man/journalctl.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>journalctl</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><style>
   2     a.headerlink {
   3       color: #c60f0f;
   4       font-size: 0.8em;
   5       padding: 0 4px 0 4px;
   6       text-decoration: none;
   7       visibility: hidden;
   8     }
   9
  10     a.headerlink:hover {
  11       background-color: #c60f0f;
  12       color: white;
  13     }
  14
  15     h1:hover > a.headerlink, h2:hover > a.headerlink, h3:hover > a.headerlink, dt:hover > a.headerlink {
  16       visibility: visible;
  17     }
  18   </style><a href="index.html">Index </a>·
  19   <a href="systemd.directives.html">Directives </a>·
  20   <a href="../python-systemd/index.html">Python </a>·
  21   <a href="../libudev/index.html">libudev </a>·
  22   <a href="../libudev/index.html">gudev </a><span style="float:right">systemd 220</span><hr><div class="refentry"><a name="journalctl"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>journalctl — Query the systemd journal</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">journalctl</code>  [OPTIONS...] [MATCHES...]</p></div></div><div class="refsect1"><a name="idm140662946320288"></a><h2 id="Description">Description<a class="headerlink" title="Permalink to this headline" href="#Description">¶</a></h2><p><span class="command"><strong>journalctl</strong></span> may be used to query the
  23       contents of the
  24       <a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>
  25       journal as written by
  26       <a href="systemd-journald.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-journald.service</span>(8)</span></a>.</p><p>If called without parameters, it will show the full
  27       contents of the journal, starting with the oldest entry
  28       collected.</p><p>If one or more match arguments are passed, the output is
  29       filtered accordingly. A match is in the format
  30       "<code class="literal">FIELD=VALUE</code>",
  31       e.g. "<code class="literal">_SYSTEMD_UNIT=httpd.service</code>", referring
  32       to the components of a structured journal entry. See
  33       <a href="systemd.journal-fields.html"><span class="citerefentry"><span class="refentrytitle">systemd.journal-fields</span>(7)</span></a>
  34       for a list of well-known fields. If multiple matches are
  35       specified matching different fields, the log entries are
  36       filtered by both, i.e. the resulting output will show only
  37       entries matching all the specified matches of this kind. If two
  38       matches apply to the same field, then they are automatically
  39       matched as alternatives, i.e. the resulting output will show
  40       entries matching any of the specified matches for the same
  41       field. Finally, the character "<code class="literal">+</code>" may appears
  42       as a separate word between other terms on the command line. This
  43       causes all matches before and after to be combined in a
  44       disjunction (i.e. logical OR).</p><p>As shortcuts for a few types of field/value matches, file
  45       paths may be specified. If a file path refers to an executable
  46       file, this is equivalent to an "<code class="literal">_EXE=</code>" match
  47       for the canonicalized binary path. Similarly, if a path refers
  48       to a device node, this is equivalent to a
  49       "<code class="literal">_KERNEL_DEVICE=</code>" match for the device.</p><p>Additional constraints may be added using options
  50       <code class="option">--boot</code>, <code class="option">--unit=</code>, etc, to
  51       further limit what entries will be shown (logical AND).</p><p>Output is interleaved from all accessible journal files,
  52       whether they are rotated or currently being written, and
  53       regardless of whether they belong to the system itself or are
  54       accessible user journals.</p><p>The set of journal files which will be used can be
  55       modified using the <code class="option">--user</code>,
  56       <code class="option">--system</code>, <code class="option">--directory</code>, and
  57       <code class="option">--file</code> options, see below.</p><p>All users are granted access to their private per-user
  58       journals. However, by default, only root and users who are
  59       members of a few special groups are granted access to the system
  60       journal and the journals of other users. Members of the the
  61       "<code class="literal">systemd-journal</code>", "<code class="literal">adm</code>", and
  62       "<code class="literal">wheel</code>" groups can read all journal files. Note
  63       that the two latter groups traditionally have additional
  64       privileges specified by the distribution. Members of the
  65       "<code class="literal">wheel</code>" group can often perform administrative
  66       tasks.</p><p>The output is paged through <span class="command"><strong>less</strong></span> by
  67       default, and long lines are "truncated" to screen width. The
  68       hidden part can be viewed by using the left-arrow and
  69       right-arrow keys. Paging can be disabled; see the
  70       <code class="option">--no-pager</code> option and the "Environment" section
  71       below.</p><p>When outputting to a tty, lines are colored according to
  72       priority: lines of level ERROR and higher are colored red; lines
  73       of level NOTICE and higher are highlighted; other lines are
  74       displayed normally.</p></div><div class="refsect1"><a name="idm140662941347168"></a><h2 id="Options">Options<a class="headerlink" title="Permalink to this headline" href="#Options">¶</a></h2><p>The following options are understood:</p><div class="variablelist"><dl class="variablelist"><dt id="--no-full"><span class="term"><code class="option">--no-full</code>, </span><span class="term"><code class="option">--full</code>, </span><span class="term"><code class="option">-l</code></span><a class="headerlink" title="Permalink to this term" href="#--no-full">¶</a></dt><dd><p>Ellipsize fields when they do not fit in
  75           available columns.  The default is to show full fields,
  76           allowing them to wrap or be truncated by the pager, if one
  77           is used.</p><p>The old options
  78           <code class="option">-l</code>/<code class="option">--full</code> are not useful
  79           anymore, except to undo <code class="option">--no-full</code>.</p></dd><dt id="-a"><span class="term"><code class="option">-a</code>, </span><span class="term"><code class="option">--all</code></span><a class="headerlink" title="Permalink to this term" href="#-a">¶</a></dt><dd><p>Show all fields in full, even if they
  80           include unprintable characters or are very
  81           long.</p></dd><dt id="-f"><span class="term"><code class="option">-f</code>, </span><span class="term"><code class="option">--follow</code></span><a class="headerlink" title="Permalink to this term" href="#-f">¶</a></dt><dd><p>Show only the most recent journal entries,
  82           and continuously print new entries as they are appended to
  83           the journal.</p></dd><dt id="-e"><span class="term"><code class="option">-e</code>, </span><span class="term"><code class="option">--pager-end</code></span><a class="headerlink" title="Permalink to this term" href="#-e">¶</a></dt><dd><p>Immediately jump to the end of the journal
  84           inside the implied pager tool. This implies
  85           <code class="option">-n1000</code> to guarantee that the pager will not
  86           buffer logs of unbounded size. This may be overridden with
  87           an explicit <code class="option">-n</code> with some other numeric
  88           value while <code class="option">-nall</code> will disable this cap.
  89           Note that this option is only supported for the
  90           <a href="http://man7.org/linux/man-pages/man1/less.1.html"><span class="citerefentry"><span class="refentrytitle">less</span>(1)</span></a>
  91           pager.</p></dd><dt id="-n"><span class="term"><code class="option">-n</code>, </span><span class="term"><code class="option">--lines=</code></span><a class="headerlink" title="Permalink to this term" href="#-n">¶</a></dt><dd><p>Show the most recent journal events and
  92           limit the number of events shown. If
  93           <code class="option">--follow</code> is used, this option is
  94           implied. The argument is a positive integer or
  95           "<code class="literal">all</code>" to disable line limiting. The default
  96           value is 10 if no argument is given.</p></dd><dt id="--no-tail"><span class="term"><code class="option">--no-tail</code></span><a class="headerlink" title="Permalink to this term" href="#--no-tail">¶</a></dt><dd><p>Show all stored output lines, even in follow
  97           mode. Undoes the effect of <code class="option">--lines=</code>.
  98           </p></dd><dt id="-r"><span class="term"><code class="option">-r</code>, </span><span class="term"><code class="option">--reverse</code></span><a class="headerlink" title="Permalink to this term" href="#-r">¶</a></dt><dd><p>Reverse output so that the newest entries
  99           are displayed first.</p></dd><dt id="-o"><span class="term"><code class="option">-o</code>, </span><span class="term"><code class="option">--output=</code></span><a class="headerlink" title="Permalink to this term" href="#-o">¶</a></dt><dd><p>Controls the formatting of the journal
 100           entries that are shown. Takes one of the following
 101           options:</p><div class="variablelist"><dl class="variablelist"><dt id="
 102                 short
 103               "><span class="term">
 104                 <code class="option">short</code>
 105               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20short%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>is the default and generates an output that is
 106                 mostly identical to the formatting of classic syslog
 107                 files, showing one line per journal entry.</p></dd><dt id="
 108                 short-iso
 109               "><span class="term">
 110                 <code class="option">short-iso</code>
 111               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20short-iso%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>is very similar, but shows ISO 8601 wallclock
 112                 timestamps.</p></dd><dt id="
 113                 short-precise
 114               "><span class="term">
 115                 <code class="option">short-precise</code>
 116               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20short-precise%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>is very similar, but shows timestamps with full
 117                 microsecond precision.</p></dd><dt id="
 118                 short-monotonic
 119               "><span class="term">
 120                 <code class="option">short-monotonic</code>
 121               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20short-monotonic%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>is very similar, but shows monotonic timestamps
 122                 instead of wallclock timestamps.</p></dd><dt id="
 123                 verbose
 124               "><span class="term">
 125                 <code class="option">verbose</code>
 126               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20verbose%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>shows the full-structured entry items with all
 127                 fields.</p></dd><dt id="
 128                 export
 129               "><span class="term">
 130                 <code class="option">export</code>
 131               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20export%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>serializes the journal into a binary (but mostly
 132                 text-based) stream suitable for backups and network
 133                 transfer (see
 134                 <a class="ulink" href="http://www.freedesktop.org/wiki/Software/systemd/export" target="_top">Journal Export Format</a>
 135                 for more information).</p></dd><dt id="
 136                 json
 137               "><span class="term">
 138                 <code class="option">json</code>
 139               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20json%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>formats entries as JSON data structures, one per
 140                 line (see
 141                 <a class="ulink" href="http://www.freedesktop.org/wiki/Software/systemd/json" target="_top">Journal JSON Format</a>
 142                 for more information).</p></dd><dt id="
 143                 json-pretty
 144               "><span class="term">
 145                 <code class="option">json-pretty</code>
 146               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20json-pretty%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>formats entries as JSON data structures, but
 147                 formats them in multiple lines in order to make them
 148                 more readable by humans.</p></dd><dt id="
 149                 json-sse
 150               "><span class="term">
 151                 <code class="option">json-sse</code>
 152               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20json-sse%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>formats entries as JSON data structures, but wraps
 153                 them in a format suitable for
 154                 <a class="ulink" href="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events" target="_top">Server-Sent Events</a>.
 155                 </p></dd><dt id="
 156                 cat
 157               "><span class="term">
 158                 <code class="option">cat</code>
 159               </span><a class="headerlink" title="Permalink to this term" href="#%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20cat%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>generates a very terse output, only showing the
 160                 actual message of each journal entry with no metadata,
 161                 not even a timestamp.</p></dd></dl></div></dd><dt id="--utc"><span class="term"><code class="option">--utc</code></span><a class="headerlink" title="Permalink to this term" href="#--utc">¶</a></dt><dd><p>Express time in Coordinated Universal Time
 162         (UTC).</p></dd><dt id="-x"><span class="term"><code class="option">-x</code>, </span><span class="term"><code class="option">--catalog</code></span><a class="headerlink" title="Permalink to this term" href="#-x">¶</a></dt><dd><p>Augment log lines with explanation texts from
 163         the message catalog. This will add explanatory help texts to
 164         log messages in the output where this is available. These
 165         short help texts will explain the context of an error or log
 166         event, possible solutions, as well as pointers to support
 167         forums, developer documentation, and any other relevant
 168         manuals. Note that help texts are not available for all
 169         messages, but only for selected ones. For more information on
 170         the message catalog, please refer to the
 171         <a class="ulink" href="http://www.freedesktop.org/wiki/Software/systemd/catalog" target="_top">Message Catalog Developer Documentation</a>.</p><p>Note: when attaching <span class="command"><strong>journalctl</strong></span>
 172         output to bug reports, please do <span class="emphasis"><em>not</em></span> use
 173         <code class="option">-x</code>.</p></dd><dt id="-q"><span class="term"><code class="option">-q</code>, </span><span class="term"><code class="option">--quiet</code></span><a class="headerlink" title="Permalink to this term" href="#-q">¶</a></dt><dd><p>Suppresses any warning messages regarding
 174         inaccessible system journals when run as a normal
 175         user.</p></dd><dt id="-m"><span class="term"><code class="option">-m</code>, </span><span class="term"><code class="option">--merge</code></span><a class="headerlink" title="Permalink to this term" href="#-m">¶</a></dt><dd><p>Show entries interleaved from all available
 176         journals, including remote ones.</p></dd><dt id="-b ID±offset"><span class="term"><code class="option">-b [<span class="optional"><em class="replaceable"><code>ID</code></em></span>][<span class="optional"><em class="replaceable"><code>±offset</code></em></span>]</code>, </span><span class="term"><code class="option">--boot=[<span class="optional"><em class="replaceable"><code>ID</code></em></span>][<span class="optional"><em class="replaceable"><code>±offset</code></em></span>]</code></span><a class="headerlink" title="Permalink to this term" href="#-b%20ID%C2%B1offset">¶</a></dt><dd><p>Show messages from a specific boot. This will
 177         add a match for "<code class="literal">_BOOT_ID=</code>".</p><p>The argument may be empty, in which case logs for the
 178         current boot will be shown.</p><p>If the boot ID is omitted, a positive
 179         <em class="replaceable"><code>offset</code></em> will look up the boots
 180         starting from the beginning of the journal, and a
 181         equal-or-less-than zero <em class="replaceable"><code>offset</code></em> will
 182         look up boots starting from the end of the journal. Thus,
 183         <code class="constant">1</code> means the first boot found in the
 184         journal in chronological order, <code class="constant">2</code> the
 185         second and so on; while <code class="constant">-0</code> is the last
 186         boot, <code class="constant">-1</code> the boot before last, and so
 187         on. An empty <em class="replaceable"><code>offset</code></em> is equivalent
 188         to specifying <code class="constant">-0</code>, except when the current
 189         boot is not the last boot (e.g. because
 190         <code class="option">--directory</code> was specified to look at logs
 191         from a different machine).</p><p>If the 32-character <em class="replaceable"><code>ID</code></em> is
 192         specified, it may optionally be followed by
 193         <em class="replaceable"><code>offset</code></em> which identifies the boot
 194         relative to the one given by boot
 195         <em class="replaceable"><code>ID</code></em>. Negative values mean earlier
 196         boots and a positive values mean later boots. If
 197         <em class="replaceable"><code>offset</code></em> is not specified, a value of
 198         zero is assumed, and the logs for the boot given by
 199         <em class="replaceable"><code>ID</code></em> are shown.</p></dd><dt id="--list-boots"><span class="term"><code class="option">--list-boots</code></span><a class="headerlink" title="Permalink to this term" href="#--list-boots">¶</a></dt><dd><p>Show a tabular list of boot numbers (relative to
 200         the current boot), their IDs, and the timestamps of the first
 201         and last message pertaining to the boot.</p></dd><dt id="-k"><span class="term"><code class="option">-k</code>, </span><span class="term"><code class="option">--dmesg</code></span><a class="headerlink" title="Permalink to this term" href="#-k">¶</a></dt><dd><p>Show only kernel messages. This implies
 202         <code class="option">-b</code> and adds the match
 203         "<code class="literal">_TRANSPORT=kernel</code>".</p></dd><dt id="-t"><span class="term"><code class="option">-t</code>, </span><span class="term"><code class="option">--identifier=<em class="replaceable"><code>SYSLOG_IDENTIFIER</code></em>|<em class="replaceable"><code>PATTERN</code></em></code></span><a class="headerlink" title="Permalink to this term" href="#-t">¶</a></dt><dd><p>Show messages for the specified syslog
 204         identifier <em class="replaceable"><code>SYSLOG_IDENTIFIER</code></em>, or
 205         for any of the messages with a
 206         "<code class="literal">SYSLOG_IDENTIFIER</code>" matched by
 207         <em class="replaceable"><code>PATTERN</code></em>.</p><p>This parameter can be specified multiple
 208         times.</p></dd><dt id="-u"><span class="term"><code class="option">-u</code>, </span><span class="term"><code class="option">--unit=<em class="replaceable"><code>UNIT</code></em>|<em class="replaceable"><code>PATTERN</code></em></code></span><a class="headerlink" title="Permalink to this term" href="#-u">¶</a></dt><dd><p>Show messages for the specified systemd unit
 209         <em class="replaceable"><code>UNIT</code></em> (such as a service unit), or
 210         for any of the units matched by
 211         <em class="replaceable"><code>PATTERN</code></em>.  If a pattern is
 212         specified, a list of unit names found in the journal is
 213         compared with the specified pattern and all that match are
 214         used. For each unit name, a match is added for messages from
 215         the unit
 216         ("<code class="literal">_SYSTEMD_UNIT=<em class="replaceable"><code>UNIT</code></em></code>"),
 217         along with additional matches for messages from systemd and
 218         messages about coredumps for the specified unit.</p><p>This parameter can be specified multiple times.</p></dd><dt id="--user-unit="><span class="term"><code class="option">--user-unit=</code></span><a class="headerlink" title="Permalink to this term" href="#--user-unit=">¶</a></dt><dd><p>Show messages for the specified user session
 219         unit. This will add a match for messages from the unit
 220         ("<code class="literal">_SYSTEMD_USER_UNIT=</code>" and
 221         "<code class="literal">_UID=</code>") and additional matches for messages
 222         from session systemd and messages about coredumps for the
 223         specified unit.</p><p>This parameter can be specified multiple times.</p></dd><dt id="-p"><span class="term"><code class="option">-p</code>, </span><span class="term"><code class="option">--priority=</code></span><a class="headerlink" title="Permalink to this term" href="#-p">¶</a></dt><dd><p>Filter output by message priorities or
 224         priority ranges. Takes either a single numeric or textual log
 225         level (i.e. between 0/"<code class="literal">emerg</code>" and
 226         7/"<code class="literal">debug</code>"), or a range of numeric/text log
 227         levels in the form FROM..TO. The log levels are the usual
 228         syslog log levels as documented in
 229         <a href="http://man7.org/linux/man-pages/man3/syslog.3.html"><span class="citerefentry"><span class="refentrytitle">syslog</span>(3)</span></a>,
 230         i.e. "<code class="literal">emerg</code>" (0),
 231         "<code class="literal">alert</code>" (1), "<code class="literal">crit</code>" (2),
 232         "<code class="literal">err</code>" (3), "<code class="literal">warning</code>" (4),
 233         "<code class="literal">notice</code>" (5), "<code class="literal">info</code>" (6),
 234         "<code class="literal">debug</code>" (7). If a single log level is
 235         specified, all messages with this log level or a lower (hence
 236         more important) log level are shown. If a range is specified,
 237         all messages within the range are shown, including both the
 238         start and the end value of the range. This will add
 239         "<code class="literal">PRIORITY=</code>" matches for the specified
 240         priorities.</p></dd><dt id="-c"><span class="term"><code class="option">-c</code>, </span><span class="term"><code class="option">--cursor=</code></span><a class="headerlink" title="Permalink to this term" href="#-c">¶</a></dt><dd><p>Start showing entries from the location in the
 241         journal specified by the passed cursor.</p></dd><dt id="--after-cursor="><span class="term"><code class="option">--after-cursor=</code></span><a class="headerlink" title="Permalink to this term" href="#--after-cursor=">¶</a></dt><dd><p>Start showing entries from the location in the
 242         journal <span class="emphasis"><em>after</em></span> the location specified by
 243         the this cursor.  The cursor is shown when the
 244         <code class="option">--show-cursor</code> option is used.</p></dd><dt id="--show-cursor"><span class="term"><code class="option">--show-cursor</code></span><a class="headerlink" title="Permalink to this term" href="#--show-cursor">¶</a></dt><dd><p>The cursor is shown after the last entry after
 245         two dashes:</p><pre class="programlisting">-- cursor: s=0639...</pre><p>The format of the cursor is private
 246         and subject to change.</p></dd><dt id="--since="><span class="term"><code class="option">--since=</code>, </span><span class="term"><code class="option">--until=</code></span><a class="headerlink" title="Permalink to this term" href="#--since=">¶</a></dt><dd><p>Start showing entries on or newer than the
 247         specified date, or on or older than the specified date,
 248         respectively. Date specifications should be of the format
 249         "<code class="literal">2012-10-30 18:17:16</code>".  If the time part is
 250         omitted, "<code class="literal">00:00:00</code>" is assumed.  If only the
 251         seconds component is omitted, "<code class="literal">:00</code>" is
 252         assumed. If the date component is omitted, the current day is
 253         assumed. Alternatively the strings
 254         "<code class="literal">yesterday</code>", "<code class="literal">today</code>",
 255         "<code class="literal">tomorrow</code>" are understood, which refer to
 256         00:00:00 of the day before the current day, the current day,
 257         or the day after the current day,
 258         respectively. "<code class="literal">now</code>" refers to the current
 259         time. Finally, relative times may be specified, prefixed with
 260         "<code class="literal">-</code>" or "<code class="literal">+</code>", referring to
 261         times before or after the current time, respectively.</p></dd><dt id="-F"><span class="term"><code class="option">-F</code>, </span><span class="term"><code class="option">--field=</code></span><a class="headerlink" title="Permalink to this term" href="#-F">¶</a></dt><dd><p>Print all possible data values the specified
 262         field can take in all entries of the journal.</p></dd><dt id="--system"><span class="term"><code class="option">--system</code>, </span><span class="term"><code class="option">--user</code></span><a class="headerlink" title="Permalink to this term" href="#--system">¶</a></dt><dd><p>Show messages from system services and the
 263         kernel (with <code class="option">--system</code>). Show messages from
 264         service of current user (with <code class="option">--user</code>).  If
 265         neither is specified, show all messages that the user can see.
 266         </p></dd><dt id="-M"><span class="term"><code class="option">-M</code>, </span><span class="term"><code class="option">--machine=</code></span><a class="headerlink" title="Permalink to this term" href="#-M">¶</a></dt><dd><p>Show messages from a running, local
 267         container. Specify a container name to connect to.</p></dd><dt id="-D DIR"><span class="term"><code class="option">-D <em class="replaceable"><code>DIR</code></em></code>, </span><span class="term"><code class="option">--directory=<em class="replaceable"><code>DIR</code></em></code></span><a class="headerlink" title="Permalink to this term" href="#-D%20DIR">¶</a></dt><dd><p>Takes a directory path as argument. If
 268         specified, journalctl will operate on the specified journal
 269         directory <em class="replaceable"><code>DIR</code></em> instead of the
 270         default runtime and system journal paths.</p></dd><dt id="--file=GLOB"><span class="term"><code class="option">--file=<em class="replaceable"><code>GLOB</code></em></code></span><a class="headerlink" title="Permalink to this term" href="#--file=GLOB">¶</a></dt><dd><p>Takes a file glob as an argument. If
 271         specified, journalctl will operate on the specified journal
 272         files matching <em class="replaceable"><code>GLOB</code></em> instead of the
 273         default runtime and system journal paths. May be specified
 274         multiple times, in which case files will be suitably
 275         interleaved.</p></dd><dt id="--root=ROOT"><span class="term"><code class="option">--root=<em class="replaceable"><code>ROOT</code></em></code></span><a class="headerlink" title="Permalink to this term" href="#--root=ROOT">¶</a></dt><dd><p>Takes a directory path as an argument. If
 276         specified, journalctl will operate on catalog file hierarchy
 277         underneath the specified directory instead of the root
 278         directory (e.g. <code class="option">--update-catalog</code> will create
 279         <code class="filename"><em class="replaceable"><code>ROOT</code></em>/var/lib/systemd/catalog/database</code>).
 280         </p></dd><dt id="--new-id128"><span class="term"><code class="option">--new-id128</code></span><a class="headerlink" title="Permalink to this term" href="#--new-id128">¶</a></dt><dd><p>Instead of showing journal contents, generate
 281         a new 128-bit ID suitable for identifying messages. This is
 282         intended for usage by developers who need a new identifier for
 283         a new message they introduce and want to make
 284         recognizable. This will print the new ID in three different
 285         formats which can be copied into source code or similar.
 286         </p></dd><dt id="--header"><span class="term"><code class="option">--header</code></span><a class="headerlink" title="Permalink to this term" href="#--header">¶</a></dt><dd><p>Instead of showing journal contents, show
 287         internal header information of the journal fields
 288         accessed.</p></dd><dt id="--disk-usage"><span class="term"><code class="option">--disk-usage</code></span><a class="headerlink" title="Permalink to this term" href="#--disk-usage">¶</a></dt><dd><p>Shows the current disk usage of all journal
 289         files. This shows the sum of the disk usage of all archived
 290         and active journal files.</p></dd><dt id="--vacuum-size="><span class="term"><code class="option">--vacuum-size=</code>, </span><span class="term"><code class="option">--vacuum-time=</code></span><a class="headerlink" title="Permalink to this term" href="#--vacuum-size=">¶</a></dt><dd><p>Removes archived journal files until the disk
 291         space they use falls below the specified size (specified with
 292         the usual "<code class="literal">K</code>", "<code class="literal">M</code>",
 293         "<code class="literal">G</code>", "<code class="literal">T</code>" suffixes), or all
 294         journal files contain no data older than the specified
 295         timespan (specified with the usual "<code class="literal">s</code>",
 296         "<code class="literal">min</code>", "<code class="literal">h</code>",
 297         "<code class="literal">days</code>", "<code class="literal">months</code>",
 298         "<code class="literal">weeks</code>", "<code class="literal">years</code>"
 299         suffixes). Note that running <code class="option">--vacuum-size=</code>
 300         has only indirect effect on the output shown by
 301         <code class="option">--disk-usage</code> as the latter includes active
 302         journal files, while the former only operates on archived
 303         journal files. <code class="option">--vacuum-size=</code> and
 304         <code class="option">--vacuum-time=</code> may be combined in a single
 305         invocation to enforce both a size and time limit on the
 306         archived journal files.</p></dd><dt id="--list-catalog
 307         128-bit-ID...
 308         "><span class="term"><code class="option">--list-catalog
 309         [<span class="optional"><em class="replaceable"><code>128-bit-ID...</code></em></span>]
 310         </code></span><a class="headerlink" title="Permalink to this term" href="#--list-catalog%0A%20%20%20%20%20%20%20%20128-bit-ID...%0A%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>List the contents of the message catalog as a
 311         table of message IDs, plus their short description strings.
 312         </p><p>If any <em class="replaceable"><code>128-bit-ID</code></em>s are
 313         specified, only those entries are shown.</p></dd><dt id="--dump-catalog
 314         128-bit-ID...
 315         "><span class="term"><code class="option">--dump-catalog
 316         [<span class="optional"><em class="replaceable"><code>128-bit-ID...</code></em></span>]
 317         </code></span><a class="headerlink" title="Permalink to this term" href="#--dump-catalog%0A%20%20%20%20%20%20%20%20128-bit-ID...%0A%20%20%20%20%20%20%20%20">¶</a></dt><dd><p>Show the contents of the message catalog, with
 318         entries separated by a line consisting of two dashes and the
 319         ID (the format is the same as <code class="filename">.catalog</code>
 320         files).</p><p>If any <em class="replaceable"><code>128-bit-ID</code></em>s are
 321         specified, only those entries are shown.</p></dd><dt id="--update-catalog"><span class="term"><code class="option">--update-catalog</code></span><a class="headerlink" title="Permalink to this term" href="#--update-catalog">¶</a></dt><dd><p>Update the message catalog index. This command
 322         needs to be executed each time new catalog files are
 323         installed, removed, or updated to rebuild the binary catalog
 324         index.</p></dd><dt id="--setup-keys"><span class="term"><code class="option">--setup-keys</code></span><a class="headerlink" title="Permalink to this term" href="#--setup-keys">¶</a></dt><dd><p>Instead of showing journal contents, generate
 325         a new key pair for Forward Secure Sealing (FSS). This will
 326         generate a sealing key and a verification key. The sealing key
 327         is stored in the journal data directory and shall remain on
 328         the host. The verification key should be stored
 329         externally. Refer to the <code class="option">Seal=</code> option in
 330         <a href="journald.conf.html"><span class="citerefentry"><span class="refentrytitle">journald.conf</span>(5)</span></a>
 331         for information on Forward Secure Sealing and for a link to a
 332         refereed scholarly paper detailing the cryptographic theory it
 333         is based on.</p></dd><dt id="--force"><span class="term"><code class="option">--force</code></span><a class="headerlink" title="Permalink to this term" href="#--force">¶</a></dt><dd><p>When <code class="option">--setup-keys</code> is passed
 334         and Forward Secure Sealing (FSS) has already been configured,
 335         recreate FSS keys.</p></dd><dt id="--interval="><span class="term"><code class="option">--interval=</code></span><a class="headerlink" title="Permalink to this term" href="#--interval=">¶</a></dt><dd><p>Specifies the change interval for the sealing
 336         key when generating an FSS key pair with
 337         <code class="option">--setup-keys</code>. Shorter intervals increase CPU
 338         consumption but shorten the time range of undetectable journal
 339         alterations. Defaults to 15min.</p></dd><dt id="--verify"><span class="term"><code class="option">--verify</code></span><a class="headerlink" title="Permalink to this term" href="#--verify">¶</a></dt><dd><p>Check the journal file for internal
 340         consistency. If the file has been generated with FSS enabled and
 341         the FSS verification key has been specified with
 342         <code class="option">--verify-key=</code>, authenticity of the journal file
 343         is verified.</p></dd><dt id="--verify-key="><span class="term"><code class="option">--verify-key=</code></span><a class="headerlink" title="Permalink to this term" href="#--verify-key=">¶</a></dt><dd><p>Specifies the FSS verification key to use for
 344         the <code class="option">--verify</code> operation.</p></dd><dt id="--flush"><span class="term"><code class="option">--flush</code></span><a class="headerlink" title="Permalink to this term" href="#--flush">¶</a></dt><dd><p>Asks the Journal daemon to flush any log data
 345         stored in <code class="filename">/run/log/journal</code> into
 346         <code class="filename">/var/log/journal</code>, if persistent storage is
 347         enabled. This call does not return until the operation is
 348         complete.</p></dd><dt id="-h"><span class="term"><code class="option">-h</code>, </span><span class="term"><code class="option">--help</code></span><a class="headerlink" title="Permalink to this term" href="#-h">¶</a></dt><dd><p><a name="help-text"></a>Print a short help text and exit.
 349     </p></dd><dt id="--version"><span class="term"><code class="option">--version</code></span><a class="headerlink" title="Permalink to this term" href="#--version">¶</a></dt><dd><p><a name="version-text"></a>Print a short version string and exit.</p></dd><dt id="--no-pager"><span class="term"><code class="option">--no-pager</code></span><a class="headerlink" title="Permalink to this term" href="#--no-pager">¶</a></dt><dd><p>Do not pipe output into a pager.</p></dd></dl></div></div><div class="refsect1"><a name="idm140662941179072"></a><h2 id="Exit status">Exit status<a class="headerlink" title="Permalink to this headline" href="#Exit%20status">¶</a></h2><p>On success, 0 is returned; otherwise, a non-zero failure
 350     code is returned.</p></div><div class="refsect1"><a name="idm140662933007840"></a><h2 id="Environment">Environment<a class="headerlink" title="Permalink to this headline" href="#Environment">¶</a></h2><div class="variablelist"><dl class="variablelist"><dt id="$SYSTEMD_PAGER"><span class="term"><code class="varname">$SYSTEMD_PAGER</code></span><a class="headerlink" title="Permalink to this term" href="#%24SYSTEMD_PAGER">¶</a></dt><dd><p>Pager to use when
 351                         <code class="option">--no-pager</code> is not given;
 352                         overrides <code class="varname">$PAGER</code>.  Setting
 353                         this to an empty string or the value
 354                         "<code class="literal">cat</code>" is equivalent to passing
 355                         <code class="option">--no-pager</code>.</p></dd><dt id="$SYSTEMD_LESS"><span class="term"><code class="varname">$SYSTEMD_LESS</code></span><a class="headerlink" title="Permalink to this term" href="#%24SYSTEMD_LESS">¶</a></dt><dd><p>Override the default
 356                         options passed to
 357                         <span class="command"><strong>less</strong></span>
 358                         ("<code class="literal">FRSXMK</code>").</p></dd></dl></div></div><div class="refsect1"><a name="idm140662941177328"></a><h2 id="Examples">Examples<a class="headerlink" title="Permalink to this headline" href="#Examples">¶</a></h2><p>Without arguments, all collected logs are shown
 359     unfiltered:</p><pre class="programlisting">journalctl</pre><p>With one match specified, all entries with a field matching
 360     the expression are shown:</p><pre class="programlisting">journalctl _SYSTEMD_UNIT=avahi-daemon.service</pre><p>If two different fields are matched, only entries matching
 361     both expressions at the same time are shown:</p><pre class="programlisting">journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</pre><p>If two matches refer to the same field, all entries matching
 362     either expression are shown:</p><pre class="programlisting">journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</pre><p>If the separator "<code class="literal">+</code>" is used, two
 363     expressions may be combined in a logical OR. The following will
 364     show all messages from the Avahi service process with the PID
 365     28097 plus all messages from the D-Bus service (from any of its
 366     processes):</p><pre class="programlisting">journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</pre><p>Show all logs generated by the D-Bus executable:</p><pre class="programlisting">journalctl /usr/bin/dbus-daemon</pre><p>Show all kernel logs from previous boot:</p><pre class="programlisting">journalctl -k -b -1</pre><p>Show a live log display from a system service
 367     <code class="filename">apache.service</code>:</p><pre class="programlisting">journalctl -f -u apache</pre></div><div class="refsect1"><a name="idm140662941166304"></a><h2 id="See Also">See Also<a class="headerlink" title="Permalink to this headline" href="#See%20Also">¶</a></h2><p>
 368       <a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>,
 369       <a href="systemd-journald.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-journald.service</span>(8)</span></a>,
 370       <a href="systemctl.html"><span class="citerefentry"><span class="refentrytitle">systemctl</span>(1)</span></a>,
 371       <a href="coredumpctl.html"><span class="citerefentry"><span class="refentrytitle">coredumpctl</span>(1)</span></a>,
 372       <a href="systemd.journal-fields.html"><span class="citerefentry"><span class="refentrytitle">systemd.journal-fields</span>(7)</span></a>,
 373       <a href="journald.conf.html"><span class="citerefentry"><span class="refentrytitle">journald.conf</span>(5)</span></a>
 374     </p></div></div></body></html>