<!--
SPDX-License-Identifier: LGPL-2.1+
-
- This file is part of systemd.
-
- Copyright 2012 Lennart Poettering
-
- systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU Lesser General Public License as published by
- the Free Software Foundation; either version 2.1 of the License, or
- (at your option) any later version.
-
- systemd is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- Lesser General Public License for more details.
-
- You should have received a copy of the GNU Lesser General Public License
- along with systemd; If not, see <http://www.gnu.org/licenses/>.
-->
<refentry id="journalctl"
<refentryinfo>
<title>journalctl</title>
<productname>systemd</productname>
-
- <authorgroup>
- <author>
- <contrib>Developer</contrib>
- <firstname>Lennart</firstname>
- <surname>Poettering</surname>
- <email>lennart@poettering.net</email>
- </author>
- </authorgroup>
</refentryinfo>
<refmeta>
<para>When outputting to a tty, lines are colored according to
priority: lines of level ERROR and higher are colored red; lines
- of level NOTICE and higher are highlighted; other lines are
- displayed normally.</para>
+ of level NOTICE and higher are highlighted; lines of level DEBUG
+ are colored lighter grey; other lines are displayed normally.</para>
</refsect1>
<refsect1>
<term><option>-a</option></term>
<term><option>--all</option></term>
- <listitem><para>Show all fields in full, even if they
- include unprintable characters or are very
- long.</para></listitem>
+ <listitem><para>Show all fields in full, even if they include unprintable characters or are very long. By
+ default, fields with unprintable characters are abbreviated as "blob data". (Note that the pager may escape
+ unprintable characters again.)</para></listitem>
</varlistentry>
<varlistentry>
<option>json</option>
</term>
<listitem>
- <para>formats entries as JSON data structures, one per
- line (see
- <ulink url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink>
- for more information).</para>
+ <para>formats entries as JSON objects, separated by newline characters (see <ulink
+ url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink> for more
+ information). Field values are generally encoded as JSON strings, with three exceptions:
+ <orderedlist>
+ <listitem><para>Fields larger than 4096 bytes are encoded as <constant>null</constant> values. (This
+ may be turned off by passing <option>--all</option>, but be aware that this may allocate overly long
+ JSON objects.) </para></listitem>
+
+ <listitem><para>Journal entries permit non-unique fields within the same log entry. JSON does not allow
+ non-unique fields within objects. Due to this, if a non-unique field is encountered a JSON array is
+ used as field value, listing all field values as elements.</para></listitem>
+
+ <listitem><para>Fields containing non-printable or non-UTF8 bytes are encoded as arrays containing
+ the raw bytes individually formatted as unsigned numbers.</para></listitem>
+ </orderedlist>
+
+ Note that this encoding is reversible (with the exception of the size limit).</para>
</listitem>
</varlistentry>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>
+ <option>json-seq</option>
+ </term>
+ <listitem>
+ <para>formats entries as JSON data structures, but prefixes them with an ASCII Record Separator
+ character (0x1E) and suffixes them with an ASCII Line Feed character (0x0A), in accordance with <ulink
+ url="https://tools.ietf.org/html/rfc7464">JavaScript Object Notation (JSON) Text Sequences </ulink>
+ (<literal>application/json-seq</literal>).
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term>
<option>cat</option>
not even a timestamp.</para>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term>
+ <option>with-unit</option>
+ </term>
+ <listitem>
+ <para>similar to short-full, but prefixes the unit and
+ user unit names instead of the traditional syslog
+ identifier. Useful when using templated instances, as it
+ will include the arguments in the unit names.</para>
+ </listitem>
+ </varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--output-fields=</option></term>
- <listitem><para>A comma separated list of the fields which should
- be included in the output. This only has an effect for the output modes
- which would normally show all fields (<option>verbose</option>,
- <option>export</option>, <option>json</option>,
- <option>json-pretty</option>, and <option>json-sse</option>). The
- <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
- <literal>__MONOTONIC_TIMESTAMP</literal>, and
- <literal>_BOOT_ID</literal> fields are always
+ <listitem><para>A comma separated list of the fields which should be included in the output. This only has an
+ effect for the output modes which would normally show all fields (<option>verbose</option>,
+ <option>export</option>, <option>json</option>, <option>json-pretty</option>, <option>json-sse</option> and
+ <option>json-seq</option>). The <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
+ <literal>__MONOTONIC_TIMESTAMP</literal>, and <literal>_BOOT_ID</literal> fields are always
printed.</para></listitem>
</varlistentry>
</para></listitem>
</varlistentry>
- <varlistentry>
- <term><option>--new-id128</option></term>
-
- <listitem><para>Instead of showing journal contents, generate
- a new 128-bit ID suitable for identifying messages. This is
- intended for usage by developers who need a new identifier for
- a new message they introduce and want to make
- recognizable. This will print the new ID in four different
- formats which can be copied into source code or similar.
- </para></listitem>
- </varlistentry>
-
<varlistentry>
<term><option>--header</option></term>
<term><option>--vacuum-time=</option></term>
<term><option>--vacuum-files=</option></term>
- <listitem><para>Removes archived journal files until the disk
- space they use falls below the specified size (specified with
- the usual <literal>K</literal>, <literal>M</literal>,
- <literal>G</literal> and <literal>T</literal> suffixes), or all
- archived journal files contain no data older than the specified
- timespan (specified with the usual <literal>s</literal>,
- <literal>m</literal>, <literal>h</literal>,
- <literal>days</literal>, <literal>months</literal>,
- <literal>weeks</literal> and <literal>years</literal> suffixes),
- or no more than the specified number of separate journal files
- remain. Note that running <option>--vacuum-size=</option> has
- only an indirect effect on the output shown by
- <option>--disk-usage</option>, as the latter includes active
- journal files, while the vacuuming operation only operates
- on archived journal files. Similarly,
- <option>--vacuum-files=</option> might not actually reduce the
- number of journal files to below the specified number, as it
- will not remove active journal
- files. <option>--vacuum-size=</option>,
- <option>--vacuum-time=</option> and
- <option>--vacuum-files=</option> may be combined in a single
- invocation to enforce any combination of a size, a time and a
- number of files limit on the archived journal
- files. Specifying any of these three parameters as zero is
- equivalent to not enforcing the specific limit, and is thus
- redundant.</para></listitem>
+ <listitem><para>Removes the oldest archived journal files until the disk space they use falls below the
+ specified size (specified with the usual <literal>K</literal>, <literal>M</literal>, <literal>G</literal> and
+ <literal>T</literal> suffixes), or all archived journal files contain no data older than the specified timespan
+ (specified with the usual <literal>s</literal>, <literal>m</literal>, <literal>h</literal>,
+ <literal>days</literal>, <literal>months</literal>, <literal>weeks</literal> and <literal>years</literal>
+ suffixes), or no more than the specified number of separate journal files remain. Note that running
+ <option>--vacuum-size=</option> has only an indirect effect on the output shown by
+ <option>--disk-usage</option>, as the latter includes active journal files, while the vacuuming operation only
+ operates on archived journal files. Similarly, <option>--vacuum-files=</option> might not actually reduce the
+ number of journal files to below the specified number, as it will not remove active journal
+ files.</para>
+
+ <para><option>--vacuum-size=</option>, <option>--vacuum-time=</option> and <option>--vacuum-files=</option>
+ may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit
+ on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing
+ the specific limit, and is thus redundant.</para>
+
+ <para>These three switches may also be combined with <option>--rotate</option> into one command. If so, all
+ active files are rotated first, and the requested vacuuming operation is executed right after. The rotation has
+ the effect that all currently active files are archived (and potentially new, empty journal files opened as
+ replacement), and hence the vacuuming operation has the greatest effect as it can take all log data written so
+ far into account.</para></listitem>
</varlistentry>
<varlistentry>
<varlistentry>
<term><option>--rotate</option></term>
- <listitem><para>Asks the journal daemon to rotate journal
- files. This call does not return until the rotation operation
- is complete.</para></listitem>
+ <listitem><para>Asks the journal daemon to rotate journal files. This call does not return until the rotation
+ operation is complete. Journal file rotation has the effect that all currently active journal files are marked
+ as archived and renamed, so that they are never written to in future. New (empty) journal files are then
+ created in their place. This operation may be combined with <option>--vacuum-size=</option>,
+ <option>--vacuum-time=</option> and <option>--vacuum-file=</option> into a single command, see
+ above.</para></listitem>
</varlistentry>
<xi:include href="standard-options.xml" xpointer="help" />
<para>With one match specified, all entries with a field matching
the expression are shown:</para>
- <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
+ <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service
+journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting>
<para>If two different fields are matched, only entries matching
both expressions at the same time are shown:</para>
<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
+ <para>To show all fields emitted <emphasis>by</emphasis> a unit and <emphasis>about</emphasis>
+ the unit, option <option>-u</option>/<option>--unit=</option> should be used.
+ <command>journalctl -u <replaceable>name</replaceable></command>
+ expands to a complex filter similar to
+ <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service
+ + UNIT=<replaceable>name</replaceable>.service _PID=1
+ + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0
+ + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
+ </programlisting>
+ (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ for an explanation of those patterns).
+ </para>
+
<para>Show all logs generated by the D-Bus executable:</para>
<programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
<citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
- <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
- <citerefentry><refentrytitle>systemd-journal-upload</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-journal-upload.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
</para>
</refsect1>
</refentry>
projects / thirdparty / systemd.git / blobdiff