory path as argument. If
 668         specified, journalctl will operate on the specified journal
 669         directory <replaceable>DIR</replaceable> instead of the
 670         default runtime and system journal paths.</para></listitem>
 671       </varlistentry>
 672
 673       <varlistentry>
 674         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 675
 676         <listitem><para>Takes a file glob as an argument. If
 677         specified, journalctl will operate on the specified journal
 678         files matching <replaceable>GLOB</replaceable> instead of the
 679         default runtime and system journal paths. May be specified
 680         multiple times, in which case files will be suitably
 681         interleaved.</para></listitem>
 682       </varlistentry>
 683
 684       <varlistentry>
 685         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 686
 687         <listitem><para>Takes a directory path as an argument. If
 688         specified, journalctl will operate on journal directories and catalog file hierarchy
 689         underneath the specified directory instead of the root
 690         directory (e.g. <option>--update-catalog</option> will create
 691         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 692         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 693         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 694         </para></listitem>
 695       </varlistentry>
 696
 697       <varlistentry>
 698         <term><option>--new-id128</option></term>
 699
 700         <listitem><para>Instead of showing journal contents, generate
 701         a new 128-bit ID suitable for identifying messages. This is
 702         intended for usage by developers who need a new identifier for
 703         a new message they introduce and want to make
 704         recognizable. This will print the new ID in four different
 705         formats which can be copied into source code or similar.
 706         </para></listitem>
 707       </varlistentry>
 708
 709       <varlistentry>
 710         <term><option>--header</option></term>
 711
 712         <listitem><para>Instead of showing journal contents, show
 713         internal header information of the journal fields
 714         accessed.</para></listitem>
 715       </varlistentry>
 716
 717       <varlistentry>
 718         <term><option>--disk-usage</option></term>
 719
 720         <listitem><para>Shows the current disk usage of all journal
 721         files. This shows the sum of the disk usage of all archived
 722         and active journal files.</para></listitem>
 723       </varlistentry>
 724
 725       <varlistentry>
 726         <term><option>--vacuum-size=</option></term>
 727         <term><option>--vacuum-time=</option></term>
 728         <term><option>--vacuum-files=</option></term>
 729
 730         <listitem><para>Removes archived journal files until the disk
 731         space they use falls below the specified size (specified with
 732         the usual <literal>K</literal>, <literal>M</literal>,
 733         <literal>G</literal> and <literal>T</literal> suffixes), or all
 734         archived journal files contain no data older than the specified
 735         timespan (specified with the usual <literal>s</literal>,
 736         <literal>m</literal>, <literal>h</literal>,
 737         <literal>days</literal>, <literal>months</literal>,
 738         <literal>weeks</literal> and <literal>years</literal> suffixes),
 739         or no more than the specified number of separate journal files
 740         remain. Note that running <option>--vacuum-size=</option> has
 741         only an indirect effect on the output shown by
 742         <option>--disk-usage</option>, as the latter includes active
 743         journal files, while the vacuuming operation only operates
 744         on archived journal files. Similarly,
 745         <option>--vacuum-files=</option> might not actually reduce the
 746         number of journal files to below the specified number, as it
 747         will not remove active journal
 748         files. <option>--vacuum-size=</option>,
 749         <option>--vacuum-time=</option> and
 750         <option>--vacuum-files=</option> may be combined in a single
 751         invocation to enforce any combination of a size, a time and a
 752         number of files limit on the archived journal
 753         files. Specifying any of these three parameters as zero is
 754         equivalent to not enforcing the specific limit, and is thus
 755         redundant.</para></listitem>
 756       </varlistentry>
 757
 758       <varlistentry>
 759         <term><option>--list-catalog
 760         <optional><replaceable>128-bit-ID…</replaceable></optional>
 761         </option></term>
 762
 763         <listitem><para>List the contents of the message catalog as a
 764         table of message IDs, plus their short description strings.
 765         </para>
 766
 767         <para>If any <replaceable>128-bit-ID</replaceable>s are
 768         specified, only those entries are shown.</para>
 769         </listitem>
 770       </varlistentry>
 771
 772       <varlistentry>
 773         <term><option>--dump-catalog
 774         <optional><replaceable>128-bit-ID…</replaceable></optional>
 775         </option></term>
 776
 777         <listitem><para>Show the contents of the message catalog, with
 778         entries separated by a line consisting of two dashes and the
 779         ID (the format is the same as <filename>.catalog</filename>
 780         files).</para>
 781
 782         <para>If any <replaceable>128-bit-ID</replaceable>s are
 783         specified, only those entries are shown.</para>
 784         </listitem>
 785       </varlistentry>
 786
 787       <varlistentry>
 788         <term><option>--update-catalog</option></term>
 789
 790         <listitem><para>Update the message catalog index. This command
 791         needs to be executed each time new catalog files are
 792         installed, removed, or updated to rebuild the binary catalog
 793         index.</para></listitem>
 794       </varlistentry>
 795
 796       <varlistentry>
 797         <term><option>--setup-keys</option></term>
 798
 799         <listitem><para>Instead of showing journal contents, generate
 800         a new key pair for Forward Secure Sealing (FSS). This will
 801         generate a sealing key and a verification key. The sealing key
 802         is stored in the journal data directory and shall remain on
 803         the host. The verification key should be stored
 804         externally. Refer to the <option>Seal=</option> option in
 805         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 806         for information on Forward Secure Sealing and for a link to a
 807         refereed scholarly paper detailing the cryptographic theory it
 808         is based on.</para></listitem>
 809       </varlistentry>
 810
 811       <varlistentry>
 812         <term><option>--force</option></term>
 813
 814         <listitem><para>When <option>--setup-keys</option> is passed
 815         and Forward Secure Sealing (FSS) has already been configured,
 816         recreate FSS keys.</para></listitem>
 817       </varlistentry>
 818
 819       <varlistentry>
 820         <term><option>--interval=</option></term>
 821
 822         <listitem><para>Specifies the change interval for the sealing
 823         key when generating an FSS key pair with
 824         <option>--setup-keys</option>. Shorter intervals increase CPU
 825         consumption but shorten the time range of undetectable journal
 826         alterations. Defaults to 15min.</para></listitem>
 827       </varlistentry>
 828
 829       <varlistentry>
 830         <term><option>--verify</option></term>
 831
 832         <listitem><para>Check the journal file for internal
 833         consistency. If the file has been generated with FSS enabled and
 834         the FSS verification key has been specified with
 835         <option>--verify-key=</option>, authenticity of the journal file
 836         is verified.</para></listitem>
 837       </varlistentry>
 838
 839       <varlistentry>
 840         <term><option>--verify-key=</option></term>
 841
 842         <listitem><para>Specifies the FSS verification key to use for
 843         the <option>--verify</option> operation.</para></listitem>
 844       </varlistentry>
 845
 846       <varlistentry>
 847         <term><option>--sync</option></term>
 848
 849         <listitem><para>Asks the journal daemon to write all yet
 850         unwritten journal data to the backing file system and
 851         synchronize all journals. This call does not return until the
 852         synchronization operation is complete. This command guarantees
 853         that any log messages written before its invocation are safely
 854         stored on disk at the time it returns.</para></listitem>
 855       </varlistentry>
 856
 857       <varlistentry>
 858         <term><option>--flush</option></term>
 859
 860         <listitem><para>Asks the journal daemon to flush any log data
 861         stored in <filename>/run/log/journal</filename> into
 862         <filename>/var/log/journal</filename>, if persistent storage
 863         is enabled. This call does not return until the operation is
 864         complete. Note that this call is idempotent: the data is only
 865         flushed from <filename>/run/log/journal</filename> into
 866         <filename>/var/log/journal</filename> once during system
 867         runtime, and this command exits cleanly without executing any
 868         operation if this has already happened. This command
 869         effectively guarantees that all data is flushed to
 870         <filename>/var/log/journal</filename> at the time it
 871         returns.</para></listitem>
 872       </varlistentry>
 873
 874       <varlistentry>
 875         <term><option>--rotate</option></term>
 876
 877         <listitem><para>Asks the journal daemon to rotate journal
 878         files. This call does not return until the rotation operation
 879         is complete.</para></listitem>
 880       </varlistentry>
 881
 882       <xi:include href="standard-options.xml" xpointer="help" />
 883       <xi:include href="standard-options.xml" xpointer="version" />
 884       <xi:include href="standard-options.xml" xpointer="no-pager" />
 885     </variablelist>
 886   </refsect1>
 887
 888   <refsect1>
 889     <title>Exit status</title>
 890
 891     <para>On success, 0 is returned; otherwise, a non-zero failure
 892     code is returned.</para>
 893   </refsect1>
 894
 895   <xi:include href="less-variables.xml" />
 896
 897   <refsect1>
 898     <title>Examples</title>
 899
 900     <para>Without arguments, all collected logs are shown
 901     unfiltered:</para>
 902
 903     <programlisting>journalctl</programlisting>
 904
 905     <para>With one match specified, all entries with a field matching
 906     the expression are shown:</para>
 907
 908     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
 909
 910     <para>If two different fields are matched, only entries matching
 911     both expressions at the same time are shown:</para>
 912
 913     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 914
 915     <para>If two matches refer to the same field, all entries matching
 916     either expression are shown:</para>
 917
 918     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 919
 920     <para>If the separator <literal>+</literal> is used, two
 921     expressions may be combined in a logical OR. The following will
 922     show all messages from the Avahi service process with the PID
 923     28097 plus all messages from the D-Bus service (from any of its
 924     processes):</para>
 925
 926     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 927
 928     <para>Show all logs generated by the D-Bus executable:</para>
 929
 930     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 931
 932     <para>Show all kernel logs from previous boot:</para>
 933
 934     <programlisting>journalctl -k -b -1</programlisting>
 935
 936     <para>Show a live log display from a system service
 937     <filename>apache.service</filename>:</para>
 938
 939     <programlisting>journalctl -f -u apache</programlisting>
 940
 941   </refsect1>
 942
 943   <refsect1>
 944     <title>See Also</title>
 945     <para>
 946       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 947       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 948       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 949       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 950       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 951       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 952       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 953       <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 954       <citerefentry><refentrytitle>systemd-journal-upload</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 955     </para>
 956   </refsect1>
 957 </refentry>