1JOURNALCTL(1) journalctl JOURNALCTL(1)
2
6 journalctl - Query the systemd journal
7
9 journalctl [OPTIONS...] [MATCHES...]
10
12 journalctl may be used to query the contents of the systemd(1) journal
13 as written by systemd-journald.service(8).
14 If called without parameters, it will show the full contents of the
16 journal, starting with the oldest entry collected.
17 If one or more match arguments are passed, the output is filtered
19 accordingly. A match is in the format "FIELD=VALUE", e.g.
20 "_SYSTEMD_UNIT=httpd.service", referring to the components of a
21 structured journal entry. See systemd.journal-fields(7) for a list of
22 well-known fields. If multiple matches are specified matching different
23 fields, the log entries are filtered by both, i.e. the resulting output
24 will show only entries matching all the specified matches of this kind.
25 If two matches apply to the same field, then they are automatically
26 matched as alternatives, i.e. the resulting output will show entries
27 matching any of the specified matches for the same field. Finally, the
28 character "+" may appear as a separate word between other terms on the
29 command line. This causes all matches before and after to be combined
30 in a disjunction (i.e. logical OR).
31 It is also possible to filter the entries by specifying an absolute
33 file path as an argument. The file path may be a file or a symbolic
34 link and the file must exist at the time of the query. If a file path
35 refers to an executable binary, an "_EXE=" match for the canonicalized
36 binary path is added to the query. If a file path refers to an
37 executable script, a "_COMM=" match for the script name is added to the
38 query. If a file path refers to a device node, "_KERNEL_DEVICE="
39 matches for the kernel name of the device and for each of its ancestor
40 devices is added to the query. Symbolic links are dereferenced, kernel
41 names are synthesized, and parent devices are identified from the
42 environment at the time of the query. In general, a device node is the
43 best proxy for an actual device, as log entries do not usually contain
44 fields that identify an actual device. For the resulting log entries to
45 be correct for the actual device, the relevant parts of the environment
46 at the time the entry was logged, in particular the actual device
47 corresponding to the device node, must have been the same as those at
48 the time of the query. Because device nodes generally change their
49 corresponding devices across reboots, specifying a device node path
50 causes the resulting entries to be restricted to those from the current
51 boot.
52 Additional constraints may be added using options --boot, --unit=,
54 etc., to further limit what entries will be shown (logical AND).
55 Output is interleaved from all accessible journal files, whether they
57 are rotated or currently being written, and regardless of whether they
58 belong to the system itself or are accessible user journals.
59 The set of journal files which will be used can be modified using the
61 --user, --system, --directory, and --file options, see below.
62 All users are granted access to their private per-user journals.
64 However, by default, only root and users who are members of a few
65 special groups are granted access to the system journal and the
66 journals of other users. Members of the groups "systemd-journal",
67 "adm", and "wheel" can read all journal files. Note that the two latter
68 groups traditionally have additional privileges specified by the
69 distribution. Members of the "wheel" group can often perform
70 administrative tasks.
71 The output is paged through less by default, and long lines are
73 "truncated" to screen width. The hidden part can be viewed by using the
74 left-arrow and right-arrow keys. Paging can be disabled; see the
75 --no-pager option and the "Environment" section below.
76 When outputting to a tty, lines are colored according to priority:
78 lines of level ERROR and higher are colored red; lines of level NOTICE
79 and higher are highlighted; other lines are displayed normally.
80
82 The following options are understood:
83 --no-full, --full, -l
85 Ellipsize fields when they do not fit in available columns. The
86 default is to show full fields, allowing them to wrap or be
87 truncated by the pager, if one is used.
88 The old options -l/--full are not useful anymore, except to undo
90 --no-full.
91 -a, --all
93 Show all fields in full, even if they include unprintable
94 characters or are very long.
95 -f, --follow
97 Show only the most recent journal entries, and continuously print
98 new entries as they are appended to the journal.
99 -e, --pager-end
101 Immediately jump to the end of the journal inside the implied pager
102 tool. This implies -n1000 to guarantee that the pager will not
103 buffer logs of unbounded size. This may be overridden with an
104 explicit -n with some other numeric value, while -nall will disable
105 this cap. Note that this option is only supported for the less(1)
106 pager.
107 -n, --lines=
109 Show the most recent journal events and limit the number of events
110 shown. If --follow is used, this option is implied. The argument is
111 a positive integer or "all" to disable line limiting. The default
112 value is 10 if no argument is given.
113 --no-tail
115 Show all stored output lines, even in follow mode. Undoes the
116 effect of --lines=.
117 -r, --reverse
119 Reverse output so that the newest entries are displayed first.
120 -o, --output=
122 Controls the formatting of the journal entries that are shown.
123 Takes one of the following options:
124 short
126 is the default and generates an output that is mostly identical
127 to the formatting of classic syslog files, showing one line per
128 journal entry.
129 short-full
131 is very similar, but shows timestamps in the format the
132 --since= and --until= options accept. Unlike the timestamp
133 information shown in short output mode this mode includes
134 weekday, year and timezone information in the output, and is
135 locale-independent.
136 short-iso
138 is very similar, but shows ISO 8601 wallclock timestamps.
139 short-iso-precise
141 as for short-iso but includes full microsecond precision.
142 short-precise
144 is very similar, but shows classic syslog timestamps with full
145 microsecond precision.
146 short-monotonic
148 is very similar, but shows monotonic timestamps instead of
149 wallclock timestamps.
150 short-unix
152 is very similar, but shows seconds passed since January 1st
153 1970 UTC instead of wallclock timestamps ("UNIX time"). The
154 time is shown with microsecond accuracy.
155 verbose
157 shows the full-structured entry items with all fields.
158 export
160 serializes the journal into a binary (but mostly text-based)
161 stream suitable for backups and network transfer (see Journal
162 Export Format[1] for more information). To import the binary
163 stream back into native journald format use systemd-journal-
164 remote(8).
165 json
167 formats entries as JSON data structures, one per line (see
168 Journal JSON Format[2] for more information).
169 json-pretty
171 formats entries as JSON data structures, but formats them in
172 multiple lines in order to make them more readable by humans.
173 json-sse
175 formats entries as JSON data structures, but wraps them in a
176 format suitable for Server-Sent Events[3].
177 cat
179 generates a very terse output, only showing the actual message
180 of each journal entry with no metadata, not even a timestamp.
181 with-unit
183 similar to short-full, but prefixes the unit and user unit
184 names instead of the traditional syslog identifier. Useful when
185 using templated instances, as it will include the arguments in
186 the unit names.
187 --output-fields=
189 A comma separated list of the fields which should be included in
190 the output. This only has an effect for the output modes which
191 would normally show all fields (verbose, export, json, json-pretty,
192 and json-sse). The "__CURSOR", "__REALTIME_TIMESTAMP",
193 "__MONOTONIC_TIMESTAMP", and "_BOOT_ID" fields are always printed.
194 --utc
196 Express time in Coordinated Universal Time (UTC).
197 --no-hostname
199 Don't show the hostname field of log messages originating from the
200 local host. This switch only has an effect on the short family of
201 output modes (see above).
202 -x, --catalog
204 Augment log lines with explanation texts from the message catalog.
205 This will add explanatory help texts to log messages in the output
206 where this is available. These short help texts will explain the
207 context of an error or log event, possible solutions, as well as
208 pointers to support forums, developer documentation, and any other
209 relevant manuals. Note that help texts are not available for all
210 messages, but only for selected ones. For more information on the
211 message catalog, please refer to the Message Catalog Developer
212 Documentation[4].
213 Note: when attaching journalctl output to bug reports, please do
215 not use -x.
216 -q, --quiet
218 Suppresses all informational messages (i.e. "-- Logs begin at ...",
219 "-- Reboot --"), any warning messages regarding inaccessible system
220 journals when run as a normal user.
221 -m, --merge
223 Show entries interleaved from all available journals, including
224 remote ones.
225 -b [ID][±offset], --boot=[ID][±offset]
227 Show messages from a specific boot. This will add a match for
228 "_BOOT_ID=".
229 The argument may be empty, in which case logs for the current boot
231 will be shown.
232 If the boot ID is omitted, a positive offset will look up the boots
234 starting from the beginning of the journal, and an
235 equal-or-less-than zero offset will look up boots starting from the
236 end of the journal. Thus, 1 means the first boot found in the
237 journal in chronological order, 2 the second and so on; while -0 is
238 the last boot, -1 the boot before last, and so on. An empty offset
239 is equivalent to specifying -0, except when the current boot is not
240 the last boot (e.g. because --directory was specified to look at
241 logs from a different machine).
242 If the 32-character ID is specified, it may optionally be followed
244 by offset which identifies the boot relative to the one given by
245 boot ID. Negative values mean earlier boots and positive values
246 mean later boots. If offset is not specified, a value of zero is
247 assumed, and the logs for the boot given by ID are shown.
248 --list-boots
250 Show a tabular list of boot numbers (relative to the current boot),
251 their IDs, and the timestamps of the first and last message
252 pertaining to the boot.
253 -k, --dmesg
255 Show only kernel messages. This implies -b and adds the match
256 "_TRANSPORT=kernel".
257 -t, --identifier=SYSLOG_IDENTIFIER
259 Show messages for the specified syslog identifier
260 SYSLOG_IDENTIFIER.
261 This parameter can be specified multiple times.
263 -u, --unit=UNIT|PATTERN
265 Show messages for the specified systemd unit UNIT (such as a
266 service unit), or for any of the units matched by PATTERN. If a
267 pattern is specified, a list of unit names found in the journal is
268 compared with the specified pattern and all that match are used.
269 For each unit name, a match is added for messages from the unit
270 ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages
271 from systemd and messages about coredumps for the specified unit.
272 This parameter can be specified multiple times.
274 --user-unit=
276 Show messages for the specified user session unit. This will add a
277 match for messages from the unit ("_SYSTEMD_USER_UNIT=" and
278 "_UID=") and additional matches for messages from session systemd
279 and messages about coredumps for the specified unit.
280 This parameter can be specified multiple times.
282 -p, --priority=
284 Filter output by message priorities or priority ranges. Takes
285 either a single numeric or textual log level (i.e. between
286 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in
287 the form FROM..TO. The log levels are the usual syslog log levels
288 as documented in syslog(3), i.e. "emerg" (0), "alert" (1),
289 "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6),
290 "debug" (7). If a single log level is specified, all messages with
291 this log level or a lower (hence more important) log level are
292 shown. If a range is specified, all messages within the range are
293 shown, including both the start and the end value of the range.
294 This will add "PRIORITY=" matches for the specified priorities.
295 -g, --grep=
297 Filter output to entries where the MESSAGE= field matches the
298 specified regular expression. PERL-compatible regular expressions
299 are used, see pcre2pattern(3) for a detailed description of the
300 syntax.
301 If the pattern is all lowercase, matching is case insensitive.
303 Otherwise, matching is case sensitive. This can be overridden with
304 the --case-sensitive option, see below.
305 --case-sensitive[=BOOLEAN]
307 Make pattern matching case sensitive or case insenstive.
308 -c, --cursor=
310 Start showing entries from the location in the journal specified by
311 the passed cursor.
312 --after-cursor=
314 Start showing entries from the location in the journal after the
315 location specified by the passed cursor. The cursor is shown when
316 the --show-cursor option is used.
317 --show-cursor
319 The cursor is shown after the last entry after two dashes:
320 -- cursor: s=0639...
322 The format of the cursor is private and subject to change.
324 -S, --since=, -U, --until=
326 Start showing entries on or newer than the specified date, or on or
327 older than the specified date, respectively. Date specifications
328 should be of the format "2012-10-30 18:17:16". If the time part is
329 omitted, "00:00:00" is assumed. If only the seconds component is
330 omitted, ":00" is assumed. If the date component is omitted, the
331 current day is assumed. Alternatively the strings "yesterday",
332 "today", "tomorrow" are understood, which refer to 00:00:00 of the
333 day before the current day, the current day, or the day after the
334 current day, respectively. "now" refers to the current time.
335 Finally, relative times may be specified, prefixed with "-" or "+",
336 referring to times before or after the current time, respectively.
337 For complete time and date specification, see systemd.time(7). Note
338 that --output=short-full prints timestamps that follow precisely
339 this format.
340 -F, --field=
342 Print all possible data values the specified field can take in all
343 entries of the journal.
344 -N, --fields
346 Print all field names currently used in all entries of the journal.
347 --system, --user
349 Show messages from system services and the kernel (with --system).
350 Show messages from service of current user (with --user). If
351 neither is specified, show all messages that the user can see.
352 -M, --machine=
354 Show messages from a running, local container. Specify a container
355 name to connect to.
356 -D DIR, --directory=DIR
358 Takes a directory path as argument. If specified, journalctl will
359 operate on the specified journal directory DIR instead of the
360 default runtime and system journal paths.
361 --file=GLOB
363 Takes a file glob as an argument. If specified, journalctl will
364 operate on the specified journal files matching GLOB instead of the
365 default runtime and system journal paths. May be specified multiple
366 times, in which case files will be suitably interleaved.
367 --root=ROOT
369 Takes a directory path as an argument. If specified, journalctl
370 will operate on journal directories and catalog file hierarchy
371 underneath the specified directory instead of the root directory
372 (e.g. --update-catalog will create
373 ROOT/var/lib/systemd/catalog/database, and journal files under
374 ROOT/run/journal or ROOT/var/log/journal will be displayed).
375 --new-id128
377 Instead of showing journal contents, generate a new 128-bit ID
378 suitable for identifying messages. This is intended for usage by
379 developers who need a new identifier for a new message they
380 introduce and want to make recognizable. This will print the new ID
381 in four different formats which can be copied into source code or
382 similar.
383 --header
385 Instead of showing journal contents, show internal header
386 information of the journal fields accessed.
387 --disk-usage
389 Shows the current disk usage of all journal files. This shows the
390 sum of the disk usage of all archived and active journal files.
391 --vacuum-size=, --vacuum-time=, --vacuum-files=
393 Removes the oldest archived journal files until the disk space they
394 use falls below the specified size (specified with the usual "K",
395 "M", "G" and "T" suffixes), or all archived journal files contain
396 no data older than the specified timespan (specified with the usual
397 "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or
398 no more than the specified number of separate journal files remain.
399 Note that running --vacuum-size= has only an indirect effect on the
400 output shown by --disk-usage, as the latter includes active journal
401 files, while the vacuuming operation only operates on archived
402 journal files. Similarly, --vacuum-files= might not actually reduce
403 the number of journal files to below the specified number, as it
404 will not remove active journal files. --vacuum-size=,
405 --vacuum-time= and --vacuum-files= may be combined in a single
406 invocation to enforce any combination of a size, a time and a
407 number of files limit on the archived journal files. Specifying any
408 of these three parameters as zero is equivalent to not enforcing
409 the specific limit, and is thus redundant.
410 --list-catalog [128-bit-ID...]
412 List the contents of the message catalog as a table of message IDs,
413 plus their short description strings.
414 If any 128-bit-IDs are specified, only those entries are shown.
416 --dump-catalog [128-bit-ID...]
418 Show the contents of the message catalog, with entries separated by
419 a line consisting of two dashes and the ID (the format is the same
420 as .catalog files).
421 If any 128-bit-IDs are specified, only those entries are shown.
423 --update-catalog
425 Update the message catalog index. This command needs to be executed
426 each time new catalog files are installed, removed, or updated to
427 rebuild the binary catalog index.
428 --setup-keys
430 Instead of showing journal contents, generate a new key pair for
431 Forward Secure Sealing (FSS). This will generate a sealing key and
432 a verification key. The sealing key is stored in the journal data
433 directory and shall remain on the host. The verification key should
434 be stored externally. Refer to the Seal= option in journald.conf(5)
435 for information on Forward Secure Sealing and for a link to a
436 refereed scholarly paper detailing the cryptographic theory it is
437 based on.
438 --force
440 When --setup-keys is passed and Forward Secure Sealing (FSS) has
441 already been configured, recreate FSS keys.
442 --interval=
444 Specifies the change interval for the sealing key when generating
445 an FSS key pair with --setup-keys. Shorter intervals increase CPU
446 consumption but shorten the time range of undetectable journal
447 alterations. Defaults to 15min.
448 --verify
450 Check the journal file for internal consistency. If the file has
451 been generated with FSS enabled and the FSS verification key has
452 been specified with --verify-key=, authenticity of the journal file
453 is verified.
454 --verify-key=
456 Specifies the FSS verification key to use for the --verify
457 operation.
458 --sync
460 Asks the journal daemon to write all yet unwritten journal data to
461 the backing file system and synchronize all journals. This call
462 does not return until the synchronization operation is complete.
463 This command guarantees that any log messages written before its
464 invocation are safely stored on disk at the time it returns.
465 --flush
467 Asks the journal daemon to flush any log data stored in
468 /run/log/journal into /var/log/journal, if persistent storage is
469 enabled. This call does not return until the operation is complete.
470 Note that this call is idempotent: the data is only flushed from
471 /run/log/journal into /var/log/journal once during system runtime,
472 and this command exits cleanly without executing any operation if
473 this has already happened. This command effectively guarantees that
474 all data is flushed to /var/log/journal at the time it returns.
475 --rotate
477 Asks the journal daemon to rotate journal files. This call does not
478 return until the rotation operation is complete.
479 -h, --help
481 Print a short help text and exit.
482 --version
484 Print a short version string and exit.
485 --no-pager
487 Do not pipe output into a pager.
488
490 On success, 0 is returned; otherwise, a non-zero failure code is
491 returned.
492
494 $SYSTEMD_PAGER
495 Pager to use when --no-pager is not given; overrides $PAGER. If
496 neither $SYSTEMD_PAGER nor $PAGER are set, a set of well-known
497 pager implementations are tried in turn, including less(1) and
498 more(1), until one is found. If no pager implementation is
499 discovered no pager is invoked. Setting this environment variable
500 to an empty string or the value "cat" is equivalent to passing
501 --no-pager.
502 $SYSTEMD_LESS
504 Override the options passed to less (by default "FRSXMK").
505 $SYSTEMD_LESSCHARSET
507 Override the charset passed to less (by default "utf-8", if the
508 invoking terminal is determined to be UTF-8 compatible).
509
511 Without arguments, all collected logs are shown unfiltered:
512 journalctl
514 With one match specified, all entries with a field matching the
516 expression are shown:
517 journalctl _SYSTEMD_UNIT=avahi-daemon.service
519 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
520 If two different fields are matched, only entries matching both
522 expressions at the same time are shown:
523 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
525 If two matches refer to the same field, all entries matching either
527 expression are shown:
528 journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
530 If the separator "+" is used, two expressions may be combined in a
532 logical OR. The following will show all messages from the Avahi service
533 process with the PID 28097 plus all messages from the D-Bus service
534 (from any of its processes):
535 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
537 To show all fields emitted by a unit and about the unit, option
539 -u/--unit= should be used. journalctl -u name expands to a complex
540 filter similar to
541 _SYSTEMD_UNIT=name.service
543 + UNIT=name.service _PID=1
544 + OBJECT_SYSTEMD_UNIT=name.service _UID=0
545 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
546 (see systemd.journal-fields(5) for an explanation of those patterns).
549 Show all logs generated by the D-Bus executable:
551 journalctl /usr/bin/dbus-daemon
553 Show all kernel logs from previous boot:
555 journalctl -k -b -1
557 Show a live log display from a system service apache.service:
559 journalctl -f -u apache
561
563 systemd(1), systemd-journald.service(8), systemctl(1), coredumpctl(1),
564 systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd-
565 journal-remote.service(8), systemd-journal-upload.service(8)
566
568 1. Journal Export Format
569 https://www.freedesktop.org/wiki/Software/systemd/export
570 2. Journal JSON Format
572 https://www.freedesktop.org/wiki/Software/systemd/json
573 3. Server-Sent Events
575 https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
576 4. Message Catalog Developer Documentation
578 https://www.freedesktop.org/wiki/Software/systemd/catalog
579systemd 239 JOURNALCTL(1)