man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   5
   6   <refentry id="journalctl"
   7             xmlns:xi="http://www.w3.org/2001/XInclude">
   8
   9     <refentryinfo>
  10       <title>journalctl</title>
  11       <productname>systemd</productname>
  12     </refentryinfo>
  13
  14     <refmeta>
  15       <refentrytitle>journalctl</refentrytitle>
  16       <manvolnum>1</manvolnum>
  17     </refmeta>
  18
  19     <refnamediv>
  20       <refname>journalctl</refname>
  21       <refpurpose>Query the systemd journal</refpurpose>
  22     </refnamediv>
  23
  24     <refsynopsisdiv>
  25       <cmdsynopsis>
  26         <command>journalctl</command>
  27         <arg choice="opt" rep="repeat">OPTIONS</arg>
  28         <arg choice="opt" rep="repeat">MATCHES</arg>
  29       </cmdsynopsis>
  30     </refsynopsisdiv>
  31
  32     <refsect1>
  33       <title>Description</title>
  34
  35       <para><command>journalctl</command> may be used to query the
  36       contents of the
  37       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  38       journal as written by
  39       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  40
  41       <para>If called without parameters, it will show the full
  42       contents of the journal, starting with the oldest entry
  43       collected.</para>
  44
  45       <para>If one or more match arguments are passed, the output is
  46       filtered accordingly. A match is in the format
  47       <literal>FIELD=VALUE</literal>,
  48       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  49       to the components of a structured journal entry. See
  50       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  51       for a list of well-known fields. If multiple matches are
  52       specified matching different fields, the log entries are
  53       filtered by both, i.e. the resulting output will show only
  54       entries matching all the specified matches of this kind. If two
  55       matches apply to the same field, then they are automatically
  56       matched as alternatives, i.e. the resulting output will show
  57       entries matching any of the specified matches for the same
  58       field. Finally, the character <literal>+</literal> may appear
  59       as a separate word between other terms on the command line. This
  60       causes all matches before and after to be combined in a
  61       disjunction (i.e. logical OR).</para>
  62
  63       <para>It is also possible to filter the entries by specifying an
  64       absolute file path as an argument. The file path may be a file or
  65       a symbolic link and the file must exist at the time of the query. If a
  66       file path refers to an executable binary, an <literal>_EXE=</literal>
  67       match for the canonicalized binary path is added to the query. If a
  68       file path refers to an executable script, a <literal>_COMM=</literal>
  69       match for the script name is added to the query. If a file path
  70       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
  71       the kernel name of the device and for each of its ancestor devices is
  72       added to the query. Symbolic links are dereferenced, kernel names are
  73       synthesized, and parent devices are identified from the environment at
  74       the time of the query. In general, a device node is the best proxy for
  75       an actual device, as log entries do not usually contain fields that
  76       identify an actual device. For the resulting log entries to be correct
  77       for the actual device, the relevant parts of the environment at the time
  78       the entry was logged, in particular the actual device corresponding to
  79       the device node, must have been the same as those at the time of the
  80       query. Because device nodes generally change their corresponding devices
  81       across reboots, specifying a device node path causes the resulting
  82       entries to be restricted to those from the current boot.</para>
  83
  84       <para>Additional constraints may be added using options
  85       <option>--boot</option>, <option>--unit=</option>, etc., to
  86       further limit what entries will be shown (logical AND).</para>
  87
  88       <para>Output is interleaved from all accessible journal files,
  89       whether they are rotated or currently being written, and
  90       regardless of whether they belong to the system itself or are
  91       accessible user journals.</para>
  92
  93       <para>The set of journal files which will be used can be
  94       modified using the <option>--user</option>,
  95       <option>--system</option>, <option>--directory</option>, and
  96       <option>--file</option> options, see below.</para>
  97
  98       <para>All users are granted access to their private per-user
  99       journals. However, by default, only root and users who are
 100       members of a few special groups are granted access to the system
 101       journal and the journals of other users. Members of the groups
 102       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 103       <literal>wheel</literal> can read all journal files. Note
 104       that the two latter groups traditionally have additional
 105       privileges specified by the distribution. Members of the
 106       <literal>wheel</literal> group can often perform administrative
 107       tasks.</para>
 108
 109       <para>The output is paged through <command>less</command> by
 110       default, and long lines are "truncated" to screen width. The
 111       hidden part can be viewed by using the left-arrow and
 112       right-arrow keys. Paging can be disabled; see the
 113       <option>--no-pager</option> option and the "Environment" section
 114       below.</para>
 115
 116       <para>When outputting to a tty, lines are colored according to
 117       priority: lines of level ERROR and higher are colored red; lines
 118       of level NOTICE and higher are highlighted; lines of level DEBUG
 119       are colored lighter grey; other lines are displayed normally.</para>
 120     </refsect1>
 121
 122     <refsect1>
 123       <title>Options</title>
 124
 125       <para>The following options are understood:</para>
 126
 127       <variablelist>
 128         <varlistentry>
 129           <term><option>--no-full</option></term>
 130           <term><option>--full</option></term>
 131           <term><option>-l</option></term>
 132
 133           <listitem><para>Ellipsize fields when they do not fit in
 134           available columns.  The default is to show full fields,
 135           allowing them to wrap or be truncated by the pager, if one
 136           is used.</para>
 137
 138           <para>The old options
 139           <option>-l</option>/<option>--full</option> are not useful
 140           anymore, except to undo <option>--no-full</option>.</para>
 141           </listitem>
 142         </varlistentry>
 143
 144         <varlistentry>
 145           <term><option>-a</option></term>
 146           <term><option>--all</option></term>
 147
 148           <listitem><para>Show all fields in full, even if they include unprintable characters or are very long. By
 149           default, fields with unprintable characters are abbreviated as "blob data". (Note that the pager may escape
 150           unprintable characters again.)</para></listitem>
 151         </varlistentry>
 152
 153         <varlistentry>
 154           <term><option>-f</option></term>
 155           <term><option>--follow</option></term>
 156
 157           <listitem><para>Show only the most recent journal entries,
 158           and continuously print new entries as they are appended to
 159           the journal.</para></listitem>
 160         </varlistentry>
 161
 162         <varlistentry>
 163           <term><option>-e</option></term>
 164           <term><option>--pager-end</option></term>
 165
 166           <listitem><para>Immediately jump to the end of the journal
 167           inside the implied pager tool. This implies
 168           <option>-n1000</option> to guarantee that the pager will not
 169           buffer logs of unbounded size. This may be overridden with
 170           an explicit <option>-n</option> with some other numeric
 171           value, while <option>-nall</option> will disable this cap.
 172           Note that this option is only supported for the
 173           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 174           pager.</para></listitem>
 175         </varlistentry>
 176
 177         <varlistentry>
 178           <term><option>-n</option></term>
 179           <term><option>--lines=</option></term>
 180
 181           <listitem><para>Show the most recent journal events and
 182           limit the number of events shown. If
 183           <option>--follow</option> is used, this option is
 184           implied. The argument is a positive integer or
 185           <literal>all</literal> to disable line limiting. The default
 186           value is 10 if no argument is given.</para></listitem>
 187         </varlistentry>
 188
 189         <varlistentry>
 190           <term><option>--no-tail</option></term>
 191
 192           <listitem><para>Show all stored output lines, even in follow
 193           mode. Undoes the effect of <option>--lines=</option>.
 194           </para></listitem>
 195         </varlistentry>
 196
 197         <varlistentry>
 198           <term><option>-r</option></term>
 199           <term><option>--reverse</option></term>
 200
 201           <listitem><para>Reverse output so that the newest entries
 202           are displayed first.</para></listitem>
 203         </varlistentry>
 204
 205         <varlistentry>
 206           <term><option>-o</option></term>
 207           <term><option>--output=</option></term>
 208
 209           <listitem><para>Controls the formatting of the journal
 210           entries that are shown. Takes one of the following
 211           options:</para>
 212           <variablelist>
 213             <varlistentry>
 214               <term>
 215                 <option>short</option>
 216               </term>
 217               <listitem>
 218                 <para>is the default and generates an output that is
 219                 mostly identical to the formatting of classic syslog
 220                 files, showing one line per journal entry.</para>
 221               </listitem>
 222             </varlistentry>
 223
 224             <varlistentry>
 225               <term>
 226                 <option>short-full</option>
 227               </term>
 228               <listitem>
 229                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 230                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 231                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 232                 output, and is locale-independent.</para>
 233               </listitem>
 234             </varlistentry>
 235
 236             <varlistentry>
 237               <term>
 238                 <option>short-iso</option>
 239               </term>
 240               <listitem>
 241                 <para>is very similar, but shows ISO 8601 wallclock
 242                 timestamps.</para>
 243               </listitem>
 244             </varlistentry>
 245
 246             <varlistentry>
 247               <term>
 248                 <option>short-iso-precise</option>
 249               </term>
 250               <listitem>
 251                 <para>as for <option>short-iso</option> but includes full
 252                 microsecond precision.</para>
 253               </listitem>
 254             </varlistentry>
 255
 256             <varlistentry>
 257               <term>
 258                 <option>short-precise</option>
 259               </term>
 260               <listitem>
 261                 <para>is very similar, but shows classic syslog timestamps
 262                 with full microsecond precision.</para>
 263               </listitem>
 264             </varlistentry>
 265
 266             <varlistentry>
 267               <term>
 268                 <option>short-monotonic</option>
 269               </term>
 270               <listitem>
 271                 <para>is very similar, but shows monotonic timestamps
 272                 instead of wallclock timestamps.</para>
 273               </listitem>
 274             </varlistentry>
 275
 276             <varlistentry>
 277               <term>
 278                 <option>short-unix</option>
 279               </term>
 280               <listitem>
 281                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 282                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 283               </listitem>
 284             </varlistentry>
 285
 286             <varlistentry>
 287               <term>
 288                 <option>verbose</option>
 289               </term>
 290               <listitem>
 291                 <para>shows the full-structured entry items with all
 292                 fields.</para>
 293               </listitem>
 294             </varlistentry>
 295
 296             <varlistentry>
 297               <term>
 298                 <option>export</option>
 299               </term>
 300               <listitem>
 301                 <para>serializes the journal into a binary (but mostly
 302                 text-based) stream suitable for backups and network
 303                 transfer (see
 304                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 305                 for more information). To import the binary stream back
 306                 into native journald format use
 307                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 308               </listitem>
 309             </varlistentry>
 310
 311             <varlistentry>
 312               <term>
 313                 <option>json</option>
 314               </term>
 315               <listitem>
 316                 <para>formats entries as JSON objects, separated by newline characters (see <ulink
 317                 url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink> for more
 318                 information). Field values are generally encoded as JSON strings, with three exceptions:
 319                 <orderedlist>
 320                   <listitem><para>Fields larger than 4096 bytes are encoded as <constant>null</constant> values. (This
 321                   may be turned off by passing <option>--all</option>, but be aware that this may allocate overly long
 322                   JSON objects.) </para></listitem>
 323
 324                   <listitem><para>Journal entries permit non-unique fields within the same log entry. JSON does not allow
 325                   non-unique fields within objects. Due to this, if a non-unique field is encountered a JSON array is
 326                   used as field value, listing all field values as elements.</para></listitem>
 327
 328                   <listitem><para>Fields containing non-printable or non-UTF8 bytes are encoded as arrays containing
 329                   the raw bytes individually formatted as unsigned numbers.</para></listitem>
 330                 </orderedlist>
 331
 332                 Note that this encoding is reversible (with the exception of the size limit).</para>
 333               </listitem>
 334             </varlistentry>
 335
 336             <varlistentry>
 337               <term>
 338                 <option>json-pretty</option>
 339               </term>
 340               <listitem>
 341                 <para>formats entries as JSON data structures, but
 342                 formats them in multiple lines in order to make them
 343                 more readable by humans.</para>
 344               </listitem>
 345             </varlistentry>
 346
 347             <varlistentry>
 348               <term>
 349                 <option>json-sse</option>
 350               </term>
 351               <listitem>
 352                 <para>formats entries as JSON data structures, but wraps
 353                 them in a format suitable for
 354                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 355                 </para>
 356               </listitem>
 357             </varlistentry>
 358
 359             <varlistentry>
 360               <term>
 361                 <option>json-seq</option>
 362               </term>
 363               <listitem>
 364                 <para>formats entries as JSON data structures, but prefixes them with an ASCII Record Separator
 365                 character (0x1E) and suffixes them with an ASCII Line Feed character (0x0A), in accordance with <ulink
 366                 url="https://tools.ietf.org/html/rfc7464">JavaScript Object Notation (JSON) Text Sequences </ulink>
 367                 (<literal>application/json-seq</literal>).
 368                 </para>
 369               </listitem>
 370             </varlistentry>
 371
 372             <varlistentry>
 373               <term>
 374                 <option>cat</option>
 375               </term>
 376               <listitem>
 377                 <para>generates a very terse output, only showing the
 378                 actual message of each journal entry with no metadata,
 379                 not even a timestamp.</para>
 380               </listitem>
 381             </varlistentry>
 382
 383             <varlistentry>
 384               <term>
 385                 <option>with-unit</option>
 386               </term>
 387               <listitem>
 388                 <para>similar to short-full, but prefixes the unit and
 389                 user unit names instead of the traditional syslog
 390                 identifier. Useful when using templated instances, as it
 391                 will include the arguments in the unit names.</para>
 392               </listitem>
 393             </varlistentry>
 394           </variablelist>
 395         </listitem>
 396       </varlistentry>
 397
 398       <varlistentry>
 399         <term><option>--output-fields=</option></term>
 400
 401         <listitem><para>A comma separated list of the fields which should be included in the output. This only has an
 402         effect for the output modes which would normally show all fields (<option>verbose</option>,
 403         <option>export</option>, <option>json</option>, <option>json-pretty</option>, <option>json-sse</option> and
 404         <option>json-seq</option>). The <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 405         <literal>__MONOTONIC_TIMESTAMP</literal>, and <literal>_BOOT_ID</literal> fields are always
 406         printed.</para></listitem>
 407       </varlistentry>
 408
 409       <varlistentry>
 410         <term><option>--utc</option></term>
 411
 412         <listitem><para>Express time in Coordinated Universal Time
 413         (UTC).</para></listitem>
 414       </varlistentry>
 415
 416       <varlistentry>
 417         <term><option>--no-hostname</option></term>
 418
 419         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 420         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 421       </varlistentry>
 422
 423       <varlistentry>
 424         <term><option>-x</option></term>
 425         <term><option>--catalog</option></term>
 426
 427         <listitem><para>Augment log lines with explanation texts from
 428         the message catalog. This will add explanatory help texts to
 429         log messages in the output where this is available. These
 430         short help texts will explain the context of an error or log
 431         event, possible solutions, as well as pointers to support
 432         forums, developer documentation, and any other relevant
 433         manuals. Note that help texts are not available for all
 434         messages, but only for selected ones. For more information on
 435         the message catalog, please refer to the
 436         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 437
 438         <para>Note: when attaching <command>journalctl</command>
 439         output to bug reports, please do <emphasis>not</emphasis> use
 440         <option>-x</option>.</para>
 441         </listitem>
 442       </varlistentry>
 443
 444       <varlistentry>
 445         <term><option>-q</option></term>
 446         <term><option>--quiet</option></term>
 447
 448         <listitem><para>Suppresses all informational messages
 449         (i.e. "-- Logs begin at …", "-- Reboot --"),
 450         any warning messages regarding
 451         inaccessible system journals when run as a normal
 452         user.</para></listitem>
 453       </varlistentry>
 454
 455       <varlistentry>
 456         <term><option>-m</option></term>
 457         <term><option>--merge</option></term>
 458
 459         <listitem><para>Show entries interleaved from all available
 460         journals, including remote ones.</para></listitem>
 461       </varlistentry>
 462
 463       <varlistentry>
 464         <term><option>-b <optional><optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional>|<constant>all</constant></optional></option></term>
 465         <term><option>--boot<optional>=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional>|<constant>all</constant></optional></option></term>
 466
 467         <listitem><para>Show messages from a specific boot. This will
 468         add a match for <literal>_BOOT_ID=</literal>.</para>
 469
 470         <para>The argument may be empty, in which case logs for the
 471         current boot will be shown.</para>
 472
 473         <para>If the boot ID is omitted, a positive
 474         <replaceable>offset</replaceable> will look up the boots
 475         starting from the beginning of the journal, and an
 476         equal-or-less-than zero <replaceable>offset</replaceable> will
 477         look up boots starting from the end of the journal. Thus,
 478         <constant>1</constant> means the first boot found in the
 479         journal in chronological order, <constant>2</constant> the
 480         second and so on; while <constant>-0</constant> is the last
 481         boot, <constant>-1</constant> the boot before last, and so
 482         on. An empty <replaceable>offset</replaceable> is equivalent
 483         to specifying <constant>-0</constant>, except when the current
 484         boot is not the last boot (e.g. because
 485         <option>--directory</option> was specified to look at logs
 486         from a different machine).</para>
 487
 488         <para>If the 32-character <replaceable>ID</replaceable> is
 489         specified, it may optionally be followed by
 490         <replaceable>offset</replaceable> which identifies the boot
 491         relative to the one given by boot
 492         <replaceable>ID</replaceable>. Negative values mean earlier
 493         boots and positive values mean later boots. If
 494         <replaceable>offset</replaceable> is not specified, a value of
 495         zero is assumed, and the logs for the boot given by
 496         <replaceable>ID</replaceable> are shown.</para>
 497
 498         <para>The special argument <constant>all</constant> can be
 499         used to negate the effect of an earlier use of
 500         <option>-b</option>.</para>
 501         </listitem>
 502       </varlistentry>
 503
 504       <varlistentry>
 505         <term><option>--list-boots</option></term>
 506
 507         <listitem><para>Show a tabular list of boot numbers (relative to
 508         the current boot), their IDs, and the timestamps of the first
 509         and last message pertaining to the boot.</para></listitem>
 510       </varlistentry>
 511
 512       <varlistentry>
 513         <term><option>-k</option></term>
 514         <term><option>--dmesg</option></term>
 515
 516         <listitem><para>Show only kernel messages. This implies
 517         <option>-b</option> and adds the match
 518         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 519       </varlistentry>
 520
 521       <varlistentry>
 522         <term><option>-t</option></term>
 523         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 524
 525         <listitem><para>Show messages for the specified syslog
 526         identifier
 527         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 528
 529         <para>This parameter can be specified multiple
 530         times.</para></listitem>
 531       </varlistentry>
 532
 533       <varlistentry>
 534         <term><option>-u</option></term>
 535         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 536
 537         <listitem><para>Show messages for the specified systemd unit
 538         <replaceable>UNIT</replaceable> (such as a service unit), or
 539         for any of the units matched by
 540         <replaceable>PATTERN</replaceable>.  If a pattern is
 541         specified, a list of unit names found in the journal is
 542         compared with the specified pattern and all that match are
 543         used. For each unit name, a match is added for messages from
 544         the unit
 545         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 546         along with additional matches for messages from systemd and
 547         messages about coredumps for the specified unit.</para>
 548
 549         <para>This parameter can be specified multiple times.</para>
 550         </listitem>
 551       </varlistentry>
 552
 553       <varlistentry>
 554         <term><option>--user-unit=</option></term>
 555
 556         <listitem><para>Show messages for the specified user session
 557         unit. This will add a match for messages from the unit
 558         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 559         <literal>_UID=</literal>) and additional matches for messages
 560         from session systemd and messages about coredumps for the
 561         specified unit.</para>
 562
 563         <para>This parameter can be specified multiple times.</para>
 564         </listitem>
 565       </varlistentry>
 566
 567       <varlistentry>
 568         <term><option>-p</option></term>
 569         <term><option>--priority=</option></term>
 570
 571         <listitem><para>Filter output by message priorities or
 572         priority ranges. Takes either a single numeric or textual log
 573         level (i.e. between 0/<literal>emerg</literal> and
 574         7/<literal>debug</literal>), or a range of numeric/text log
 575         levels in the form FROM..TO. The log levels are the usual
 576         syslog log levels as documented in
 577         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 578         i.e. <literal>emerg</literal> (0),
 579         <literal>alert</literal> (1), <literal>crit</literal> (2),
 580         <literal>err</literal> (3), <literal>warning</literal> (4),
 581         <literal>notice</literal> (5), <literal>info</literal> (6),
 582         <literal>debug</literal> (7). If a single log level is
 583         specified, all messages with this log level or a lower (hence
 584         more important) log level are shown. If a range is specified,
 585         all messages within the range are shown, including both the
 586         start and the end value of the range. This will add
 587         <literal>PRIORITY=</literal> matches for the specified
 588         priorities.</para></listitem>
 589       </varlistentry>
 590
 591       <varlistentry>
 592         <term><option>-g</option></term>
 593         <term><option>--grep=</option></term>
 594
 595         <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname>
 596         field matches the specified regular expression. PERL-compatible regular expressions
 597         are used, see
 598         <citerefentry><refentrytitle>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 599         for a detailed description of the syntax.</para>
 600
 601         <para>If the pattern is all lowercase, matching is case insensitive.
 602         Otherwise, matching is case sensitive. This can be overridden with the
 603         <option>--case-sensitive</option> option, see below.</para>
 604         </listitem>
 605       </varlistentry>
 606
 607       <varlistentry>
 608         <term><option>--case-sensitive<optional>=BOOLEAN</optional></option></term>
 609
 610         <listitem><para>Make pattern matching case sensitive or case insenstive.</para>
 611         </listitem>
 612       </varlistentry>
 613
 614       <varlistentry>
 615         <term><option>-c</option></term>
 616         <term><option>--cursor=</option></term>
 617
 618         <listitem><para>Start showing entries from the location in the
 619         journal specified by the passed cursor.</para></listitem>
 620       </varlistentry>
 621
 622       <varlistentry>
 623         <term><option>--cursor-file=<replaceable>FILE</replaceable></option></term>
 624
 625         <listitem><para>If <replaceable>FILE</replaceable> exists and contains a
 626         cursor, start showing entries <emphasis>after</emphasis> this location.
 627         Otherwise the show entries according the other given options. At the end,
 628         write the cursor of the last entry to <replaceable>FILE</replaceable>. Use
 629         this option to continually read the journal by sequentially calling
 630         <command>journalctl</command>.</para></listitem>
 631       </varlistentry>
 632
 633       <varlistentry>
 634         <term><option>--after-cursor=</option></term>
 635
 636         <listitem><para>Start showing entries from the location in the
 637         journal <emphasis>after</emphasis> the location specified by
 638         the passed cursor.  The cursor is shown when the
 639         <option>--show-cursor</option> option is used.</para>
 640         </listitem>
 641       </varlistentry>
 642
 643       <varlistentry>
 644         <term><option>--show-cursor</option></term>
 645
 646         <listitem><para>The cursor is shown after the last entry after
 647         two dashes:</para>
 648         <programlisting>-- cursor: s=0639…</programlisting>
 649         <para>The format of the cursor is private
 650         and subject to change.</para></listitem>
 651       </varlistentry>
 652
 653       <varlistentry>
 654         <term><option>-S</option></term>
 655         <term><option>--since=</option></term>
 656         <term><option>-U</option></term>
 657         <term><option>--until=</option></term>
 658
 659         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 660         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 661         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 662         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 663         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 664         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 665         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 666         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 667         time, respectively. For complete time and date specification, see
 668         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 669         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 670         </para>
 671         </listitem>
 672       </varlistentry>
 673
 674       <varlistentry>
 675         <term><option>-F</option></term>
 676         <term><option>--field=</option></term>
 677
 678         <listitem><para>Print all possible data values the specified
 679         field can take in all entries of the journal.</para></listitem>
 680       </varlistentry>
 681
 682       <varlistentry>
 683         <term><option>-N</option></term>
 684         <term><option>--fields</option></term>
 685
 686         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 687       </varlistentry>
 688
 689       <varlistentry>
 690         <term><option>--system</option></term>
 691         <term><option>--user</option></term>
 692
 693         <listitem><para>Show messages from system services and the
 694         kernel (with <option>--system</option>). Show messages from
 695         service of current user (with <option>--user</option>).  If
 696         neither is specified, show all messages that the user can see.
 697         </para></listitem>
 698       </varlistentry>
 699
 700       <varlistentry>
 701         <term><option>-M</option></term>
 702         <term><option>--machine=</option></term>
 703
 704         <listitem><para>Show messages from a running, local
 705         container. Specify a container name to connect to.</para>
 706         </listitem>
 707       </varlistentry>
 708
 709       <varlistentry>
 710         <term><option>-D <replaceable>DIR</replaceable></option></term>
 711         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 712
 713         <listitem><para>Takes a directory path as argument. If
 714         specified, journalctl will operate on the specified journal
 715         directory <replaceable>DIR</replaceable> instead of the
 716         default runtime and system journal paths.</para></listitem>
 717       </varlistentry>
 718
 719       <varlistentry>
 720         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 721
 722         <listitem><para>Takes a file glob as an argument. If
 723         specified, journalctl will operate on the specified journal
 724         files matching <replaceable>GLOB</replaceable> instead of the
 725         default runtime and system journal paths. May be specified
 726         multiple times, in which case files will be suitably
 727         interleaved.</para></listitem>
 728       </varlistentry>
 729
 730       <varlistentry>
 731         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 732
 733         <listitem><para>Takes a directory path as an argument. If
 734         specified, journalctl will operate on journal directories and catalog file hierarchy
 735         underneath the specified directory instead of the root
 736         directory (e.g. <option>--update-catalog</option> will create
 737         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 738         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 739         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 740         </para></listitem>
 741       </varlistentry>
 742
 743       <varlistentry>
 744         <term><option>--header</option></term>
 745
 746         <listitem><para>Instead of showing journal contents, show
 747         internal header information of the journal fields
 748         accessed.</para></listitem>
 749       </varlistentry>
 750
 751       <varlistentry>
 752         <term><option>--disk-usage</option></term>
 753
 754         <listitem><para>Shows the current disk usage of all journal
 755         files. This shows the sum of the disk usage of all archived
 756         and active journal files.</para></listitem>
 757       </varlistentry>
 758
 759       <varlistentry>
 760         <term><option>--vacuum-size=</option></term>
 761         <term><option>--vacuum-time=</option></term>
 762         <term><option>--vacuum-files=</option></term>
 763
 764         <listitem><para>Removes the oldest archived journal files until the disk space they use falls below the
 765         specified size (specified with the usual <literal>K</literal>, <literal>M</literal>, <literal>G</literal> and
 766         <literal>T</literal> suffixes), or all archived journal files contain no data older than the specified timespan
 767         (specified with the usual <literal>s</literal>, <literal>m</literal>, <literal>h</literal>,
 768         <literal>days</literal>, <literal>months</literal>, <literal>weeks</literal> and <literal>years</literal>
 769         suffixes), or no more than the specified number of separate journal files remain. Note that running
 770         <option>--vacuum-size=</option> has only an indirect effect on the output shown by
 771         <option>--disk-usage</option>, as the latter includes active journal files, while the vacuuming operation only
 772         operates on archived journal files. Similarly, <option>--vacuum-files=</option> might not actually reduce the
 773         number of journal files to below the specified number, as it will not remove active journal
 774         files.</para>
 775
 776         <para><option>--vacuum-size=</option>, <option>--vacuum-time=</option> and <option>--vacuum-files=</option>
 777         may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit
 778         on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing
 779         the specific limit, and is thus redundant.</para>
 780
 781         <para>These three switches may also be combined with <option>--rotate</option> into one command. If so, all
 782         active files are rotated first, and the requested vacuuming operation is executed right after. The rotation has
 783         the effect that all currently active files are archived (and potentially new, empty journal files opened as
 784         replacement), and hence the vacuuming operation has the greatest effect as it can take all log data written so
 785         far into account.</para></listitem>
 786       </varlistentry>
 787
 788       <varlistentry>
 789         <term><option>--list-catalog
 790         <optional><replaceable>128-bit-ID…</replaceable></optional>
 791         </option></term>
 792
 793         <listitem><para>List the contents of the message catalog as a
 794         table of message IDs, plus their short description strings.
 795         </para>
 796
 797         <para>If any <replaceable>128-bit-ID</replaceable>s are
 798         specified, only those entries are shown.</para>
 799         </listitem>
 800       </varlistentry>
 801
 802       <varlistentry>
 803         <term><option>--dump-catalog
 804         <optional><replaceable>128-bit-ID…</replaceable></optional>
 805         </option></term>
 806
 807         <listitem><para>Show the contents of the message catalog, with
 808         entries separated by a line consisting of two dashes and the
 809         ID (the format is the same as <filename>.catalog</filename>
 810         files).</para>
 811
 812         <para>If any <replaceable>128-bit-ID</replaceable>s are
 813         specified, only those entries are shown.</para>
 814         </listitem>
 815       </varlistentry>
 816
 817       <varlistentry>
 818         <term><option>--update-catalog</option></term>
 819
 820         <listitem><para>Update the message catalog index. This command
 821         needs to be executed each time new catalog files are
 822         installed, removed, or updated to rebuild the binary catalog
 823         index.</para></listitem>
 824       </varlistentry>
 825
 826       <varlistentry>
 827         <term><option>--setup-keys</option></term>
 828
 829         <listitem><para>Instead of showing journal contents, generate
 830         a new key pair for Forward Secure Sealing (FSS). This will
 831         generate a sealing key and a verification key. The sealing key
 832         is stored in the journal data directory and shall remain on
 833         the host. The verification key should be stored
 834         externally. Refer to the <option>Seal=</option> option in
 835         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 836         for information on Forward Secure Sealing and for a link to a
 837         refereed scholarly paper detailing the cryptographic theory it
 838         is based on.</para></listitem>
 839       </varlistentry>
 840
 841       <varlistentry>
 842         <term><option>--force</option></term>
 843
 844         <listitem><para>When <option>--setup-keys</option> is passed
 845         and Forward Secure Sealing (FSS) has already been configured,
 846         recreate FSS keys.</para></listitem>
 847       </varlistentry>
 848
 849       <varlistentry>
 850         <term><option>--interval=</option></term>
 851
 852         <listitem><para>Specifies the change interval for the sealing
 853         key when generating an FSS key pair with
 854         <option>--setup-keys</option>. Shorter intervals increase CPU
 855         consumption but shorten the time range of undetectable journal
 856         alterations. Defaults to 15min.</para></listitem>
 857       </varlistentry>
 858
 859       <varlistentry>
 860         <term><option>--verify</option></term>
 861
 862         <listitem><para>Check the journal file for internal
 863         consistency. If the file has been generated with FSS enabled and
 864         the FSS verification key has been specified with
 865         <option>--verify-key=</option>, authenticity of the journal file
 866         is verified.</para></listitem>
 867       </varlistentry>
 868
 869       <varlistentry>
 870         <term><option>--verify-key=</option></term>
 871
 872         <listitem><para>Specifies the FSS verification key to use for
 873         the <option>--verify</option> operation.</para></listitem>
 874       </varlistentry>
 875
 876       <varlistentry>
 877         <term><option>--sync</option></term>
 878
 879         <listitem><para>Asks the journal daemon to write all yet
 880         unwritten journal data to the backing file system and
 881         synchronize all journals. This call does not return until the
 882         synchronization operation is complete. This command guarantees
 883         that any log messages written before its invocation are safely
 884         stored on disk at the time it returns.</para></listitem>
 885       </varlistentry>
 886
 887       <varlistentry>
 888         <term><option>--flush</option></term>
 889
 890         <listitem><para>Asks the journal daemon to flush any log data stored in
 891         <filename>/run/log/journal/</filename> into <filename>/var/log/journal/</filename>, if persistent
 892         storage is enabled. This call does not return until the operation is complete. Note that this call is
 893         idempotent: the data is only flushed from <filename>/run/log/journal/</filename> into
 894         <filename>/var/log/journal</filename> once during system runtime (but see
 895         <option>--relinquish-var</option> below), and this command exits cleanly without executing any
 896         operation if this has already happened. This command effectively guarantees that all data is flushed
 897         to <filename>/var/log/journal</filename> at the time it returns.</para></listitem>
 898       </varlistentry>
 899
 900       <varlistentry>
 901         <term><option>--relinquish-var</option></term>
 902
 903         <listitem><para>Asks the journal daemon for the reverse operation to <option>--flush</option>: if
 904         requested the daemon will write further log data to <filename>/run/log/journal/</filename> and stops
 905         writing to <filename>/var/log/journal/</filename>. A subsequent call to <option>--flush</option>
 906         causes the log output to switch back to <filename>/var/log/journal/</filename>, see
 907         above.</para></listitem>
 908       </varlistentry>
 909
 910       <varlistentry>
 911         <term><option>--smart-relinquish-var</option></term>
 912
 913         <listitem><para>Similar to <option>--relinquish-var</option> but executes no operation if the root file
 914         system and <filename>/var/lib/journal/</filename> reside on the same mount point. This operation is
 915         used during system shutdown in order to make the journal daemon stop writing data to
 916         <filename>/var/log/journal/</filename> in case that directory is located on a mount point that needs
 917         to be unmounted.</para></listitem>
 918       </varlistentry>
 919
 920       <varlistentry>
 921         <term><option>--rotate</option></term>
 922
 923         <listitem><para>Asks the journal daemon to rotate journal files. This call does not return until the rotation
 924         operation is complete. Journal file rotation has the effect that all currently active journal files are marked
 925         as archived and renamed, so that they are never written to in future. New (empty) journal files are then
 926         created in their place. This operation may be combined with <option>--vacuum-size=</option>,
 927         <option>--vacuum-time=</option> and <option>--vacuum-file=</option> into a single command, see
 928         above.</para></listitem>
 929       </varlistentry>
 930
 931       <xi:include href="standard-options.xml" xpointer="help" />
 932       <xi:include href="standard-options.xml" xpointer="version" />
 933       <xi:include href="standard-options.xml" xpointer="no-pager" />
 934     </variablelist>
 935   </refsect1>
 936
 937   <refsect1>
 938     <title>Exit status</title>
 939
 940     <para>On success, 0 is returned; otherwise, a non-zero failure
 941     code is returned.</para>
 942   </refsect1>
 943
 944   <xi:include href="less-variables.xml" />
 945
 946   <refsect1>
 947     <title>Examples</title>
 948
 949     <para>Without arguments, all collected logs are shown
 950     unfiltered:</para>
 951
 952     <programlisting>journalctl</programlisting>
 953
 954     <para>With one match specified, all entries with a field matching
 955     the expression are shown:</para>
 956
 957     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service
 958 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting>
 959
 960     <para>If two different fields are matched, only entries matching
 961     both expressions at the same time are shown:</para>
 962
 963     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 964
 965     <para>If two matches refer to the same field, all entries matching
 966     either expression are shown:</para>
 967
 968     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 969
 970     <para>If the separator <literal>+</literal> is used, two
 971     expressions may be combined in a logical OR. The following will
 972     show all messages from the Avahi service process with the PID
 973     28097 plus all messages from the D-Bus service (from any of its
 974     processes):</para>
 975
 976     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 977
 978     <para>To show all fields emitted <emphasis>by</emphasis> a unit and <emphasis>about</emphasis>
 979     the unit, option <option>-u</option>/<option>--unit=</option> should be used.
 980     <command>journalctl -u <replaceable>name</replaceable></command>
 981     expands to a complex filter similar to
 982     <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service
 983   + UNIT=<replaceable>name</replaceable>.service _PID=1
 984   + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0
 985   + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
 986     </programlisting>
 987     (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 988     for an explanation of those patterns).
 989     </para>
 990
 991     <para>Show all logs generated by the D-Bus executable:</para>
 992
 993     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 994
 995     <para>Show all kernel logs from previous boot:</para>
 996
 997     <programlisting>journalctl -k -b -1</programlisting>
 998
 999     <para>Show a live log display from a system service
1000     <filename>apache.service</filename>:</para>
1001
1002     <programlisting>journalctl -f -u apache</programlisting>
1003
1004   </refsect1>
1005
1006   <refsect1>
1007     <title>See Also</title>
1008     <para>
1009       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1010       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1011       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1012       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1013       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1014       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1015       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1016       <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1017       <citerefentry><refentrytitle>systemd-journal-upload.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1018     </para>
1019   </refsect1>
1020 </refentry>