man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   This file is part of systemd.
   9
  10   Copyright 2012 Lennart Poettering
  11
  12   systemd is free software; you can redistribute it and/or modify it
  13   under the terms of the GNU Lesser General Public License as published by
  14   the Free Software Foundation; either version 2.1 of the License, or
  15   (at your option) any later version.
  16
  17   systemd is distributed in the hope that it will be useful, but
  18   WITHOUT ANY WARRANTY; without even the implied warranty of
  19   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  20   Lesser General Public License for more details.
  21
  22   You should have received a copy of the GNU Lesser General Public License
  23   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  24 -->
  25
  26   <refentry id="journalctl"
  27             xmlns:xi="http://www.w3.org/2001/XInclude">
  28
  29     <refentryinfo>
  30       <title>journalctl</title>
  31       <productname>systemd</productname>
  32
  33       <authorgroup>
  34         <author>
  35           <contrib>Developer</contrib>
  36           <firstname>Lennart</firstname>
  37           <surname>Poettering</surname>
  38           <email>lennart@poettering.net</email>
  39         </author>
  40       </authorgroup>
  41     </refentryinfo>
  42
  43     <refmeta>
  44       <refentrytitle>journalctl</refentrytitle>
  45       <manvolnum>1</manvolnum>
  46     </refmeta>
  47
  48     <refnamediv>
  49       <refname>journalctl</refname>
  50       <refpurpose>Query the systemd journal</refpurpose>
  51     </refnamediv>
  52
  53     <refsynopsisdiv>
  54       <cmdsynopsis>
  55         <command>journalctl</command>
  56         <arg choice="opt" rep="repeat">OPTIONS</arg>
  57         <arg choice="opt" rep="repeat">MATCHES</arg>
  58       </cmdsynopsis>
  59     </refsynopsisdiv>
  60
  61     <refsect1>
  62       <title>Description</title>
  63
  64       <para><command>journalctl</command> may be used to query the
  65       contents of the
  66       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  67       journal as written by
  68       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  69
  70       <para>If called without parameters, it will show the full
  71       contents of the journal, starting with the oldest entry
  72       collected.</para>
  73
  74       <para>If one or more match arguments are passed, the output is
  75       filtered accordingly. A match is in the format
  76       <literal>FIELD=VALUE</literal>,
  77       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  78       to the components of a structured journal entry. See
  79       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  80       for a list of well-known fields. If multiple matches are
  81       specified matching different fields, the log entries are
  82       filtered by both, i.e. the resulting output will show only
  83       entries matching all the specified matches of this kind. If two
  84       matches apply to the same field, then they are automatically
  85       matched as alternatives, i.e. the resulting output will show
  86       entries matching any of the specified matches for the same
  87       field. Finally, the character <literal>+</literal> may appear
  88       as a separate word between other terms on the command line. This
  89       causes all matches before and after to be combined in a
  90       disjunction (i.e. logical OR).</para>
  91
  92       <para>It is also possible to filter the entries by specifying an
  93       absolute file path as an argument. The file path may be a file or
  94       a symbolic link and the file must exist at the time of the query. If a
  95       file path refers to an executable binary, an <literal>_EXE=</literal>
  96       match for the canonicalized binary path is added to the query. If a
  97       file path refers to an executable script, a <literal>_COMM=</literal>
  98       match for the script name is added to the query. If a file path
  99       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
 100       the kernel name of the device and for each of its ancestor devices is
 101       added to the query. Symbolic links are dereferenced, kernel names are
 102       synthesized, and parent devices are identified from the environment at
 103       the time of the query. In general, a device node is the best proxy for
 104       an actual device, as log entries do not usually contain fields that
 105       identify an actual device. For the resulting log entries to be correct
 106       for the actual device, the relevant parts of the environment at the time
 107       the entry was logged, in particular the actual device corresponding to
 108       the device node, must have been the same as those at the time of the
 109       query. Because device nodes generally change their corresponding devices
 110       across reboots, specifying a device node path causes the resulting
 111       entries to be restricted to those from the current boot.</para>
 112
 113       <para>Additional constraints may be added using options
 114       <option>--boot</option>, <option>--unit=</option>, etc., to
 115       further limit what entries will be shown (logical AND).</para>
 116
 117       <para>Output is interleaved from all accessible journal files,
 118       whether they are rotated or currently being written, and
 119       regardless of whether they belong to the system itself or are
 120       accessible user journals.</para>
 121
 122       <para>The set of journal files which will be used can be
 123       modified using the <option>--user</option>,
 124       <option>--system</option>, <option>--directory</option>, and
 125       <option>--file</option> options, see below.</para>
 126
 127       <para>All users are granted access to their private per-user
 128       journals. However, by default, only root and users who are
 129       members of a few special groups are granted access to the system
 130       journal and the journals of other users. Members of the groups
 131       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 132       <literal>wheel</literal> can read all journal files. Note
 133       that the two latter groups traditionally have additional
 134       privileges specified by the distribution. Members of the
 135       <literal>wheel</literal> group can often perform administrative
 136       tasks.</para>
 137
 138       <para>The output is paged through <command>less</command> by
 139       default, and long lines are "truncated" to screen width. The
 140       hidden part can be viewed by using the left-arrow and
 141       right-arrow keys. Paging can be disabled; see the
 142       <option>--no-pager</option> option and the "Environment" section
 143       below.</para>
 144
 145       <para>When outputting to a tty, lines are colored according to
 146       priority: lines of level ERROR and higher are colored red; lines
 147       of level NOTICE and higher are highlighted; other lines are
 148       displayed normally.</para>
 149     </refsect1>
 150
 151     <refsect1>
 152       <title>Options</title>
 153
 154       <para>The following options are understood:</para>
 155
 156       <variablelist>
 157         <varlistentry>
 158           <term><option>--no-full</option></term>
 159           <term><option>--full</option></term>
 160           <term><option>-l</option></term>
 161
 162           <listitem><para>Ellipsize fields when they do not fit in
 163           available columns.  The default is to show full fields,
 164           allowing them to wrap or be truncated by the pager, if one
 165           is used.</para>
 166
 167           <para>The old options
 168           <option>-l</option>/<option>--full</option> are not useful
 169           anymore, except to undo <option>--no-full</option>.</para>
 170           </listitem>
 171         </varlistentry>
 172
 173         <varlistentry>
 174           <term><option>-a</option></term>
 175           <term><option>--all</option></term>
 176
 177           <listitem><para>Show all fields in full, even if they
 178           include unprintable characters or are very
 179           long.</para></listitem>
 180         </varlistentry>
 181
 182         <varlistentry>
 183           <term><option>-f</option></term>
 184           <term><option>--follow</option></term>
 185
 186           <listitem><para>Show only the most recent journal entries,
 187           and continuously print new entries as they are appended to
 188           the journal.</para></listitem>
 189         </varlistentry>
 190
 191         <varlistentry>
 192           <term><option>-e</option></term>
 193           <term><option>--pager-end</option></term>
 194
 195           <listitem><para>Immediately jump to the end of the journal
 196           inside the implied pager tool. This implies
 197           <option>-n1000</option> to guarantee that the pager will not
 198           buffer logs of unbounded size. This may be overridden with
 199           an explicit <option>-n</option> with some other numeric
 200           value, while <option>-nall</option> will disable this cap.
 201           Note that this option is only supported for the
 202           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 203           pager.</para></listitem>
 204         </varlistentry>
 205
 206         <varlistentry>
 207           <term><option>-n</option></term>
 208           <term><option>--lines=</option></term>
 209
 210           <listitem><para>Show the most recent journal events and
 211           limit the number of events shown. If
 212           <option>--follow</option> is used, this option is
 213           implied. The argument is a positive integer or
 214           <literal>all</literal> to disable line limiting. The default
 215           value is 10 if no argument is given.</para></listitem>
 216         </varlistentry>
 217
 218         <varlistentry>
 219           <term><option>--no-tail</option></term>
 220
 221           <listitem><para>Show all stored output lines, even in follow
 222           mode. Undoes the effect of <option>--lines=</option>.
 223           </para></listitem>
 224         </varlistentry>
 225
 226         <varlistentry>
 227           <term><option>-r</option></term>
 228           <term><option>--reverse</option></term>
 229
 230           <listitem><para>Reverse output so that the newest entries
 231           are displayed first.</para></listitem>
 232         </varlistentry>
 233
 234         <varlistentry>
 235           <term><option>-o</option></term>
 236           <term><option>--output=</option></term>
 237
 238           <listitem><para>Controls the formatting of the journal
 239           entries that are shown. Takes one of the following
 240           options:</para>
 241           <variablelist>
 242             <varlistentry>
 243               <term>
 244                 <option>short</option>
 245               </term>
 246               <listitem>
 247                 <para>is the default and generates an output that is
 248                 mostly identical to the formatting of classic syslog
 249                 files, showing one line per journal entry.</para>
 250               </listitem>
 251             </varlistentry>
 252
 253             <varlistentry>
 254               <term>
 255                 <option>short-full</option>
 256               </term>
 257               <listitem>
 258                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 259                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 260                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 261                 output, and is locale-independent.</para>
 262               </listitem>
 263             </varlistentry>
 264
 265             <varlistentry>
 266               <term>
 267                 <option>short-iso</option>
 268               </term>
 269               <listitem>
 270                 <para>is very similar, but shows ISO 8601 wallclock
 271                 timestamps.</para>
 272               </listitem>
 273             </varlistentry>
 274
 275             <varlistentry>
 276               <term>
 277                 <option>short-iso-precise</option>
 278               </term>
 279               <listitem>
 280                 <para>as for <option>short-iso</option> but includes full
 281                 microsecond precision.</para>
 282               </listitem>
 283             </varlistentry>
 284
 285             <varlistentry>
 286               <term>
 287                 <option>short-precise</option>
 288               </term>
 289               <listitem>
 290                 <para>is very similar, but shows classic syslog timestamps
 291                 with full microsecond precision.</para>
 292               </listitem>
 293             </varlistentry>
 294
 295             <varlistentry>
 296               <term>
 297                 <option>short-monotonic</option>
 298               </term>
 299               <listitem>
 300                 <para>is very similar, but shows monotonic timestamps
 301                 instead of wallclock timestamps.</para>
 302               </listitem>
 303             </varlistentry>
 304
 305             <varlistentry>
 306               <term>
 307                 <option>short-unix</option>
 308               </term>
 309               <listitem>
 310                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 311                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 312               </listitem>
 313             </varlistentry>
 314
 315             <varlistentry>
 316               <term>
 317                 <option>verbose</option>
 318               </term>
 319               <listitem>
 320                 <para>shows the full-structured entry items with all
 321                 fields.</para>
 322               </listitem>
 323             </varlistentry>
 324
 325             <varlistentry>
 326               <term>
 327                 <option>export</option>
 328               </term>
 329               <listitem>
 330                 <para>serializes the journal into a binary (but mostly
 331                 text-based) stream suitable for backups and network
 332                 transfer (see
 333                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 334                 for more information). To import the binary stream back
 335                 into native journald format use
 336                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 337               </listitem>
 338             </varlistentry>
 339
 340             <varlistentry>
 341               <term>
 342                 <option>json</option>
 343               </term>
 344               <listitem>
 345                 <para>formats entries as JSON data structures, one per
 346                 line (see
 347                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink>
 348                 for more information).</para>
 349               </listitem>
 350             </varlistentry>
 351
 352             <varlistentry>
 353               <term>
 354                 <option>json-pretty</option>
 355               </term>
 356               <listitem>
 357                 <para>formats entries as JSON data structures, but
 358                 formats them in multiple lines in order to make them
 359                 more readable by humans.</para>
 360               </listitem>
 361             </varlistentry>
 362
 363             <varlistentry>
 364               <term>
 365                 <option>json-sse</option>
 366               </term>
 367               <listitem>
 368                 <para>formats entries as JSON data structures, but wraps
 369                 them in a format suitable for
 370                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 371                 </para>
 372               </listitem>
 373             </varlistentry>
 374
 375             <varlistentry>
 376               <term>
 377                 <option>cat</option>
 378               </term>
 379               <listitem>
 380                 <para>generates a very terse output, only showing the
 381                 actual message of each journal entry with no metadata,
 382                 not even a timestamp.</para>
 383               </listitem>
 384             </varlistentry>
 385           </variablelist>
 386         </listitem>
 387       </varlistentry>
 388
 389       <varlistentry>
 390         <term><option>--output-fields=</option></term>
 391
 392         <listitem><para>A comma separated list of the fields which should
 393         be included in the output. This only has an effect for the output modes
 394         which would normally show all fields (<option>verbose</option>,
 395         <option>export</option>, <option>json</option>,
 396         <option>json-pretty</option>, and <option>json-sse</option>). The
 397         <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 398         <literal>__MONOTONIC_TIMESTAMP</literal>, and
 399         <literal>_BOOT_ID</literal> fields are always
 400         printed.</para></listitem>
 401       </varlistentry>
 402
 403       <varlistentry>
 404         <term><option>--utc</option></term>
 405
 406         <listitem><para>Express time in Coordinated Universal Time
 407         (UTC).</para></listitem>
 408       </varlistentry>
 409
 410       <varlistentry>
 411         <term><option>--no-hostname</option></term>
 412
 413         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 414         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 415       </varlistentry>
 416
 417       <varlistentry>
 418         <term><option>-x</option></term>
 419         <term><option>--catalog</option></term>
 420
 421         <listitem><para>Augment log lines with explanation texts from
 422         the message catalog. This will add explanatory help texts to
 423         log messages in the output where this is available. These
 424         short help texts will explain the context of an error or log
 425         event, possible solutions, as well as pointers to support
 426         forums, developer documentation, and any other relevant
 427         manuals. Note that help texts are not available for all
 428         messages, but only for selected ones. For more information on
 429         the message catalog, please refer to the
 430         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 431
 432         <para>Note: when attaching <command>journalctl</command>
 433         output to bug reports, please do <emphasis>not</emphasis> use
 434         <option>-x</option>.</para>
 435         </listitem>
 436       </varlistentry>
 437
 438       <varlistentry>
 439         <term><option>-q</option></term>
 440         <term><option>--quiet</option></term>
 441
 442         <listitem><para>Suppresses all informational messages
 443         (i.e. "-- Logs begin at …", "-- Reboot --"),
 444         any warning messages regarding
 445         inaccessible system journals when run as a normal
 446         user.</para></listitem>
 447       </varlistentry>
 448
 449       <varlistentry>
 450         <term><option>-m</option></term>
 451         <term><option>--merge</option></term>
 452
 453         <listitem><para>Show entries interleaved from all available
 454         journals, including remote ones.</para></listitem>
 455       </varlistentry>
 456
 457       <varlistentry>
 458         <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 459         <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 460
 461         <listitem><para>Show messages from a specific boot. This will
 462         add a match for <literal>_BOOT_ID=</literal>.</para>
 463
 464         <para>The argument may be empty, in which case logs for the
 465         current boot will be shown.</para>
 466
 467         <para>If the boot ID is omitted, a positive
 468         <replaceable>offset</replaceable> will look up the boots
 469         starting from the beginning of the journal, and an
 470         equal-or-less-than zero <replaceable>offset</replaceable> will
 471         look up boots starting from the end of the journal. Thus,
 472         <constant>1</constant> means the first boot found in the
 473         journal in chronological order, <constant>2</constant> the
 474         second and so on; while <constant>-0</constant> is the last
 475         boot, <constant>-1</constant> the boot before last, and so
 476         on. An empty <replaceable>offset</replaceable> is equivalent
 477         to specifying <constant>-0</constant>, except when the current
 478         boot is not the last boot (e.g. because
 479         <option>--directory</option> was specified to look at logs
 480         from a different machine).</para>
 481
 482         <para>If the 32-character <replaceable>ID</replaceable> is
 483         specified, it may optionally be followed by
 484         <replaceable>offset</replaceable> which identifies the boot
 485         relative to the one given by boot
 486         <replaceable>ID</replaceable>. Negative values mean earlier
 487         boots and positive values mean later boots. If
 488         <replaceable>offset</replaceable> is not specified, a value of
 489         zero is assumed, and the logs for the boot given by
 490         <replaceable>ID</replaceable> are shown.</para>
 491         </listitem>
 492       </varlistentry>
 493
 494       <varlistentry>
 495         <term><option>--list-boots</option></term>
 496
 497         <listitem><para>Show a tabular list of boot numbers (relative to
 498         the current boot), their IDs, and the timestamps of the first
 499         and last message pertaining to the boot.</para></listitem>
 500       </varlistentry>
 501
 502       <varlistentry>
 503         <term><option>-k</option></term>
 504         <term><option>--dmesg</option></term>
 505
 506         <listitem><para>Show only kernel messages. This implies
 507         <option>-b</option> and adds the match
 508         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 509       </varlistentry>
 510
 511       <varlistentry>
 512         <term><option>-t</option></term>
 513         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 514
 515         <listitem><para>Show messages for the specified syslog
 516         identifier
 517         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 518
 519         <para>This parameter can be specified multiple
 520         times.</para></listitem>
 521       </varlistentry>
 522
 523       <varlistentry>
 524         <term><option>-u</option></term>
 525         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 526
 527         <listitem><para>Show messages for the specified systemd unit
 528         <replaceable>UNIT</replaceable> (such as a service unit), or
 529         for any of the units matched by
 530         <replaceable>PATTERN</replaceable>.  If a pattern is
 531         specified, a list of unit names found in the journal is
 532         compared with the specified pattern and all that match are
 533         used. For each unit name, a match is added for messages from
 534         the unit
 535         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 536         along with additional matches for messages from systemd and
 537         messages about coredumps for the specified unit.</para>
 538
 539         <para>This parameter can be specified multiple times.</para>
 540         </listitem>
 541       </varlistentry>
 542
 543       <varlistentry>
 544         <term><option>--user-unit=</option></term>
 545
 546         <listitem><para>Show messages for the specified user session
 547         unit. This will add a match for messages from the unit
 548         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 549         <literal>_UID=</literal>) and additional matches for messages
 550         from session systemd and messages about coredumps for the
 551         specified unit.</para>
 552
 553         <para>This parameter can be specified multiple times.</para>
 554         </listitem>
 555       </varlistentry>
 556
 557       <varlistentry>
 558         <term><option>-p</option></term>
 559         <term><option>--priority=</option></term>
 560
 561         <listitem><para>Filter output by message priorities or
 562         priority ranges. Takes either a single numeric or textual log
 563         level (i.e. between 0/<literal>emerg</literal> and
 564         7/<literal>debug</literal>), or a range of numeric/text log
 565         levels in the form FROM..TO. The log levels are the usual
 566         syslog log levels as documented in
 567         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 568         i.e. <literal>emerg</literal> (0),
 569         <literal>alert</literal> (1), <literal>crit</literal> (2),
 570         <literal>err</literal> (3), <literal>warning</literal> (4),
 571         <literal>notice</literal> (5), <literal>info</literal> (6),
 572         <literal>debug</literal> (7). If a single log level is
 573         specified, all messages with this log level or a lower (hence
 574         more important) log level are shown. If a range is specified,
 575         all messages within the range are shown, including both the
 576         start and the end value of the range. This will add
 577         <literal>PRIORITY=</literal> matches for the specified
 578         priorities.</para></listitem>
 579       </varlistentry>
 580
 581       <varlistentry>
 582         <term><option>-c</option></term>
 583         <term><option>--cursor=</option></term>
 584
 585         <listitem><para>Start showing entries from the location in the
 586         journal specified by the passed cursor.</para></listitem>
 587       </varlistentry>
 588
 589       <varlistentry>
 590         <term><option>--after-cursor=</option></term>
 591
 592         <listitem><para>Start showing entries from the location in the
 593         journal <emphasis>after</emphasis> the location specified by
 594         the passed cursor.  The cursor is shown when the
 595         <option>--show-cursor</option> option is used.</para>
 596         </listitem>
 597       </varlistentry>
 598
 599       <varlistentry>
 600         <term><option>--show-cursor</option></term>
 601
 602         <listitem><para>The cursor is shown after the last entry after
 603         two dashes:</para>
 604         <programlisting>-- cursor: s=0639…</programlisting>
 605         <para>The format of the cursor is private
 606         and subject to change.</para></listitem>
 607       </varlistentry>
 608
 609       <varlistentry>
 610         <term><option>-S</option></term>
 611         <term><option>--since=</option></term>
 612         <term><option>-U</option></term>
 613         <term><option>--until=</option></term>
 614
 615         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 616         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 617         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 618         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 619         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 620         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 621         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 622         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 623         time, respectively. For complete time and date specification, see
 624         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 625         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 626         </para>
 627         </listitem>
 628       </varlistentry>
 629
 630       <varlistentry>
 631         <term><option>-F</option></term>
 632         <term><option>--field=</option></term>
 633
 634         <listitem><para>Print all possible data values the specified
 635         field can take in all entries of the journal.</para></listitem>
 636       </varlistentry>
 637
 638       <varlistentry>
 639         <term><option>-N</option></term>
 640         <term><option>--fields</option></term>
 641
 642         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 643       </varlistentry>
 644
 645       <varlistentry>
 646         <term><option>--system</option></term>
 647         <term><option>--user</option></term>
 648
 649         <listitem><para>Show messages from system services and the
 650         kernel (with <option>--system</option>). Show messages from
 651         service of current user (with <option>--user</option>).  If
 652         neither is specified, show all messages that the user can see.
 653         </para></listitem>
 654       </varlistentry>
 655
 656       <varlistentry>
 657         <term><option>-M</option></term>
 658         <term><option>--machine=</option></term>
 659
 660         <listitem><para>Show messages from a running, local
 661         container. Specify a container name to connect to.</para>
 662         </listitem>
 663       </varlistentry>
 664
 665       <varlistentry>
 666         <term><option>-D <replaceable>DIR</replaceable></option></term>
 667         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 668
 669         <listitem><para>Takes a directory path as argument. If
 670         specified, journalctl will operate on the specified journal
 671         directory <replaceable>DIR</replaceable> instead of the
 672         default runtime and system journal paths.</para></listitem>
 673       </varlistentry>
 674
 675       <varlistentry>
 676         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 677
 678         <listitem><para>Takes a file glob as an argument. If
 679         specified, journalctl will operate on the specified journal
 680         files matching <replaceable>GLOB</replaceable> instead of the
 681         default runtime and system journal paths. May be specified
 682         multiple times, in which case files will be suitably
 683         interleaved.</para></listitem>
 684       </varlistentry>
 685
 686       <varlistentry>
 687         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 688
 689         <listitem><para>Takes a directory path as an argument. If
 690         specified, journalctl will operate on journal directories and catalog file hierarchy
 691         underneath the specified directory instead of the root
 692         directory (e.g. <option>--update-catalog</option> will create
 693         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 694         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 695         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 696         </para></listitem>
 697       </varlistentry>
 698
 699       <varlistentry>
 700         <term><option>--new-id128</option></term>
 701
 702         <listitem><para>Instead of showing journal contents, generate
 703         a new 128-bit ID suitable for identifying messages. This is
 704         intended for usage by developers who need a new identifier for
 705         a new message they introduce and want to make
 706         recognizable. This will print the new ID in four different
 707         formats which can be copied into source code or similar.
 708         </para></listitem>
 709       </varlistentry>
 710
 711       <varlistentry>
 712         <term><option>--header</option></term>
 713
 714         <listitem><para>Instead of showing journal contents, show
 715         internal header information of the journal fields
 716         accessed.</para></listitem>
 717       </varlistentry>
 718
 719       <varlistentry>
 720         <term><option>--disk-usage</option></term>
 721
 722         <listitem><para>Shows the current disk usage of all journal
 723         files. This shows the sum of the disk usage of all archived
 724         and active journal files.</para></listitem>
 725       </varlistentry>
 726
 727       <varlistentry>
 728         <term><option>--vacuum-size=</option></term>
 729         <term><option>--vacuum-time=</option></term>
 730         <term><option>--vacuum-files=</option></term>
 731
 732         <listitem><para>Removes archived journal files until the disk
 733         space they use falls below the specified size (specified with
 734         the usual <literal>K</literal>, <literal>M</literal>,
 735         <literal>G</literal> and <literal>T</literal> suffixes), or all
 736         archived journal files contain no data older than the specified
 737         timespan (specified with the usual <literal>s</literal>,
 738         <literal>m</literal>, <literal>h</literal>,
 739         <literal>days</literal>, <literal>months</literal>,
 740         <literal>weeks</literal> and <literal>years</literal> suffixes),
 741         or no more than the specified number of separate journal files
 742         remain. Note that running <option>--vacuum-size=</option> has
 743         only an indirect effect on the output shown by
 744         <option>--disk-usage</option>, as the latter includes active
 745         journal files, while the vacuuming operation only operates
 746         on archived journal files. Similarly,
 747         <option>--vacuum-files=</option> might not actually reduce the
 748         number of journal files to below the specified number, as it
 749         will not remove active journal
 750         files. <option>--vacuum-size=</option>,
 751         <option>--vacuum-time=</option> and
 752         <option>--vacuum-files=</option> may be combined in a single
 753         invocation to enforce any combination of a size, a time and a
 754         number of files limit on the archived journal
 755         files. Specifying any of these three parameters as zero is
 756         equivalent to not enforcing the specific limit, and is thus
 757         redundant.</para></listitem>
 758       </varlistentry>
 759
 760       <varlistentry>
 761         <term><option>--list-catalog
 762         <optional><replaceable>128-bit-ID…</replaceable></optional>
 763         </option></term>
 764
 765         <listitem><para>List the contents of the message catalog as a
 766         table of message IDs, plus their short description strings.
 767         </para>
 768
 769         <para>If any <replaceable>128-bit-ID</replaceable>s are
 770         specified, only those entries are shown.</para>
 771         </listitem>
 772       </varlistentry>
 773
 774       <varlistentry>
 775         <term><option>--dump-catalog
 776         <optional><replaceable>128-bit-ID…</replaceable></optional>
 777         </option></term>
 778
 779         <listitem><para>Show the contents of the message catalog, with
 780         entries separated by a line consisting of two dashes and the
 781         ID (the format is the same as <filename>.catalog</filename>
 782         files).</para>
 783
 784         <para>If any <replaceable>128-bit-ID</replaceable>s are
 785         specified, only those entries are shown.</para>
 786         </listitem>
 787       </varlistentry>
 788
 789       <varlistentry>
 790         <term><option>--update-catalog</option></term>
 791
 792         <listitem><para>Update the message catalog index. This command
 793         needs to be executed each time new catalog files are
 794         installed, removed, or updated to rebuild the binary catalog
 795         index.</para></listitem>
 796       </varlistentry>
 797
 798       <varlistentry>
 799         <term><option>--setup-keys</option></term>
 800
 801         <listitem><para>Instead of showing journal contents, generate
 802         a new key pair for Forward Secure Sealing (FSS). This will
 803         generate a sealing key and a verification key. The sealing key
 804         is stored in the journal data directory and shall remain on
 805         the host. The verification key should be stored
 806         externally. Refer to the <option>Seal=</option> option in
 807         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 808         for information on Forward Secure Sealing and for a link to a
 809         refereed scholarly paper detailing the cryptographic theory it
 810         is based on.</para></listitem>
 811       </varlistentry>
 812
 813       <varlistentry>
 814         <term><option>--force</option></term>
 815
 816         <listitem><para>When <option>--setup-keys</option> is passed
 817         and Forward Secure Sealing (FSS) has already been configured,
 818         recreate FSS keys.</para></listitem>
 819       </varlistentry>
 820
 821       <varlistentry>
 822         <term><option>--interval=</option></term>
 823
 824         <listitem><para>Specifies the change interval for the sealing
 825         key when generating an FSS key pair with
 826         <option>--setup-keys</option>. Shorter intervals increase CPU
 827         consumption but shorten the time range of undetectable journal
 828         alterations. Defaults to 15min.</para></listitem>
 829       </varlistentry>
 830
 831       <varlistentry>
 832         <term><option>--verify</option></term>
 833
 834         <listitem><para>Check the journal file for internal
 835         consistency. If the file has been generated with FSS enabled and
 836         the FSS verification key has been specified with
 837         <option>--verify-key=</option>, authenticity of the journal file
 838         is verified.</para></listitem>
 839       </varlistentry>
 840
 841       <varlistentry>
 842         <term><option>--verify-key=</option></term>
 843
 844         <listitem><para>Specifies the FSS verification key to use for
 845         the <option>--verify</option> operation.</para></listitem>
 846       </varlistentry>
 847
 848       <varlistentry>
 849         <term><option>--sync</option></term>
 850
 851         <listitem><para>Asks the journal daemon to write all yet
 852         unwritten journal data to the backing file system and
 853         synchronize all journals. This call does not return until the
 854         synchronization operation is complete. This command guarantees
 855         that any log messages written before its invocation are safely
 856         stored on disk at the time it returns.</para></listitem>
 857       </varlistentry>
 858
 859       <varlistentry>
 860         <term><option>--flush</option></term>
 861
 862         <listitem><para>Asks the journal daemon to flush any log data
 863         stored in <filename>/run/log/journal</filename> into
 864         <filename>/var/log/journal</filename>, if persistent storage
 865         is enabled. This call does not return until the operation is
 866         complete. Note that this call is idempotent: the data is only
 867         flushed from <filename>/run/log/journal</filename> into
 868         <filename>/var/log/journal</filename> once during system
 869         runtime, and this command exits cleanly without executing any
 870         operation if this has already happened. This command
 871         effectively guarantees that all data is flushed to
 872         <filename>/var/log/journal</filename> at the time it
 873         returns.</para></listitem>
 874       </varlistentry>
 875
 876       <varlistentry>
 877         <term><option>--rotate</option></term>
 878
 879         <listitem><para>Asks the journal daemon to rotate journal
 880         files. This call does not return until the rotation operation
 881         is complete.</para></listitem>
 882       </varlistentry>
 883
 884       <xi:include href="standard-options.xml" xpointer="help" />
 885       <xi:include href="standard-options.xml" xpointer="version" />
 886       <xi:include href="standard-options.xml" xpointer="no-pager" />
 887     </variablelist>
 888   </refsect1>
 889
 890   <refsect1>
 891     <title>Exit status</title>
 892
 893     <para>On success, 0 is returned; otherwise, a non-zero failure
 894     code is returned.</para>
 895   </refsect1>
 896
 897   <xi:include href="less-variables.xml" />
 898
 899   <refsect1>
 900     <title>Examples</title>
 901
 902     <para>Without arguments, all collected logs are shown
 903     unfiltered:</para>
 904
 905     <programlisting>journalctl</programlisting>
 906
 907     <para>With one match specified, all entries with a field matching
 908     the expression are shown:</para>
 909
 910     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
 911
 912     <para>If two different fields are matched, only entries matching
 913     both expressions at the same time are shown:</para>
 914
 915     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 916
 917     <para>If two matches refer to the same field, all entries matching
 918     either expression are shown:</para>
 919
 920     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 921
 922     <para>If the separator <literal>+</literal> is used, two
 923     expressions may be combined in a logical OR. The following will
 924     show all messages from the Avahi service process with the PID
 925     28097 plus all messages from the D-Bus service (from any of its
 926     processes):</para>
 927
 928     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 929
 930     <para>Show all logs generated by the D-Bus executable:</para>
 931
 932     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 933
 934     <para>Show all kernel logs from previous boot:</para>
 935
 936     <programlisting>journalctl -k -b -1</programlisting>
 937
 938     <para>Show a live log display from a system service
 939     <filename>apache.service</filename>:</para>
 940
 941     <programlisting>journalctl -f -u apache</programlisting>
 942
 943   </refsect1>
 944
 945   <refsect1>
 946     <title>See Also</title>
 947     <para>
 948       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 949       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 950       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 951       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 952       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 953       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 954       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 955       <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 956       <citerefentry><refentrytitle>systemd-journal-upload</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 957     </para>
 958   </refsect1>
 959 </refentry>