man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   5
   6   <refentry id="journalctl"
   7             xmlns:xi="http://www.w3.org/2001/XInclude">
   8
   9     <refentryinfo>
  10       <title>journalctl</title>
  11       <productname>systemd</productname>
  12     </refentryinfo>
  13
  14     <refmeta>
  15       <refentrytitle>journalctl</refentrytitle>
  16       <manvolnum>1</manvolnum>
  17     </refmeta>
  18
  19     <refnamediv>
  20       <refname>journalctl</refname>
  21       <refpurpose>Query the systemd journal</refpurpose>
  22     </refnamediv>
  23
  24     <refsynopsisdiv>
  25       <cmdsynopsis>
  26         <command>journalctl</command>
  27         <arg choice="opt" rep="repeat">OPTIONS</arg>
  28         <arg choice="opt" rep="repeat">MATCHES</arg>
  29       </cmdsynopsis>
  30     </refsynopsisdiv>
  31
  32     <refsect1>
  33       <title>Description</title>
  34
  35       <para><command>journalctl</command> may be used to query the
  36       contents of the
  37       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  38       journal as written by
  39       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  40
  41       <para>If called without parameters, it will show the full
  42       contents of the journal, starting with the oldest entry
  43       collected.</para>
  44
  45       <para>If one or more match arguments are passed, the output is
  46       filtered accordingly. A match is in the format
  47       <literal>FIELD=VALUE</literal>,
  48       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  49       to the components of a structured journal entry. See
  50       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  51       for a list of well-known fields. If multiple matches are
  52       specified matching different fields, the log entries are
  53       filtered by both, i.e. the resulting output will show only
  54       entries matching all the specified matches of this kind. If two
  55       matches apply to the same field, then they are automatically
  56       matched as alternatives, i.e. the resulting output will show
  57       entries matching any of the specified matches for the same
  58       field. Finally, the character <literal>+</literal> may appear
  59       as a separate word between other terms on the command line. This
  60       causes all matches before and after to be combined in a
  61       disjunction (i.e. logical OR).</para>
  62
  63       <para>It is also possible to filter the entries by specifying an
  64       absolute file path as an argument. The file path may be a file or
  65       a symbolic link and the file must exist at the time of the query. If a
  66       file path refers to an executable binary, an <literal>_EXE=</literal>
  67       match for the canonicalized binary path is added to the query. If a
  68       file path refers to an executable script, a <literal>_COMM=</literal>
  69       match for the script name is added to the query. If a file path
  70       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
  71       the kernel name of the device and for each of its ancestor devices is
  72       added to the query. Symbolic links are dereferenced, kernel names are
  73       synthesized, and parent devices are identified from the environment at
  74       the time of the query. In general, a device node is the best proxy for
  75       an actual device, as log entries do not usually contain fields that
  76       identify an actual device. For the resulting log entries to be correct
  77       for the actual device, the relevant parts of the environment at the time
  78       the entry was logged, in particular the actual device corresponding to
  79       the device node, must have been the same as those at the time of the
  80       query. Because device nodes generally change their corresponding devices
  81       across reboots, specifying a device node path causes the resulting
  82       entries to be restricted to those from the current boot.</para>
  83
  84       <para>Additional constraints may be added using options
  85       <option>--boot</option>, <option>--unit=</option>, etc., to
  86       further limit what entries will be shown (logical AND).</para>
  87
  88       <para>Output is interleaved from all accessible journal files,
  89       whether they are rotated or currently being written, and
  90       regardless of whether they belong to the system itself or are
  91       accessible user journals.</para>
  92
  93       <para>The set of journal files which will be used can be
  94       modified using the <option>--user</option>,
  95       <option>--system</option>, <option>--directory</option>, and
  96       <option>--file</option> options, see below.</para>
  97
  98       <para>All users are granted access to their private per-user
  99       journals. However, by default, only root and users who are
 100       members of a few special groups are granted access to the system
 101       journal and the journals of other users. Members of the groups
 102       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 103       <literal>wheel</literal> can read all journal files. Note
 104       that the two latter groups traditionally have additional
 105       privileges specified by the distribution. Members of the
 106       <literal>wheel</literal> group can often perform administrative
 107       tasks.</para>
 108
 109       <para>The output is paged through <command>less</command> by
 110       default, and long lines are "truncated" to screen width. The
 111       hidden part can be viewed by using the left-arrow and
 112       right-arrow keys. Paging can be disabled; see the
 113       <option>--no-pager</option> option and the "Environment" section
 114       below.</para>
 115
 116       <para>When outputting to a tty, lines are colored according to
 117       priority: lines of level ERROR and higher are colored red; lines
 118       of level NOTICE and higher are highlighted; lines of level DEBUG
 119       are colored lighter grey; other lines are displayed normally.</para>
 120     </refsect1>
 121
 122     <refsect1>
 123       <title>Options</title>
 124
 125       <para>The following options are understood:</para>
 126
 127       <variablelist>
 128         <varlistentry>
 129           <term><option>--no-full</option></term>
 130           <term><option>--full</option></term>
 131           <term><option>-l</option></term>
 132
 133           <listitem><para>Ellipsize fields when they do not fit in
 134           available columns.  The default is to show full fields,
 135           allowing them to wrap or be truncated by the pager, if one
 136           is used.</para>
 137
 138           <para>The old options
 139           <option>-l</option>/<option>--full</option> are not useful
 140           anymore, except to undo <option>--no-full</option>.</para>
 141           </listitem>
 142         </varlistentry>
 143
 144         <varlistentry>
 145           <term><option>-a</option></term>
 146           <term><option>--all</option></term>
 147
 148           <listitem><para>Show all fields in full, even if they include unprintable characters or are very long. By
 149           default, fields with unprintable characters are abbreviated as "blob data". (Note that the pager may escape
 150           unprintable characters again.)</para></listitem>
 151         </varlistentry>
 152
 153         <varlistentry>
 154           <term><option>-f</option></term>
 155           <term><option>--follow</option></term>
 156
 157           <listitem><para>Show only the most recent journal entries,
 158           and continuously print new entries as they are appended to
 159           the journal.</para></listitem>
 160         </varlistentry>
 161
 162         <varlistentry>
 163           <term><option>-e</option></term>
 164           <term><option>--pager-end</option></term>
 165
 166           <listitem><para>Immediately jump to the end of the journal
 167           inside the implied pager tool. This implies
 168           <option>-n1000</option> to guarantee that the pager will not
 169           buffer logs of unbounded size. This may be overridden with
 170           an explicit <option>-n</option> with some other numeric
 171           value, while <option>-nall</option> will disable this cap.
 172           Note that this option is only supported for the
 173           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 174           pager.</para></listitem>
 175         </varlistentry>
 176
 177         <varlistentry>
 178           <term><option>-n</option></term>
 179           <term><option>--lines=</option></term>
 180
 181           <listitem><para>Show the most recent journal events and
 182           limit the number of events shown. If
 183           <option>--follow</option> is used, this option is
 184           implied. The argument is a positive integer or
 185           <literal>all</literal> to disable line limiting. The default
 186           value is 10 if no argument is given.</para></listitem>
 187         </varlistentry>
 188
 189         <varlistentry>
 190           <term><option>--no-tail</option></term>
 191
 192           <listitem><para>Show all stored output lines, even in follow
 193           mode. Undoes the effect of <option>--lines=</option>.
 194           </para></listitem>
 195         </varlistentry>
 196
 197         <varlistentry>
 198           <term><option>-r</option></term>
 199           <term><option>--reverse</option></term>
 200
 201           <listitem><para>Reverse output so that the newest entries
 202           are displayed first.</para></listitem>
 203         </varlistentry>
 204
 205         <varlistentry>
 206           <term><option>-o</option></term>
 207           <term><option>--output=</option></term>
 208
 209           <listitem><para>Controls the formatting of the journal
 210           entries that are shown. Takes one of the following
 211           options:</para>
 212           <variablelist>
 213             <varlistentry>
 214               <term>
 215                 <option>short</option>
 216               </term>
 217               <listitem>
 218                 <para>is the default and generates an output that is
 219                 mostly identical to the formatting of classic syslog
 220                 files, showing one line per journal entry.</para>
 221               </listitem>
 222             </varlistentry>
 223
 224             <varlistentry>
 225               <term>
 226                 <option>short-full</option>
 227               </term>
 228               <listitem>
 229                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 230                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 231                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 232                 output, and is locale-independent.</para>
 233               </listitem>
 234             </varlistentry>
 235
 236             <varlistentry>
 237               <term>
 238                 <option>short-iso</option>
 239               </term>
 240               <listitem>
 241                 <para>is very similar, but shows ISO 8601 wallclock
 242                 timestamps.</para>
 243               </listitem>
 244             </varlistentry>
 245
 246             <varlistentry>
 247               <term>
 248                 <option>short-iso-precise</option>
 249               </term>
 250               <listitem>
 251                 <para>as for <option>short-iso</option> but includes full
 252                 microsecond precision.</para>
 253               </listitem>
 254             </varlistentry>
 255
 256             <varlistentry>
 257               <term>
 258                 <option>short-precise</option>
 259               </term>
 260               <listitem>
 261                 <para>is very similar, but shows classic syslog timestamps
 262                 with full microsecond precision.</para>
 263               </listitem>
 264             </varlistentry>
 265
 266             <varlistentry>
 267               <term>
 268                 <option>short-monotonic</option>
 269               </term>
 270               <listitem>
 271                 <para>is very similar, but shows monotonic timestamps
 272                 instead of wallclock timestamps.</para>
 273               </listitem>
 274             </varlistentry>
 275
 276             <varlistentry>
 277               <term>
 278                 <option>short-unix</option>
 279               </term>
 280               <listitem>
 281                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 282                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 283               </listitem>
 284             </varlistentry>
 285
 286             <varlistentry>
 287               <term>
 288                 <option>verbose</option>
 289               </term>
 290               <listitem>
 291                 <para>shows the full-structured entry items with all
 292                 fields.</para>
 293               </listitem>
 294             </varlistentry>
 295
 296             <varlistentry>
 297               <term>
 298                 <option>export</option>
 299               </term>
 300               <listitem>
 301                 <para>serializes the journal into a binary (but mostly
 302                 text-based) stream suitable for backups and network
 303                 transfer (see
 304                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 305                 for more information). To import the binary stream back
 306                 into native journald format use
 307                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 308               </listitem>
 309             </varlistentry>
 310
 311             <varlistentry>
 312               <term>
 313                 <option>json</option>
 314               </term>
 315               <listitem>
 316                 <para>formats entries as JSON objects, separated by newline characters (see <ulink
 317                 url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink> for more
 318                 information). Field values are generally encoded as JSON strings, with three exceptions:
 319                 <orderedlist>
 320                   <listitem><para>Fields larger than 4096 bytes are encoded as <constant>null</constant> values. (This
 321                   may be turned off by passing <option>--all</option>, but be aware that this may allocate overly long
 322                   JSON objects.) </para></listitem>
 323
 324                   <listitem><para>Journal entries permit non-unique fields within the same log entry. JSON does not allow
 325                   non-unique fields within objects. Due to this, if a non-unique field is encountered a JSON array is
 326                   used as field value, listing all field values as elements.</para></listitem>
 327
 328                   <listitem><para>Fields containing non-printable or non-UTF8 bytes are encoded as arrays containing
 329                   the raw bytes individually formatted as unsigned numbers.</para></listitem>
 330                 </orderedlist>
 331
 332                 Note that this encoding is reversible (with the exception of the size limit).</para>
 333               </listitem>
 334             </varlistentry>
 335
 336             <varlistentry>
 337               <term>
 338                 <option>json-pretty</option>
 339               </term>
 340               <listitem>
 341                 <para>formats entries as JSON data structures, but
 342                 formats them in multiple lines in order to make them
 343                 more readable by humans.</para>
 344               </listitem>
 345             </varlistentry>
 346
 347             <varlistentry>
 348               <term>
 349                 <option>json-sse</option>
 350               </term>
 351               <listitem>
 352                 <para>formats entries as JSON data structures, but wraps
 353                 them in a format suitable for
 354                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 355                 </para>
 356               </listitem>
 357             </varlistentry>
 358
 359             <varlistentry>
 360               <term>
 361                 <option>json-seq</option>
 362               </term>
 363               <listitem>
 364                 <para>formats entries as JSON data structures, but prefixes them with an ASCII Record Separator
 365                 character (0x1E) and suffixes them with an ASCII Line Feed character (0x0A), in accordance with <ulink
 366                 url="https://tools.ietf.org/html/rfc7464">JavaScript Object Notation (JSON) Text Sequences </ulink>
 367                 (<literal>application/json-seq</literal>).
 368                 </para>
 369               </listitem>
 370             </varlistentry>
 371
 372             <varlistentry>
 373               <term>
 374                 <option>cat</option>
 375               </term>
 376               <listitem>
 377                 <para>generates a very terse output, only showing the
 378                 actual message of each journal entry with no metadata,
 379                 not even a timestamp.</para>
 380               </listitem>
 381             </varlistentry>
 382
 383             <varlistentry>
 384               <term>
 385                 <option>with-unit</option>
 386               </term>
 387               <listitem>
 388                 <para>similar to short-full, but prefixes the unit and
 389                 user unit names instead of the traditional syslog
 390                 identifier. Useful when using templated instances, as it
 391                 will include the arguments in the unit names.</para>
 392               </listitem>
 393             </varlistentry>
 394           </variablelist>
 395         </listitem>
 396       </varlistentry>
 397
 398       <varlistentry>
 399         <term><option>--output-fields=</option></term>
 400
 401         <listitem><para>A comma separated list of the fields which should be included in the output. This only has an
 402         effect for the output modes which would normally show all fields (<option>verbose</option>,
 403         <option>export</option>, <option>json</option>, <option>json-pretty</option>, <option>json-sse</option> and
 404         <option>json-seq</option>). The <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 405         <literal>__MONOTONIC_TIMESTAMP</literal>, and <literal>_BOOT_ID</literal> fields are always
 406         printed.</para></listitem>
 407       </varlistentry>
 408
 409       <varlistentry>
 410         <term><option>--utc</option></term>
 411
 412         <listitem><para>Express time in Coordinated Universal Time
 413         (UTC).</para></listitem>
 414       </varlistentry>
 415
 416       <varlistentry>
 417         <term><option>--no-hostname</option></term>
 418
 419         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 420         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 421       </varlistentry>
 422
 423       <varlistentry>
 424         <term><option>-x</option></term>
 425         <term><option>--catalog</option></term>
 426
 427         <listitem><para>Augment log lines with explanation texts from
 428         the message catalog. This will add explanatory help texts to
 429         log messages in the output where this is available. These
 430         short help texts will explain the context of an error or log
 431         event, possible solutions, as well as pointers to support
 432         forums, developer documentation, and any other relevant
 433         manuals. Note that help texts are not available for all
 434         messages, but only for selected ones. For more information on
 435         the message catalog, please refer to the
 436         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 437
 438         <para>Note: when attaching <command>journalctl</command>
 439         output to bug reports, please do <emphasis>not</emphasis> use
 440         <option>-x</option>.</para>
 441         </listitem>
 442       </varlistentry>
 443
 444       <varlistentry>
 445         <term><option>-q</option></term>
 446         <term><option>--quiet</option></term>
 447
 448         <listitem><para>Suppresses all informational messages
 449         (i.e. "-- Logs begin at …", "-- Reboot --"),
 450         any warning messages regarding
 451         inaccessible system journals when run as a normal
 452         user.</para></listitem>
 453       </varlistentry>
 454
 455       <varlistentry>
 456         <term><option>-m</option></term>
 457         <term><option>--merge</option></term>
 458
 459         <listitem><para>Show entries interleaved from all available
 460         journals, including remote ones.</para></listitem>
 461       </varlistentry>
 462
 463       <varlistentry>
 464         <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 465         <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 466
 467         <listitem><para>Show messages from a specific boot. This will
 468         add a match for <literal>_BOOT_ID=</literal>.</para>
 469
 470         <para>The argument may be empty, in which case logs for the
 471         current boot will be shown.</para>
 472
 473         <para>If the boot ID is omitted, a positive
 474         <replaceable>offset</replaceable> will look up the boots
 475         starting from the beginning of the journal, and an
 476         equal-or-less-than zero <replaceable>offset</replaceable> will
 477         look up boots starting from the end of the journal. Thus,
 478         <constant>1</constant> means the first boot found in the
 479         journal in chronological order, <constant>2</constant> the
 480         second and so on; while <constant>-0</constant> is the last
 481         boot, <constant>-1</constant> the boot before last, and so
 482         on. An empty <replaceable>offset</replaceable> is equivalent
 483         to specifying <constant>-0</constant>, except when the current
 484         boot is not the last boot (e.g. because
 485         <option>--directory</option> was specified to look at logs
 486         from a different machine).</para>
 487
 488         <para>If the 32-character <replaceable>ID</replaceable> is
 489         specified, it may optionally be followed by
 490         <replaceable>offset</replaceable> which identifies the boot
 491         relative to the one given by boot
 492         <replaceable>ID</replaceable>. Negative values mean earlier
 493         boots and positive values mean later boots. If
 494         <replaceable>offset</replaceable> is not specified, a value of
 495         zero is assumed, and the logs for the boot given by
 496         <replaceable>ID</replaceable> are shown.</para>
 497         </listitem>
 498       </varlistentry>
 499
 500       <varlistentry>
 501         <term><option>--list-boots</option></term>
 502
 503         <listitem><para>Show a tabular list of boot numbers (relative to
 504         the current boot), their IDs, and the timestamps of the first
 505         and last message pertaining to the boot.</para></listitem>
 506       </varlistentry>
 507
 508       <varlistentry>
 509         <term><option>-k</option></term>
 510         <term><option>--dmesg</option></term>
 511
 512         <listitem><para>Show only kernel messages. This implies
 513         <option>-b</option> and adds the match
 514         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 515       </varlistentry>
 516
 517       <varlistentry>
 518         <term><option>-t</option></term>
 519         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 520
 521         <listitem><para>Show messages for the specified syslog
 522         identifier
 523         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 524
 525         <para>This parameter can be specified multiple
 526         times.</para></listitem>
 527       </varlistentry>
 528
 529       <varlistentry>
 530         <term><option>-u</option></term>
 531         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 532
 533         <listitem><para>Show messages for the specified systemd unit
 534         <replaceable>UNIT</replaceable> (such as a service unit), or
 535         for any of the units matched by
 536         <replaceable>PATTERN</replaceable>.  If a pattern is
 537         specified, a list of unit names found in the journal is
 538         compared with the specified pattern and all that match are
 539         used. For each unit name, a match is added for messages from
 540         the unit
 541         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 542         along with additional matches for messages from systemd and
 543         messages about coredumps for the specified unit.</para>
 544
 545         <para>This parameter can be specified multiple times.</para>
 546         </listitem>
 547       </varlistentry>
 548
 549       <varlistentry>
 550         <term><option>--user-unit=</option></term>
 551
 552         <listitem><para>Show messages for the specified user session
 553         unit. This will add a match for messages from the unit
 554         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 555         <literal>_UID=</literal>) and additional matches for messages
 556         from session systemd and messages about coredumps for the
 557         specified unit.</para>
 558
 559         <para>This parameter can be specified multiple times.</para>
 560         </listitem>
 561       </varlistentry>
 562
 563       <varlistentry>
 564         <term><option>-p</option></term>
 565         <term><option>--priority=</option></term>
 566
 567         <listitem><para>Filter output by message priorities or
 568         priority ranges. Takes either a single numeric or textual log
 569         level (i.e. between 0/<literal>emerg</literal> and
 570         7/<literal>debug</literal>), or a range of numeric/text log
 571         levels in the form FROM..TO. The log levels are the usual
 572         syslog log levels as documented in
 573         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 574         i.e. <literal>emerg</literal> (0),
 575         <literal>alert</literal> (1), <literal>crit</literal> (2),
 576         <literal>err</literal> (3), <literal>warning</literal> (4),
 577         <literal>notice</literal> (5), <literal>info</literal> (6),
 578         <literal>debug</literal> (7). If a single log level is
 579         specified, all messages with this log level or a lower (hence
 580         more important) log level are shown. If a range is specified,
 581         all messages within the range are shown, including both the
 582         start and the end value of the range. This will add
 583         <literal>PRIORITY=</literal> matches for the specified
 584         priorities.</para></listitem>
 585       </varlistentry>
 586
 587       <varlistentry>
 588         <term><option>-g</option></term>
 589         <term><option>--grep=</option></term>
 590
 591         <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname>
 592         field matches the specified regular expression. PERL-compatible regular expressions
 593         are used, see
 594         <citerefentry><refentrytitle>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 595         for a detailed description of the syntax.</para>
 596
 597         <para>If the pattern is all lowercase, matching is case insensitive.
 598         Otherwise, matching is case sensitive. This can be overridden with the
 599         <option>--case-sensitive</option> option, see below.</para>
 600         </listitem>
 601       </varlistentry>
 602
 603       <varlistentry>
 604         <term><option>--case-sensitive<optional>=BOOLEAN</optional></option></term>
 605
 606         <listitem><para>Make pattern matching case sensitive or case insenstive.</para>
 607         </listitem>
 608       </varlistentry>
 609
 610       <varlistentry>
 611         <term><option>-c</option></term>
 612         <term><option>--cursor=</option></term>
 613
 614         <listitem><para>Start showing entries from the location in the
 615         journal specified by the passed cursor.</para></listitem>
 616       </varlistentry>
 617
 618       <varlistentry>
 619         <term><option>--cursor-file=<replaceable>FILE</replaceable></option></term>
 620
 621         <listitem><para>If <replaceable>FILE</replaceable> exists and contains a
 622         cursor, start showing entries <emphasis>after</emphasis> this location.
 623         Otherwise the show entries according the other given options. At the end,
 624         write the cursor of the last entry to <replaceable>FILE</replaceable>. Use
 625         this option to continually read the journal by sequentially calling
 626         <command>journalctl</command>.</para></listitem>
 627       </varlistentry>
 628
 629       <varlistentry>
 630         <term><option>--after-cursor=</option></term>
 631
 632         <listitem><para>Start showing entries from the location in the
 633         journal <emphasis>after</emphasis> the location specified by
 634         the passed cursor.  The cursor is shown when the
 635         <option>--show-cursor</option> option is used.</para>
 636         </listitem>
 637       </varlistentry>
 638
 639       <varlistentry>
 640         <term><option>--show-cursor</option></term>
 641
 642         <listitem><para>The cursor is shown after the last entry after
 643         two dashes:</para>
 644         <programlisting>-- cursor: s=0639…</programlisting>
 645         <para>The format of the cursor is private
 646         and subject to change.</para></listitem>
 647       </varlistentry>
 648
 649       <varlistentry>
 650         <term><option>-S</option></term>
 651         <term><option>--since=</option></term>
 652         <term><option>-U</option></term>
 653         <term><option>--until=</option></term>
 654
 655         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 656         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 657         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 658         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 659         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 660         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 661         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 662         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 663         time, respectively. For complete time and date specification, see
 664         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 665         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 666         </para>
 667         </listitem>
 668       </varlistentry>
 669
 670       <varlistentry>
 671         <term><option>-F</option></term>
 672         <term><option>--field=</option></term>
 673
 674         <listitem><para>Print all possible data values the specified
 675         field can take in all entries of the journal.</para></listitem>
 676       </varlistentry>
 677
 678       <varlistentry>
 679         <term><option>-N</option></term>
 680         <term><option>--fields</option></term>
 681
 682         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 683       </varlistentry>
 684
 685       <varlistentry>
 686         <term><option>--system</option></term>
 687         <term><option>--user</option></term>
 688
 689         <listitem><para>Show messages from system services and the
 690         kernel (with <option>--system</option>). Show messages from
 691         service of current user (with <option>--user</option>).  If
 692         neither is specified, show all messages that the user can see.
 693         </para></listitem>
 694       </varlistentry>
 695
 696       <varlistentry>
 697         <term><option>-M</option></term>
 698         <term><option>--machine=</option></term>
 699
 700         <listitem><para>Show messages from a running, local
 701         container. Specify a container name to connect to.</para>
 702         </listitem>
 703       </varlistentry>
 704
 705       <varlistentry>
 706         <term><option>-D <replaceable>DIR</replaceable></option></term>
 707         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 708
 709         <listitem><para>Takes a directory path as argument. If
 710         specified, journalctl will operate on the specified journal
 711         directory <replaceable>DIR</replaceable> instead of the
 712         default runtime and system journal paths.</para></listitem>
 713       </varlistentry>
 714
 715       <varlistentry>
 716         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 717
 718         <listitem><para>Takes a file glob as an argument. If
 719         specified, journalctl will operate on the specified journal
 720         files matching <replaceable>GLOB</replaceable> instead of the
 721         default runtime and system journal paths. May be specified
 722         multiple times, in which case files will be suitably
 723         interleaved.</para></listitem>
 724       </varlistentry>
 725
 726       <varlistentry>
 727         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 728
 729         <listitem><para>Takes a directory path as an argument. If
 730         specified, journalctl will operate on journal directories and catalog file hierarchy
 731         underneath the specified directory instead of the root
 732         directory (e.g. <option>--update-catalog</option> will create
 733         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 734         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 735         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 736         </para></listitem>
 737       </varlistentry>
 738
 739       <varlistentry>
 740         <term><option>--header</option></term>
 741
 742         <listitem><para>Instead of showing journal contents, show
 743         internal header information of the journal fields
 744         accessed.</para></listitem>
 745       </varlistentry>
 746
 747       <varlistentry>
 748         <term><option>--disk-usage</option></term>
 749
 750         <listitem><para>Shows the current disk usage of all journal
 751         files. This shows the sum of the disk usage of all archived
 752         and active journal files.</para></listitem>
 753       </varlistentry>
 754
 755       <varlistentry>
 756         <term><option>--vacuum-size=</option></term>
 757         <term><option>--vacuum-time=</option></term>
 758         <term><option>--vacuum-files=</option></term>
 759
 760         <listitem><para>Removes the oldest archived journal files until the disk space they use falls below the
 761         specified size (specified with the usual <literal>K</literal>, <literal>M</literal>, <literal>G</literal> and
 762         <literal>T</literal> suffixes), or all archived journal files contain no data older than the specified timespan
 763         (specified with the usual <literal>s</literal>, <literal>m</literal>, <literal>h</literal>,
 764         <literal>days</literal>, <literal>months</literal>, <literal>weeks</literal> and <literal>years</literal>
 765         suffixes), or no more than the specified number of separate journal files remain. Note that running
 766         <option>--vacuum-size=</option> has only an indirect effect on the output shown by
 767         <option>--disk-usage</option>, as the latter includes active journal files, while the vacuuming operation only
 768         operates on archived journal files. Similarly, <option>--vacuum-files=</option> might not actually reduce the
 769         number of journal files to below the specified number, as it will not remove active journal
 770         files.</para>
 771
 772         <para><option>--vacuum-size=</option>, <option>--vacuum-time=</option> and <option>--vacuum-files=</option>
 773         may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit
 774         on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing
 775         the specific limit, and is thus redundant.</para>
 776
 777         <para>These three switches may also be combined with <option>--rotate</option> into one command. If so, all
 778         active files are rotated first, and the requested vacuuming operation is executed right after. The rotation has
 779         the effect that all currently active files are archived (and potentially new, empty journal files opened as
 780         replacement), and hence the vacuuming operation has the greatest effect as it can take all log data written so
 781         far into account.</para></listitem>
 782       </varlistentry>
 783
 784       <varlistentry>
 785         <term><option>--list-catalog
 786         <optional><replaceable>128-bit-ID…</replaceable></optional>
 787         </option></term>
 788
 789         <listitem><para>List the contents of the message catalog as a
 790         table of message IDs, plus their short description strings.
 791         </para>
 792
 793         <para>If any <replaceable>128-bit-ID</replaceable>s are
 794         specified, only those entries are shown.</para>
 795         </listitem>
 796       </varlistentry>
 797
 798       <varlistentry>
 799         <term><option>--dump-catalog
 800         <optional><replaceable>128-bit-ID…</replaceable></optional>
 801         </option></term>
 802
 803         <listitem><para>Show the contents of the message catalog, with
 804         entries separated by a line consisting of two dashes and the
 805         ID (the format is the same as <filename>.catalog</filename>
 806         files).</para>
 807
 808         <para>If any <replaceable>128-bit-ID</replaceable>s are
 809         specified, only those entries are shown.</para>
 810         </listitem>
 811       </varlistentry>
 812
 813       <varlistentry>
 814         <term><option>--update-catalog</option></term>
 815
 816         <listitem><para>Update the message catalog index. This command
 817         needs to be executed each time new catalog files are
 818         installed, removed, or updated to rebuild the binary catalog
 819         index.</para></listitem>
 820       </varlistentry>
 821
 822       <varlistentry>
 823         <term><option>--setup-keys</option></term>
 824
 825         <listitem><para>Instead of showing journal contents, generate
 826         a new key pair for Forward Secure Sealing (FSS). This will
 827         generate a sealing key and a verification key. The sealing key
 828         is stored in the journal data directory and shall remain on
 829         the host. The verification key should be stored
 830         externally. Refer to the <option>Seal=</option> option in
 831         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 832         for information on Forward Secure Sealing and for a link to a
 833         refereed scholarly paper detailing the cryptographic theory it
 834         is based on.</para></listitem>
 835       </varlistentry>
 836
 837       <varlistentry>
 838         <term><option>--force</option></term>
 839
 840         <listitem><para>When <option>--setup-keys</option> is passed
 841         and Forward Secure Sealing (FSS) has already been configured,
 842         recreate FSS keys.</para></listitem>
 843       </varlistentry>
 844
 845       <varlistentry>
 846         <term><option>--interval=</option></term>
 847
 848         <listitem><para>Specifies the change interval for the sealing
 849         key when generating an FSS key pair with
 850         <option>--setup-keys</option>. Shorter intervals increase CPU
 851         consumption but shorten the time range of undetectable journal
 852         alterations. Defaults to 15min.</para></listitem>
 853       </varlistentry>
 854
 855       <varlistentry>
 856         <term><option>--verify</option></term>
 857
 858         <listitem><para>Check the journal file for internal
 859         consistency. If the file has been generated with FSS enabled and
 860         the FSS verification key has been specified with
 861         <option>--verify-key=</option>, authenticity of the journal file
 862         is verified.</para></listitem>
 863       </varlistentry>
 864
 865       <varlistentry>
 866         <term><option>--verify-key=</option></term>
 867
 868         <listitem><para>Specifies the FSS verification key to use for
 869         the <option>--verify</option> operation.</para></listitem>
 870       </varlistentry>
 871
 872       <varlistentry>
 873         <term><option>--sync</option></term>
 874
 875         <listitem><para>Asks the journal daemon to write all yet
 876         unwritten journal data to the backing file system and
 877         synchronize all journals. This call does not return until the
 878         synchronization operation is complete. This command guarantees
 879         that any log messages written before its invocation are safely
 880         stored on disk at the time it returns.</para></listitem>
 881       </varlistentry>
 882
 883       <varlistentry>
 884         <term><option>--flush</option></term>
 885
 886         <listitem><para>Asks the journal daemon to flush any log data
 887         stored in <filename>/run/log/journal</filename> into
 888         <filename>/var/log/journal</filename>, if persistent storage
 889         is enabled. This call does not return until the operation is
 890         complete. Note that this call is idempotent: the data is only
 891         flushed from <filename>/run/log/journal</filename> into
 892         <filename>/var/log/journal</filename> once during system
 893         runtime, and this command exits cleanly without executing any
 894         operation if this has already happened. This command
 895         effectively guarantees that all data is flushed to
 896         <filename>/var/log/journal</filename> at the time it
 897         returns.</para></listitem>
 898       </varlistentry>
 899
 900       <varlistentry>
 901         <term><option>--rotate</option></term>
 902
 903         <listitem><para>Asks the journal daemon to rotate journal files. This call does not return until the rotation
 904         operation is complete. Journal file rotation has the effect that all currently active journal files are marked
 905         as archived and renamed, so that they are never written to in future. New (empty) journal files are then
 906         created in their place. This operation may be combined with <option>--vacuum-size=</option>,
 907         <option>--vacuum-time=</option> and <option>--vacuum-file=</option> into a single command, see
 908         above.</para></listitem>
 909       </varlistentry>
 910
 911       <xi:include href="standard-options.xml" xpointer="help" />
 912       <xi:include href="standard-options.xml" xpointer="version" />
 913       <xi:include href="standard-options.xml" xpointer="no-pager" />
 914     </variablelist>
 915   </refsect1>
 916
 917   <refsect1>
 918     <title>Exit status</title>
 919
 920     <para>On success, 0 is returned; otherwise, a non-zero failure
 921     code is returned.</para>
 922   </refsect1>
 923
 924   <xi:include href="less-variables.xml" />
 925
 926   <refsect1>
 927     <title>Examples</title>
 928
 929     <para>Without arguments, all collected logs are shown
 930     unfiltered:</para>
 931
 932     <programlisting>journalctl</programlisting>
 933
 934     <para>With one match specified, all entries with a field matching
 935     the expression are shown:</para>
 936
 937     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service
 938 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting>
 939
 940     <para>If two different fields are matched, only entries matching
 941     both expressions at the same time are shown:</para>
 942
 943     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 944
 945     <para>If two matches refer to the same field, all entries matching
 946     either expression are shown:</para>
 947
 948     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 949
 950     <para>If the separator <literal>+</literal> is used, two
 951     expressions may be combined in a logical OR. The following will
 952     show all messages from the Avahi service process with the PID
 953     28097 plus all messages from the D-Bus service (from any of its
 954     processes):</para>
 955
 956     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 957
 958     <para>To show all fields emitted <emphasis>by</emphasis> a unit and <emphasis>about</emphasis>
 959     the unit, option <option>-u</option>/<option>--unit=</option> should be used.
 960     <command>journalctl -u <replaceable>name</replaceable></command>
 961     expands to a complex filter similar to
 962     <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service
 963   + UNIT=<replaceable>name</replaceable>.service _PID=1
 964   + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0
 965   + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
 966     </programlisting>
 967     (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 968     for an explanation of those patterns).
 969     </para>
 970
 971     <para>Show all logs generated by the D-Bus executable:</para>
 972
 973     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 974
 975     <para>Show all kernel logs from previous boot:</para>
 976
 977     <programlisting>journalctl -k -b -1</programlisting>
 978
 979     <para>Show a live log display from a system service
 980     <filename>apache.service</filename>:</para>
 981
 982     <programlisting>journalctl -f -u apache</programlisting>
 983
 984   </refsect1>
 985
 986   <refsect1>
 987     <title>See Also</title>
 988     <para>
 989       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 990       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 991       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 992       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 993       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 994       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 995       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 996       <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 997       <citerefentry><refentrytitle>systemd-journal-upload.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 998     </para>
 999   </refsect1>
1000 </refentry>