man/journalctl.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7 -->
   8
   9   <refentry id="journalctl"
  10             xmlns:xi="http://www.w3.org/2001/XInclude">
  11
  12     <refentryinfo>
  13       <title>journalctl</title>
  14       <productname>systemd</productname>
  15     </refentryinfo>
  16
  17     <refmeta>
  18       <refentrytitle>journalctl</refentrytitle>
  19       <manvolnum>1</manvolnum>
  20     </refmeta>
  21
  22     <refnamediv>
  23       <refname>journalctl</refname>
  24       <refpurpose>Query the systemd journal</refpurpose>
  25     </refnamediv>
  26
  27     <refsynopsisdiv>
  28       <cmdsynopsis>
  29         <command>journalctl</command>
  30         <arg choice="opt" rep="repeat">OPTIONS</arg>
  31         <arg choice="opt" rep="repeat">MATCHES</arg>
  32       </cmdsynopsis>
  33     </refsynopsisdiv>
  34
  35     <refsect1>
  36       <title>Description</title>
  37
  38       <para><command>journalctl</command> may be used to query the
  39       contents of the
  40       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  41       journal as written by
  42       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  43
  44       <para>If called without parameters, it will show the full
  45       contents of the journal, starting with the oldest entry
  46       collected.</para>
  47
  48       <para>If one or more match arguments are passed, the output is
  49       filtered accordingly. A match is in the format
  50       <literal>FIELD=VALUE</literal>,
  51       e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>, referring
  52       to the components of a structured journal entry. See
  53       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  54       for a list of well-known fields. If multiple matches are
  55       specified matching different fields, the log entries are
  56       filtered by both, i.e. the resulting output will show only
  57       entries matching all the specified matches of this kind. If two
  58       matches apply to the same field, then they are automatically
  59       matched as alternatives, i.e. the resulting output will show
  60       entries matching any of the specified matches for the same
  61       field. Finally, the character <literal>+</literal> may appear
  62       as a separate word between other terms on the command line. This
  63       causes all matches before and after to be combined in a
  64       disjunction (i.e. logical OR).</para>
  65
  66       <para>It is also possible to filter the entries by specifying an
  67       absolute file path as an argument. The file path may be a file or
  68       a symbolic link and the file must exist at the time of the query. If a
  69       file path refers to an executable binary, an <literal>_EXE=</literal>
  70       match for the canonicalized binary path is added to the query. If a
  71       file path refers to an executable script, a <literal>_COMM=</literal>
  72       match for the script name is added to the query. If a file path
  73       refers to a device node, <literal>_KERNEL_DEVICE=</literal> matches for
  74       the kernel name of the device and for each of its ancestor devices is
  75       added to the query. Symbolic links are dereferenced, kernel names are
  76       synthesized, and parent devices are identified from the environment at
  77       the time of the query. In general, a device node is the best proxy for
  78       an actual device, as log entries do not usually contain fields that
  79       identify an actual device. For the resulting log entries to be correct
  80       for the actual device, the relevant parts of the environment at the time
  81       the entry was logged, in particular the actual device corresponding to
  82       the device node, must have been the same as those at the time of the
  83       query. Because device nodes generally change their corresponding devices
  84       across reboots, specifying a device node path causes the resulting
  85       entries to be restricted to those from the current boot.</para>
  86
  87       <para>Additional constraints may be added using options
  88       <option>--boot</option>, <option>--unit=</option>, etc., to
  89       further limit what entries will be shown (logical AND).</para>
  90
  91       <para>Output is interleaved from all accessible journal files,
  92       whether they are rotated or currently being written, and
  93       regardless of whether they belong to the system itself or are
  94       accessible user journals.</para>
  95
  96       <para>The set of journal files which will be used can be
  97       modified using the <option>--user</option>,
  98       <option>--system</option>, <option>--directory</option>, and
  99       <option>--file</option> options, see below.</para>
 100
 101       <para>All users are granted access to their private per-user
 102       journals. However, by default, only root and users who are
 103       members of a few special groups are granted access to the system
 104       journal and the journals of other users. Members of the groups
 105       <literal>systemd-journal</literal>, <literal>adm</literal>, and
 106       <literal>wheel</literal> can read all journal files. Note
 107       that the two latter groups traditionally have additional
 108       privileges specified by the distribution. Members of the
 109       <literal>wheel</literal> group can often perform administrative
 110       tasks.</para>
 111
 112       <para>The output is paged through <command>less</command> by
 113       default, and long lines are "truncated" to screen width. The
 114       hidden part can be viewed by using the left-arrow and
 115       right-arrow keys. Paging can be disabled; see the
 116       <option>--no-pager</option> option and the "Environment" section
 117       below.</para>
 118
 119       <para>When outputting to a tty, lines are colored according to
 120       priority: lines of level ERROR and higher are colored red; lines
 121       of level NOTICE and higher are highlighted; other lines are
 122       displayed normally.</para>
 123     </refsect1>
 124
 125     <refsect1>
 126       <title>Options</title>
 127
 128       <para>The following options are understood:</para>
 129
 130       <variablelist>
 131         <varlistentry>
 132           <term><option>--no-full</option></term>
 133           <term><option>--full</option></term>
 134           <term><option>-l</option></term>
 135
 136           <listitem><para>Ellipsize fields when they do not fit in
 137           available columns.  The default is to show full fields,
 138           allowing them to wrap or be truncated by the pager, if one
 139           is used.</para>
 140
 141           <para>The old options
 142           <option>-l</option>/<option>--full</option> are not useful
 143           anymore, except to undo <option>--no-full</option>.</para>
 144           </listitem>
 145         </varlistentry>
 146
 147         <varlistentry>
 148           <term><option>-a</option></term>
 149           <term><option>--all</option></term>
 150
 151           <listitem><para>Show all fields in full, even if they
 152           include unprintable characters or are very
 153           long.</para></listitem>
 154         </varlistentry>
 155
 156         <varlistentry>
 157           <term><option>-f</option></term>
 158           <term><option>--follow</option></term>
 159
 160           <listitem><para>Show only the most recent journal entries,
 161           and continuously print new entries as they are appended to
 162           the journal.</para></listitem>
 163         </varlistentry>
 164
 165         <varlistentry>
 166           <term><option>-e</option></term>
 167           <term><option>--pager-end</option></term>
 168
 169           <listitem><para>Immediately jump to the end of the journal
 170           inside the implied pager tool. This implies
 171           <option>-n1000</option> to guarantee that the pager will not
 172           buffer logs of unbounded size. This may be overridden with
 173           an explicit <option>-n</option> with some other numeric
 174           value, while <option>-nall</option> will disable this cap.
 175           Note that this option is only supported for the
 176           <citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 177           pager.</para></listitem>
 178         </varlistentry>
 179
 180         <varlistentry>
 181           <term><option>-n</option></term>
 182           <term><option>--lines=</option></term>
 183
 184           <listitem><para>Show the most recent journal events and
 185           limit the number of events shown. If
 186           <option>--follow</option> is used, this option is
 187           implied. The argument is a positive integer or
 188           <literal>all</literal> to disable line limiting. The default
 189           value is 10 if no argument is given.</para></listitem>
 190         </varlistentry>
 191
 192         <varlistentry>
 193           <term><option>--no-tail</option></term>
 194
 195           <listitem><para>Show all stored output lines, even in follow
 196           mode. Undoes the effect of <option>--lines=</option>.
 197           </para></listitem>
 198         </varlistentry>
 199
 200         <varlistentry>
 201           <term><option>-r</option></term>
 202           <term><option>--reverse</option></term>
 203
 204           <listitem><para>Reverse output so that the newest entries
 205           are displayed first.</para></listitem>
 206         </varlistentry>
 207
 208         <varlistentry>
 209           <term><option>-o</option></term>
 210           <term><option>--output=</option></term>
 211
 212           <listitem><para>Controls the formatting of the journal
 213           entries that are shown. Takes one of the following
 214           options:</para>
 215           <variablelist>
 216             <varlistentry>
 217               <term>
 218                 <option>short</option>
 219               </term>
 220               <listitem>
 221                 <para>is the default and generates an output that is
 222                 mostly identical to the formatting of classic syslog
 223                 files, showing one line per journal entry.</para>
 224               </listitem>
 225             </varlistentry>
 226
 227             <varlistentry>
 228               <term>
 229                 <option>short-full</option>
 230               </term>
 231               <listitem>
 232                 <para>is very similar, but shows timestamps in the format the <option>--since=</option> and
 233                 <option>--until=</option> options accept. Unlike the timestamp information shown in
 234                 <option>short</option> output mode this mode includes weekday, year and timezone information in the
 235                 output, and is locale-independent.</para>
 236               </listitem>
 237             </varlistentry>
 238
 239             <varlistentry>
 240               <term>
 241                 <option>short-iso</option>
 242               </term>
 243               <listitem>
 244                 <para>is very similar, but shows ISO 8601 wallclock
 245                 timestamps.</para>
 246               </listitem>
 247             </varlistentry>
 248
 249             <varlistentry>
 250               <term>
 251                 <option>short-iso-precise</option>
 252               </term>
 253               <listitem>
 254                 <para>as for <option>short-iso</option> but includes full
 255                 microsecond precision.</para>
 256               </listitem>
 257             </varlistentry>
 258
 259             <varlistentry>
 260               <term>
 261                 <option>short-precise</option>
 262               </term>
 263               <listitem>
 264                 <para>is very similar, but shows classic syslog timestamps
 265                 with full microsecond precision.</para>
 266               </listitem>
 267             </varlistentry>
 268
 269             <varlistentry>
 270               <term>
 271                 <option>short-monotonic</option>
 272               </term>
 273               <listitem>
 274                 <para>is very similar, but shows monotonic timestamps
 275                 instead of wallclock timestamps.</para>
 276               </listitem>
 277             </varlistentry>
 278
 279             <varlistentry>
 280               <term>
 281                 <option>short-unix</option>
 282               </term>
 283               <listitem>
 284                 <para>is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock
 285                 timestamps ("UNIX time"). The time is shown with microsecond accuracy.</para>
 286               </listitem>
 287             </varlistentry>
 288
 289             <varlistentry>
 290               <term>
 291                 <option>verbose</option>
 292               </term>
 293               <listitem>
 294                 <para>shows the full-structured entry items with all
 295                 fields.</para>
 296               </listitem>
 297             </varlistentry>
 298
 299             <varlistentry>
 300               <term>
 301                 <option>export</option>
 302               </term>
 303               <listitem>
 304                 <para>serializes the journal into a binary (but mostly
 305                 text-based) stream suitable for backups and network
 306                 transfer (see
 307                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
 308                 for more information). To import the binary stream back
 309                 into native journald format use
 310                 <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
 311               </listitem>
 312             </varlistentry>
 313
 314             <varlistentry>
 315               <term>
 316                 <option>json</option>
 317               </term>
 318               <listitem>
 319                 <para>formats entries as JSON data structures, one per
 320                 line (see
 321                 <ulink url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format</ulink>
 322                 for more information).</para>
 323               </listitem>
 324             </varlistentry>
 325
 326             <varlistentry>
 327               <term>
 328                 <option>json-pretty</option>
 329               </term>
 330               <listitem>
 331                 <para>formats entries as JSON data structures, but
 332                 formats them in multiple lines in order to make them
 333                 more readable by humans.</para>
 334               </listitem>
 335             </varlistentry>
 336
 337             <varlistentry>
 338               <term>
 339                 <option>json-sse</option>
 340               </term>
 341               <listitem>
 342                 <para>formats entries as JSON data structures, but wraps
 343                 them in a format suitable for
 344                 <ulink url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent Events</ulink>.
 345                 </para>
 346               </listitem>
 347             </varlistentry>
 348
 349             <varlistentry>
 350               <term>
 351                 <option>cat</option>
 352               </term>
 353               <listitem>
 354                 <para>generates a very terse output, only showing the
 355                 actual message of each journal entry with no metadata,
 356                 not even a timestamp.</para>
 357               </listitem>
 358             </varlistentry>
 359
 360             <varlistentry>
 361               <term>
 362                 <option>with-unit</option>
 363               </term>
 364               <listitem>
 365                 <para>similar to short-full, but prefixes the unit and
 366                 user unit names instead of the traditional syslog
 367                 identifier. Useful when using templated instances, as it
 368                 will include the arguments in the unit names.</para>
 369               </listitem>
 370             </varlistentry>
 371           </variablelist>
 372         </listitem>
 373       </varlistentry>
 374
 375       <varlistentry>
 376         <term><option>--output-fields=</option></term>
 377
 378         <listitem><para>A comma separated list of the fields which should
 379         be included in the output. This only has an effect for the output modes
 380         which would normally show all fields (<option>verbose</option>,
 381         <option>export</option>, <option>json</option>,
 382         <option>json-pretty</option>, and <option>json-sse</option>). The
 383         <literal>__CURSOR</literal>, <literal>__REALTIME_TIMESTAMP</literal>,
 384         <literal>__MONOTONIC_TIMESTAMP</literal>, and
 385         <literal>_BOOT_ID</literal> fields are always
 386         printed.</para></listitem>
 387       </varlistentry>
 388
 389       <varlistentry>
 390         <term><option>--utc</option></term>
 391
 392         <listitem><para>Express time in Coordinated Universal Time
 393         (UTC).</para></listitem>
 394       </varlistentry>
 395
 396       <varlistentry>
 397         <term><option>--no-hostname</option></term>
 398
 399         <listitem><para>Don't show the hostname field of log messages originating from the local host. This switch only
 400         has an effect on the <option>short</option> family of output modes (see above).</para></listitem>
 401       </varlistentry>
 402
 403       <varlistentry>
 404         <term><option>-x</option></term>
 405         <term><option>--catalog</option></term>
 406
 407         <listitem><para>Augment log lines with explanation texts from
 408         the message catalog. This will add explanatory help texts to
 409         log messages in the output where this is available. These
 410         short help texts will explain the context of an error or log
 411         event, possible solutions, as well as pointers to support
 412         forums, developer documentation, and any other relevant
 413         manuals. Note that help texts are not available for all
 414         messages, but only for selected ones. For more information on
 415         the message catalog, please refer to the
 416         <ulink url="https://www.freedesktop.org/wiki/Software/systemd/catalog">Message Catalog Developer Documentation</ulink>.</para>
 417
 418         <para>Note: when attaching <command>journalctl</command>
 419         output to bug reports, please do <emphasis>not</emphasis> use
 420         <option>-x</option>.</para>
 421         </listitem>
 422       </varlistentry>
 423
 424       <varlistentry>
 425         <term><option>-q</option></term>
 426         <term><option>--quiet</option></term>
 427
 428         <listitem><para>Suppresses all informational messages
 429         (i.e. "-- Logs begin at …", "-- Reboot --"),
 430         any warning messages regarding
 431         inaccessible system journals when run as a normal
 432         user.</para></listitem>
 433       </varlistentry>
 434
 435       <varlistentry>
 436         <term><option>-m</option></term>
 437         <term><option>--merge</option></term>
 438
 439         <listitem><para>Show entries interleaved from all available
 440         journals, including remote ones.</para></listitem>
 441       </varlistentry>
 442
 443       <varlistentry>
 444         <term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 445         <term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>
 446
 447         <listitem><para>Show messages from a specific boot. This will
 448         add a match for <literal>_BOOT_ID=</literal>.</para>
 449
 450         <para>The argument may be empty, in which case logs for the
 451         current boot will be shown.</para>
 452
 453         <para>If the boot ID is omitted, a positive
 454         <replaceable>offset</replaceable> will look up the boots
 455         starting from the beginning of the journal, and an
 456         equal-or-less-than zero <replaceable>offset</replaceable> will
 457         look up boots starting from the end of the journal. Thus,
 458         <constant>1</constant> means the first boot found in the
 459         journal in chronological order, <constant>2</constant> the
 460         second and so on; while <constant>-0</constant> is the last
 461         boot, <constant>-1</constant> the boot before last, and so
 462         on. An empty <replaceable>offset</replaceable> is equivalent
 463         to specifying <constant>-0</constant>, except when the current
 464         boot is not the last boot (e.g. because
 465         <option>--directory</option> was specified to look at logs
 466         from a different machine).</para>
 467
 468         <para>If the 32-character <replaceable>ID</replaceable> is
 469         specified, it may optionally be followed by
 470         <replaceable>offset</replaceable> which identifies the boot
 471         relative to the one given by boot
 472         <replaceable>ID</replaceable>. Negative values mean earlier
 473         boots and positive values mean later boots. If
 474         <replaceable>offset</replaceable> is not specified, a value of
 475         zero is assumed, and the logs for the boot given by
 476         <replaceable>ID</replaceable> are shown.</para>
 477         </listitem>
 478       </varlistentry>
 479
 480       <varlistentry>
 481         <term><option>--list-boots</option></term>
 482
 483         <listitem><para>Show a tabular list of boot numbers (relative to
 484         the current boot), their IDs, and the timestamps of the first
 485         and last message pertaining to the boot.</para></listitem>
 486       </varlistentry>
 487
 488       <varlistentry>
 489         <term><option>-k</option></term>
 490         <term><option>--dmesg</option></term>
 491
 492         <listitem><para>Show only kernel messages. This implies
 493         <option>-b</option> and adds the match
 494         <literal>_TRANSPORT=kernel</literal>.</para></listitem>
 495       </varlistentry>
 496
 497       <varlistentry>
 498         <term><option>-t</option></term>
 499         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
 500
 501         <listitem><para>Show messages for the specified syslog
 502         identifier
 503         <replaceable>SYSLOG_IDENTIFIER</replaceable>.</para>
 504
 505         <para>This parameter can be specified multiple
 506         times.</para></listitem>
 507       </varlistentry>
 508
 509       <varlistentry>
 510         <term><option>-u</option></term>
 511         <term><option>--unit=<replaceable>UNIT</replaceable>|<replaceable>PATTERN</replaceable></option></term>
 512
 513         <listitem><para>Show messages for the specified systemd unit
 514         <replaceable>UNIT</replaceable> (such as a service unit), or
 515         for any of the units matched by
 516         <replaceable>PATTERN</replaceable>.  If a pattern is
 517         specified, a list of unit names found in the journal is
 518         compared with the specified pattern and all that match are
 519         used. For each unit name, a match is added for messages from
 520         the unit
 521         (<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>),
 522         along with additional matches for messages from systemd and
 523         messages about coredumps for the specified unit.</para>
 524
 525         <para>This parameter can be specified multiple times.</para>
 526         </listitem>
 527       </varlistentry>
 528
 529       <varlistentry>
 530         <term><option>--user-unit=</option></term>
 531
 532         <listitem><para>Show messages for the specified user session
 533         unit. This will add a match for messages from the unit
 534         (<literal>_SYSTEMD_USER_UNIT=</literal> and
 535         <literal>_UID=</literal>) and additional matches for messages
 536         from session systemd and messages about coredumps for the
 537         specified unit.</para>
 538
 539         <para>This parameter can be specified multiple times.</para>
 540         </listitem>
 541       </varlistentry>
 542
 543       <varlistentry>
 544         <term><option>-p</option></term>
 545         <term><option>--priority=</option></term>
 546
 547         <listitem><para>Filter output by message priorities or
 548         priority ranges. Takes either a single numeric or textual log
 549         level (i.e. between 0/<literal>emerg</literal> and
 550         7/<literal>debug</literal>), or a range of numeric/text log
 551         levels in the form FROM..TO. The log levels are the usual
 552         syslog log levels as documented in
 553         <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 554         i.e. <literal>emerg</literal> (0),
 555         <literal>alert</literal> (1), <literal>crit</literal> (2),
 556         <literal>err</literal> (3), <literal>warning</literal> (4),
 557         <literal>notice</literal> (5), <literal>info</literal> (6),
 558         <literal>debug</literal> (7). If a single log level is
 559         specified, all messages with this log level or a lower (hence
 560         more important) log level are shown. If a range is specified,
 561         all messages within the range are shown, including both the
 562         start and the end value of the range. This will add
 563         <literal>PRIORITY=</literal> matches for the specified
 564         priorities.</para></listitem>
 565       </varlistentry>
 566
 567       <varlistentry>
 568         <term><option>-g</option></term>
 569         <term><option>--grep=</option></term>
 570
 571         <listitem><para>Filter output to entries where the <varname>MESSAGE=</varname>
 572         field matches the specified regular expression. PERL-compatible regular expressions
 573         are used, see
 574         <citerefentry><refentrytitle>pcre2pattern</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 575         for a detailed description of the syntax.</para>
 576
 577         <para>If the pattern is all lowercase, matching is case insensitive.
 578         Otherwise, matching is case sensitive. This can be overridden with the
 579         <option>--case-sensitive</option> option, see below.</para>
 580         </listitem>
 581       </varlistentry>
 582
 583       <varlistentry>
 584         <term><option>--case-sensitive<optional>=BOOLEAN</optional></option></term>
 585
 586         <listitem><para>Make pattern matching case sensitive or case insenstive.</para>
 587         </listitem>
 588       </varlistentry>
 589
 590       <varlistentry>
 591         <term><option>-c</option></term>
 592         <term><option>--cursor=</option></term>
 593
 594         <listitem><para>Start showing entries from the location in the
 595         journal specified by the passed cursor.</para></listitem>
 596       </varlistentry>
 597
 598       <varlistentry>
 599         <term><option>--after-cursor=</option></term>
 600
 601         <listitem><para>Start showing entries from the location in the
 602         journal <emphasis>after</emphasis> the location specified by
 603         the passed cursor.  The cursor is shown when the
 604         <option>--show-cursor</option> option is used.</para>
 605         </listitem>
 606       </varlistentry>
 607
 608       <varlistentry>
 609         <term><option>--show-cursor</option></term>
 610
 611         <listitem><para>The cursor is shown after the last entry after
 612         two dashes:</para>
 613         <programlisting>-- cursor: s=0639…</programlisting>
 614         <para>The format of the cursor is private
 615         and subject to change.</para></listitem>
 616       </varlistentry>
 617
 618       <varlistentry>
 619         <term><option>-S</option></term>
 620         <term><option>--since=</option></term>
 621         <term><option>-U</option></term>
 622         <term><option>--until=</option></term>
 623
 624         <listitem><para>Start showing entries on or newer than the specified date, or on or older than the specified
 625         date, respectively. Date specifications should be of the format <literal>2012-10-30 18:17:16</literal>.  If the
 626         time part is omitted, <literal>00:00:00</literal> is assumed.  If only the seconds component is omitted,
 627         <literal>:00</literal> is assumed. If the date component is omitted, the current day is assumed. Alternatively
 628         the strings <literal>yesterday</literal>, <literal>today</literal>, <literal>tomorrow</literal> are understood,
 629         which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day,
 630         respectively. <literal>now</literal> refers to the current time. Finally, relative times may be specified,
 631         prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current
 632         time, respectively. For complete time and date specification, see
 633         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Note that
 634         <option>--output=short-full</option> prints timestamps that follow precisely this format.
 635         </para>
 636         </listitem>
 637       </varlistentry>
 638
 639       <varlistentry>
 640         <term><option>-F</option></term>
 641         <term><option>--field=</option></term>
 642
 643         <listitem><para>Print all possible data values the specified
 644         field can take in all entries of the journal.</para></listitem>
 645       </varlistentry>
 646
 647       <varlistentry>
 648         <term><option>-N</option></term>
 649         <term><option>--fields</option></term>
 650
 651         <listitem><para>Print all field names currently used in all entries of the journal.</para></listitem>
 652       </varlistentry>
 653
 654       <varlistentry>
 655         <term><option>--system</option></term>
 656         <term><option>--user</option></term>
 657
 658         <listitem><para>Show messages from system services and the
 659         kernel (with <option>--system</option>). Show messages from
 660         service of current user (with <option>--user</option>).  If
 661         neither is specified, show all messages that the user can see.
 662         </para></listitem>
 663       </varlistentry>
 664
 665       <varlistentry>
 666         <term><option>-M</option></term>
 667         <term><option>--machine=</option></term>
 668
 669         <listitem><para>Show messages from a running, local
 670         container. Specify a container name to connect to.</para>
 671         </listitem>
 672       </varlistentry>
 673
 674       <varlistentry>
 675         <term><option>-D <replaceable>DIR</replaceable></option></term>
 676         <term><option>--directory=<replaceable>DIR</replaceable></option></term>
 677
 678         <listitem><para>Takes a directory path as argument. If
 679         specified, journalctl will operate on the specified journal
 680         directory <replaceable>DIR</replaceable> instead of the
 681         default runtime and system journal paths.</para></listitem>
 682       </varlistentry>
 683
 684       <varlistentry>
 685         <term><option>--file=<replaceable>GLOB</replaceable></option></term>
 686
 687         <listitem><para>Takes a file glob as an argument. If
 688         specified, journalctl will operate on the specified journal
 689         files matching <replaceable>GLOB</replaceable> instead of the
 690         default runtime and system journal paths. May be specified
 691         multiple times, in which case files will be suitably
 692         interleaved.</para></listitem>
 693       </varlistentry>
 694
 695       <varlistentry>
 696         <term><option>--root=<replaceable>ROOT</replaceable></option></term>
 697
 698         <listitem><para>Takes a directory path as an argument. If
 699         specified, journalctl will operate on journal directories and catalog file hierarchy
 700         underneath the specified directory instead of the root
 701         directory (e.g. <option>--update-catalog</option> will create
 702         <filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>,
 703         and journal files under <filename><replaceable>ROOT</replaceable>/run/journal</filename>
 704         or <filename><replaceable>ROOT</replaceable>/var/log/journal</filename> will be displayed).
 705         </para></listitem>
 706       </varlistentry>
 707
 708       <varlistentry>
 709         <term><option>--header</option></term>
 710
 711         <listitem><para>Instead of showing journal contents, show
 712         internal header information of the journal fields
 713         accessed.</para></listitem>
 714       </varlistentry>
 715
 716       <varlistentry>
 717         <term><option>--disk-usage</option></term>
 718
 719         <listitem><para>Shows the current disk usage of all journal
 720         files. This shows the sum of the disk usage of all archived
 721         and active journal files.</para></listitem>
 722       </varlistentry>
 723
 724       <varlistentry>
 725         <term><option>--vacuum-size=</option></term>
 726         <term><option>--vacuum-time=</option></term>
 727         <term><option>--vacuum-files=</option></term>
 728
 729         <listitem><para>Removes the oldest archived journal files until the disk
 730         space they use falls below the specified size (specified with
 731         the usual <literal>K</literal>, <literal>M</literal>,
 732         <literal>G</literal> and <literal>T</literal> suffixes), or all
 733         archived journal files contain no data older than the specified
 734         timespan (specified with the usual <literal>s</literal>,
 735         <literal>m</literal>, <literal>h</literal>,
 736         <literal>days</literal>, <literal>months</literal>,
 737         <literal>weeks</literal> and <literal>years</literal> suffixes),
 738         or no more than the specified number of separate journal files
 739         remain. Note that running <option>--vacuum-size=</option> has
 740         only an indirect effect on the output shown by
 741         <option>--disk-usage</option>, as the latter includes active
 742         journal files, while the vacuuming operation only operates
 743         on archived journal files. Similarly,
 744         <option>--vacuum-files=</option> might not actually reduce the
 745         number of journal files to below the specified number, as it
 746         will not remove active journal
 747         files. <option>--vacuum-size=</option>,
 748         <option>--vacuum-time=</option> and
 749         <option>--vacuum-files=</option> may be combined in a single
 750         invocation to enforce any combination of a size, a time and a
 751         number of files limit on the archived journal
 752         files. Specifying any of these three parameters as zero is
 753         equivalent to not enforcing the specific limit, and is thus
 754         redundant.</para></listitem>
 755       </varlistentry>
 756
 757       <varlistentry>
 758         <term><option>--list-catalog
 759         <optional><replaceable>128-bit-ID…</replaceable></optional>
 760         </option></term>
 761
 762         <listitem><para>List the contents of the message catalog as a
 763         table of message IDs, plus their short description strings.
 764         </para>
 765
 766         <para>If any <replaceable>128-bit-ID</replaceable>s are
 767         specified, only those entries are shown.</para>
 768         </listitem>
 769       </varlistentry>
 770
 771       <varlistentry>
 772         <term><option>--dump-catalog
 773         <optional><replaceable>128-bit-ID…</replaceable></optional>
 774         </option></term>
 775
 776         <listitem><para>Show the contents of the message catalog, with
 777         entries separated by a line consisting of two dashes and the
 778         ID (the format is the same as <filename>.catalog</filename>
 779         files).</para>
 780
 781         <para>If any <replaceable>128-bit-ID</replaceable>s are
 782         specified, only those entries are shown.</para>
 783         </listitem>
 784       </varlistentry>
 785
 786       <varlistentry>
 787         <term><option>--update-catalog</option></term>
 788
 789         <listitem><para>Update the message catalog index. This command
 790         needs to be executed each time new catalog files are
 791         installed, removed, or updated to rebuild the binary catalog
 792         index.</para></listitem>
 793       </varlistentry>
 794
 795       <varlistentry>
 796         <term><option>--setup-keys</option></term>
 797
 798         <listitem><para>Instead of showing journal contents, generate
 799         a new key pair for Forward Secure Sealing (FSS). This will
 800         generate a sealing key and a verification key. The sealing key
 801         is stored in the journal data directory and shall remain on
 802         the host. The verification key should be stored
 803         externally. Refer to the <option>Seal=</option> option in
 804         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 805         for information on Forward Secure Sealing and for a link to a
 806         refereed scholarly paper detailing the cryptographic theory it
 807         is based on.</para></listitem>
 808       </varlistentry>
 809
 810       <varlistentry>
 811         <term><option>--force</option></term>
 812
 813         <listitem><para>When <option>--setup-keys</option> is passed
 814         and Forward Secure Sealing (FSS) has already been configured,
 815         recreate FSS keys.</para></listitem>
 816       </varlistentry>
 817
 818       <varlistentry>
 819         <term><option>--interval=</option></term>
 820
 821         <listitem><para>Specifies the change interval for the sealing
 822         key when generating an FSS key pair with
 823         <option>--setup-keys</option>. Shorter intervals increase CPU
 824         consumption but shorten the time range of undetectable journal
 825         alterations. Defaults to 15min.</para></listitem>
 826       </varlistentry>
 827
 828       <varlistentry>
 829         <term><option>--verify</option></term>
 830
 831         <listitem><para>Check the journal file for internal
 832         consistency. If the file has been generated with FSS enabled and
 833         the FSS verification key has been specified with
 834         <option>--verify-key=</option>, authenticity of the journal file
 835         is verified.</para></listitem>
 836       </varlistentry>
 837
 838       <varlistentry>
 839         <term><option>--verify-key=</option></term>
 840
 841         <listitem><para>Specifies the FSS verification key to use for
 842         the <option>--verify</option> operation.</para></listitem>
 843       </varlistentry>
 844
 845       <varlistentry>
 846         <term><option>--sync</option></term>
 847
 848         <listitem><para>Asks the journal daemon to write all yet
 849         unwritten journal data to the backing file system and
 850         synchronize all journals. This call does not return until the
 851         synchronization operation is complete. This command guarantees
 852         that any log messages written before its invocation are safely
 853         stored on disk at the time it returns.</para></listitem>
 854       </varlistentry>
 855
 856       <varlistentry>
 857         <term><option>--flush</option></term>
 858
 859         <listitem><para>Asks the journal daemon to flush any log data
 860         stored in <filename>/run/log/journal</filename> into
 861         <filename>/var/log/journal</filename>, if persistent storage
 862         is enabled. This call does not return until the operation is
 863         complete. Note that this call is idempotent: the data is only
 864         flushed from <filename>/run/log/journal</filename> into
 865         <filename>/var/log/journal</filename> once during system
 866         runtime, and this command exits cleanly without executing any
 867         operation if this has already happened. This command
 868         effectively guarantees that all data is flushed to
 869         <filename>/var/log/journal</filename> at the time it
 870         returns.</para></listitem>
 871       </varlistentry>
 872
 873       <varlistentry>
 874         <term><option>--rotate</option></term>
 875
 876         <listitem><para>Asks the journal daemon to rotate journal
 877         files. This call does not return until the rotation operation
 878         is complete.</para></listitem>
 879       </varlistentry>
 880
 881       <xi:include href="standard-options.xml" xpointer="help" />
 882       <xi:include href="standard-options.xml" xpointer="version" />
 883       <xi:include href="standard-options.xml" xpointer="no-pager" />
 884     </variablelist>
 885   </refsect1>
 886
 887   <refsect1>
 888     <title>Exit status</title>
 889
 890     <para>On success, 0 is returned; otherwise, a non-zero failure
 891     code is returned.</para>
 892   </refsect1>
 893
 894   <xi:include href="less-variables.xml" />
 895
 896   <refsect1>
 897     <title>Examples</title>
 898
 899     <para>Without arguments, all collected logs are shown
 900     unfiltered:</para>
 901
 902     <programlisting>journalctl</programlisting>
 903
 904     <para>With one match specified, all entries with a field matching
 905     the expression are shown:</para>
 906
 907     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service
 908 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope</programlisting>
 909
 910     <para>If two different fields are matched, only entries matching
 911     both expressions at the same time are shown:</para>
 912
 913     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
 914
 915     <para>If two matches refer to the same field, all entries matching
 916     either expression are shown:</para>
 917
 918     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
 919
 920     <para>If the separator <literal>+</literal> is used, two
 921     expressions may be combined in a logical OR. The following will
 922     show all messages from the Avahi service process with the PID
 923     28097 plus all messages from the D-Bus service (from any of its
 924     processes):</para>
 925
 926     <programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
 927
 928     <para>To show all fields emitted <emphasis>by</emphasis> a unit and <emphasis>about</emphasis>
 929     the unit, option <option>-u</option>/<option>--unit=</option> should be used.
 930     <command>journalctl -u <replaceable>name</replaceable></command>
 931     expands to a complex filter similar to
 932     <programlisting>_SYSTEMD_UNIT=<replaceable>name</replaceable>.service
 933   + UNIT=<replaceable>name</replaceable>.service _PID=1
 934   + OBJECT_SYSTEMD_UNIT=<replaceable>name</replaceable>.service _UID=0
 935   + COREDUMP_UNIT=<replaceable>name</replaceable>.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
 936     </programlisting>
 937     (see <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 938     for an explanation of those patterns).
 939     </para>
 940
 941     <para>Show all logs generated by the D-Bus executable:</para>
 942
 943     <programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
 944
 945     <para>Show all kernel logs from previous boot:</para>
 946
 947     <programlisting>journalctl -k -b -1</programlisting>
 948
 949     <para>Show a live log display from a system service
 950     <filename>apache.service</filename>:</para>
 951
 952     <programlisting>journalctl -f -u apache</programlisting>
 953
 954   </refsect1>
 955
 956   <refsect1>
 957     <title>See Also</title>
 958     <para>
 959       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 960       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 961       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 962       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 963       <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 964       <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 965       <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 966       <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 967       <citerefentry><refentrytitle>systemd-journal-upload.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 968     </para>
 969   </refsect1>
 970 </refentry>