<?xml version='1.0'?> <!--*-nxml-*-->

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">

<refentry id="journalctl">

<refentryinfo>

<title>journalctl</title>

<productname>systemd</productname>

<authorgroup>

<author>

<contrib>Developer</contrib>

<firstname>Lennart</firstname>

<surname>Poettering</surname>

<email>lennart@poettering.net</email>

</author>

</authorgroup>

</refentryinfo>

<refmeta>

<refentrytitle>journalctl</refentrytitle>

<manvolnum>1</manvolnum>

</refmeta>

<refnamediv>

<refname>journalctl</refname>

<refpurpose>Query the systemd journal</refpurpose>

</refnamediv>

<refsynopsisdiv>

<cmdsynopsis>

<command>journalctl</command>

<arg choice="opt" rep="repeat">OPTIONS</arg>

<arg choice="opt" rep="repeat">MATCHES</arg>

</cmdsynopsis>

</refsynopsisdiv>

<refsect1>

<title>Description</title>

<para><command>journalctl</command> may be used to

query the contents of the

<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>

journal as written by

<citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>

<para>If called without parameters, it will show the full

contents of the journal, starting with the oldest

entry collected.</para>

<para>If one or more match arguments are passed, the

output is filtered accordingly. A match is in the

format <literal>FIELD=VALUE</literal>,

e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,

referring to the components of a structured journal

entry. See

<citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>

for a list of well-known fields. If multiple matches

are specified matching different fields, the log

entries are filtered by both, i.e. the resulting output

will show only entries matching all the specified

matches of this kind. If two matches apply to the same

field, then they are automatically matched as

alternatives, i.e. the resulting output will show

entries matching any of the specified matches for the

same field. Finally, if the character

<literal>+</literal> appears as separate word on the

command line, all matches before and after are combined

in a disjunction (i.e. logical OR).</para>

<para>As shortcuts for a few types of field/value

matches, file paths may be specified. If a file path

refers to an executable file, this is equivalent to an

<literal>_EXE=</literal> match for the canonicalized

binary path. Similarly, if a path refers to a device

node, this is equivalent to a

<literal>_KERNEL_DEVICE=</literal> match for the

device.</para>

<para>Output is interleaved from all accessible

journal files, whether they are rotated or currently

being written, and regardless of whether they belong to the

system itself or are accessible user journals.</para>

<para>All users are granted access to their private

per-user journals. However, by default, only root and

users who are members of the <literal>adm</literal>

group get access to the system journal and the

journals of other users.</para>

<para>The output is paged through

<command>less</command> by default, and long lines are

"truncated" to screen width. The hidden part can be

viewed by using the left-arrow and right-arrow

keys. Paging can be disabled, see

<option>--no-pager</option> and section Environment

below.</para>

<para>When outputing to a tty, lines are colored

according to priority: lines of level ERROR and higher

are colored red, lines of level NOTICE and higher are

highlighted, and other lines are displayed normally.

</para>

</refsect1>

<refsect1>

<title>Options</title>

<para>The following options are understood:</para>

<variablelist>

<varlistentry>

<term><option>-h</option></term>

<term><option>--help</option></term>

<listitem><para>Prints a short help

text and exits.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--version</option></term>

<listitem><para>Prints a short version

string and exits.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--no-pager</option></term>

<listitem><para>Do not pipe output into a

pager.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-l</option></term>

<term><option>--full</option></term>

<listitem><para>Show all (printable) fields in

full.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-a</option></term>

<term><option>--all</option></term>

<listitem><para>Show all fields in

full, even if they include unprintable

characters or are very

long.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-f</option></term>

<term><option>--follow</option></term>

<listitem><para>Show only the most recent

journal entries, and continuously print

new entries as they are appended to

the journal.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-e</option></term>

<term><option>--pager-end</option></term>

<listitem><para>Immediately jump to

the end of the journal inside the

implied pager tool. This implies

<option>-n1000</option> to guarantee

that the pager will not buffer logs of

unbounded size. This may be overridden

with an explicit <option>-n</option>

with some other numeric value on the

command line. Note that this option is

only supported for the

<citerefentry><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>

pager.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-n</option></term>

<term><option>--lines=</option></term>

<listitem><para>Show the most recent

journal events and limit the number of

events shown. If

<option>--follow</option> is used,

this option is implied. The argument,

a positive integer, is optional, and

defaults to 10. </para></listitem>

</varlistentry>

<varlistentry>

<term><option>--no-tail</option></term>

<listitem><para>Show all stored output

lines, even in follow mode. Undoes the

effect of

<option>--lines=</option>.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-r</option></term>

<term><option>--reverse</option></term>

<listitem><para>Reverse output, so the newest

entries are displayed first.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-o</option></term>

<term><option>--output=</option></term>

<listitem><para>Controls the

formatting of the journal entries that

are shown. Takes one of the following options:

</para>

<variablelist>

<varlistentry>

<term>

<option>short</option>

</term>

<listitem>

<para>is the default

and generates an output

that is mostly identical

to the formatting of

classic syslog files,

showing one line per

journal entry.</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>short-iso</option>

</term>

<listitem>

<para>is very similar,

but shows ISO 8601

wallclock timestamps.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>short-precise</option>

</term>

<listitem>

<para>is very similar,

but shows timestamps

with full microsecond

precision.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>short-monotonic</option>

</term>

<listitem>

<para>is very similar

but shows monotonic

timestamps instead of

wallclock timestamps.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>verbose</option>

</term>

<listitem>

<para>shows the

full-structured entry

items with all fields.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>export</option>

</term>

<listitem>

<para>serializes the

journal into a binary

(but mostly text-based)

stream suitable for

backups and network

transfer (see <ulink

url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal

Export Format</ulink>

for more

information).</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>json</option>

</term>

<listitem>

<para>formats entries

as JSON data structures,

one per line (see <ulink

url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal

JSON Format</ulink> for

more information).</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>json-pretty</option>

</term>

<listitem>

<para>formats entries as

JSON data structures,

but formats them in

multiple lines in order

to make them more

readable for humans.</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>json-sse</option>

</term>

<listitem>

<para>formats entries as

JSON data structures,

but wraps them in a

format suitable for <ulink

url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent

Events</ulink>.</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>cat</option>

</term>

<listitem>

<para>generates a very

terse output only

showing the actual

message of each journal

entry with no meta data,

not even a timestamp.

</para>

</listitem>

</varlistentry>

</variablelist>

</listitem>

</varlistentry>

<varlistentry>

<term><option>-x</option></term>

<term><option>--catalog</option></term>

<listitem><para>Augment log lines with

explanation texts from the message

catalog. This will add explanatory

help texts to log messages in the

output where this is available. These

short help texts will explain the

context of an error or log event,

possible solutions, as well as

pointers to support forums, developer

documentation and any other relevant

manuals. Note that help texts are not

available for all messages, but only

for selected ones. For more

information on the message catalog,

please refer to the <ulink

url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message

Catalog Developer

Documentation</ulink>.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-q</option></term>

<term><option>--quiet</option></term>

<listitem><para>Suppresses any warning

message regarding inaccessible system

journals when run as normal

user.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-m</option></term>

<term><option>--merge</option></term>

<listitem><para>Show entries

interleaved from all available

journals, including remote

ones.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-b <optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>

<term><option>--boot=<optional><replaceable>ID</replaceable></optional><optional><replaceable>±offset</replaceable></optional></option></term>

<listitem><para>Show messages from a specific

boot. This will add a match for

<literal>_BOOT_ID=</literal>.</para>

<para>The argument may be empty, in which case

logs for the current boot will be shown.</para>

<para>If the boot ID is omitted, a positive

<replaceable>offset</replaceable> will look up

the boots starting from the beginning of the

journal, and a equal-or-less-than zero

<replaceable>offset</replaceable> will look up

boots starting from the end of the

journal. Thus, <constant>1</constant> means the

first boot found in the journal in the

chronological order, <constant>2</constant> the

second and so on; while <constant>-0</constant>

is the last boot, <constant>-1</constant> the

boot before that, and so on. An empty

<replaceable>offset</replaceable> is equivalent

to specifying <constant>-0</constant>, except

when the current boot is not the last boot

(e.g. because <option>--directory</option> was

specified to look at logs from a different

machine).</para>

<para>If the 32 character

<replaceable>ID</replaceable> is specified, it

may optionally be followed by

<replaceable>offset</replaceable> which

identifies the boot relative to the one given by

boot <replaceable>ID</replaceable>. Negative

values mean earlier boots and a positive values

mean later boots. If

<replaceable>offset</replaceable> is not

specified, a value of zero is assumed and the

logs for the boot given by

<replaceable>ID</replaceable> are shown.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>-k</option></term>

<term><option>--dmesg</option></term>

<listitem><para>Show only kernel messages. This

implies <option>-b</option> and adds the match

<literal>_TRANSPORT=kernel</literal>.

</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-u</option></term>

<term><option>--unit=</option></term>

<listitem><para>Show messages for the

specified systemd unit. This will add

a match for messages from the unit

(<literal>_SYSTEMD_UNIT=</literal>)

and additional matches for messages

from systemd and messages about

coredumps for the specified unit.</para>

<para>This parameter can be specified multiple times.

</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--user-unit=</option></term>

<listitem><para>Show messages for the

specified user session unit. This will

add a match for messages from the unit

(<literal>_SYSTEMD_USER_UNIT=</literal>

and <literal>_UID=</literal>) and

additional matches for messages from

session systemd and messages about

coredumps for the specified unit.</para>

<para>This parameter can be specified multiple times.

</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-p</option></term>

<term><option>--priority=</option></term>

<listitem><para>Filter output by

message priorities or priority

ranges. Takes either a single numeric

or textual log level (i.e. between

0/<literal>emerg</literal> and

7/<literal>debug</literal>), or a

range of numeric/text log levels in

the form FROM..TO. The log levels are

the usual syslog log levels as

documented in

<citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,

i.e. <literal>emerg</literal> (0),

<literal>alert</literal> (1),

<literal>crit</literal> (2),

<literal>err</literal> (3),

<literal>warning</literal> (4),

<literal>notice</literal> (5),

<literal>info</literal> (6),

<literal>debug</literal> (7). If a

single log level is specified, all

messages with this log level or a

lower (hence more important) log level

are shown. If a range is specified, all

messages within the range are shown,

including both the start and the end

value of the range. This will add

<literal>PRIORITY=</literal> matches

for the specified

priorities.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-c</option></term>

<term><option>--cursor=</option></term>

<listitem><para>Start showing entries

from the location in the journal

specified by the passed

cursor.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--after-cursor=</option></term>

<listitem><para>Start showing entries from the

location in the journal

<emphasis>after</emphasis> the location

specified by the this cursor.

</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--since=</option></term>

<term><option>--until=</option></term>

<listitem><para>Start showing entries

on or newer than the specified date,

or on or older than the specified

date, respectively. Date specifications

should be of the format

<literal>2012-10-30 18:17:16</literal>.

If the time part is omitted,

<literal>00:00:00</literal> is assumed.

If only the seconds component is omitted,

<literal>:00</literal> is assumed. If the

date component is omitted, the current

day is assumed. Alternatively the strings

<literal>yesterday</literal>,

<literal>today</literal>,

<literal>tomorrow</literal> are

understood, which refer to 00:00:00 of

the day before the current day, the

current day, or the day after the

current day, respectively. <literal>now</literal>

refers to the current time. Finally,

relative times may be specified,

prefixed with <literal>-</literal> or

<literal>+</literal>, referring to

times before or after the current

time, respectively.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-F</option></term>

<term><option>--field=</option></term>

<listitem><para>Print all possible

data values the specified field can

take in all entries of the

journal.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--system</option></term>

<term><option>--user</option></term>

<listitem><para>Show messages from

system services and the kernel (with

<option>--system</option>). Show

messages from service of current user

(with <option>--user</option>).

If neither is specified, show all

messages that the user can see.

</para></listitem>

</varlistentry>

<varlistentry>

<term><option>-D <replaceable>DIR</replaceable></option></term>

<term><option>--directory=<replaceable>DIR</replaceable></option></term>

<listitem><para>Takes a directory path

as argument. If specified, journalctl

will operate on the specified journal

directory

<replaceable>DIR</replaceable> instead

of the default runtime and system

journal paths.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--file=<replaceable>GLOB</replaceable></option></term>

<listitem><para>Takes a file glob as

argument. If specified, journalctl will

operate on the specified journal files

matching <replaceable>GLOB</replaceable>

instead of the default runtime and

system journal paths. May be specified

multiple times, in which case files will

be suitably interleaved.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--root=<replaceable>ROOT</replaceable></option></term>

<listitem><para>Takes a directory path

as argument. If specified, journalctl

will operate on catalog file hierarchy

underneath the specified directory

instead of the root directory

(e.g. <option>--update-catalog</option>

will create

<filename><replaceable>ROOT</replaceable>/var/lib/systemd/catalog/database</filename>).

</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--new-id128</option></term>

<listitem><para>Instead of showing

journal contents, generate a new 128

bit ID suitable for identifying

messages. This is intended for usage

by developers who need a new

identifier for a new message they

introduce and want to make

recognizable. This will print the new ID in

three different formats which can be

copied into source code or

similar.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--header</option></term>

<listitem><para>Instead of showing

journal contents, show internal header

information of the journal fields

accessed.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--disk-usage</option></term>

<listitem><para>Shows the current disk

usage of all

journal files.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--list-catalog

<optional><replaceable>ID128...</replaceable></optional>

</option></term>

<listitem><para>List the contents of

the message catalog, as table of

message IDs plus their short

description strings.</para>

<para>If any

<replaceable>ID128</replaceable>s are

specified, only those entries are shown.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>--dump-catalog

<optional><replaceable>ID128...</replaceable></optional>

</option></term>

<listitem><para>Show the contents of

the message catalog, with entries

separated by a line consisting of two

dashes and the id (the format is the

same as <filename>.catalog</filename>

files.</para>

<para>If any

<replaceable>ID128</replaceable>s are

specified, only those entries are shown.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>--update-catalog</option></term>

<listitem><para>Update the message

catalog index. This command needs to

be executed each time new catalog

files are installed, removed or

updated to rebuild the binary catalog

index.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--setup-keys</option></term>

<listitem><para>Instead of showing

journal contents, generate a new key

pair for Forward Secure Sealing

(FSS). This will generate a sealing

key and a verification key. The

sealing key is stored in the journal

data directory and shall remain on the

host. The verification key should be

stored externally. Also see the

<option>Seal=</option> option in

<citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>

for details.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--force</option></term>

<listitem><para>When --setup-keys is passed and

Forward Secure Sealing has already been set up,

recreate FSS keys.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--interval=</option></term>

<listitem><para>Specifies the change

interval for the sealing key when

generating an FSS key pair with

<option>--setup-keys</option>. Shorter

intervals increase CPU consumption but

shorten the time range of

undetectable journal

alterations. Defaults to

15min.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--verify</option></term>

<listitem><para>Check the journal file

for internal consistency. If the

file has been generated with FSS

enabled and the FSS verification key

has been specified with

<option>--verify-key=</option>,

authenticity of the journal file is

verified.</para></listitem>

</varlistentry>

<varlistentry>

<term><option>--verify-key=</option></term>

<listitem><para>Specifies the FSS

verification key to use for the

<option>--verify</option>

operation.</para></listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>Exit status</title>

<para>On success, 0 is returned, a non-zero failure

code otherwise.</para>

</refsect1>

<refsect1>

<title>Environment</title>

<variablelist class='environment-variables'>

<varlistentry>

<term><varname>$SYSTEMD_PAGER</varname></term>

<listitem><para>Pager to use when

<option>--no-pager</option> is not given;

overrides <varname>$PAGER</varname>. Setting

this to an empty string or the value

<literal>cat</literal> is equivalent to passing

<option>--no-pager</option>.</para></listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>Examples</title>

<para>Without arguments, all collected logs are shown

unfiltered:</para>

<programlisting>journalctl</programlisting>

<para>With one match specified, all entries with a field matching the expression are shown:</para>

<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>

<para>If two different fields are matched, only entries matching both expressions at the same time are shown:</para>

<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>

<para>If two matches refer to the same field, all entries matching either expression are shown:</para>

<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>

<para>If the separator <literal>+</literal> is used,

two expressions may be combined in a logical OR. The

following will show all messages from the Avahi

service process with the PID 28097 plus all messages

from the D-Bus service (from any of its

processes):</para>

<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>

<para>Show all logs generated by the D-Bus executable:</para>

<programlisting>journalctl /usr/bin/dbus-daemon</programlisting>

<para>Show all logs of the kernel device node <filename noindex='true'>/dev/sda</filename>:</para>

<programlisting>journalctl /dev/sda</programlisting>

<para>Show all kernel logs from previous boot:</para>

<programlisting>journalctl -k -b -1</programlisting>

</refsect1>

<refsect1>

<title>See Also</title>

<para>

<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,

<citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,

<citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,

<citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,

<citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>

</para>

</refsect1>

</refentry>