1JOURNALCTL(1) journalctl JOURNALCTL(1)
2
6 journalctl - Query the systemd journal
7
9 journalctl [OPTIONS...] [MATCHES...]
10
12 journalctl may be used to query the contents of the systemd(1) journal
13 as written by systemd-journald.service(8).
14 If called without parameters, it will show the full contents of the
16 journal, starting with the oldest entry collected.
17 If one or more match arguments are passed, the output is filtered
19 accordingly. A match is in the format "FIELD=VALUE", e.g.
20 "_SYSTEMD_UNIT=httpd.service", referring to the components of a
21 structured journal entry. See systemd.journal-fields(7) for a list of
22 well-known fields. If multiple matches are specified matching different
23 fields, the log entries are filtered by both, i.e. the resulting output
24 will show only entries matching all the specified matches of this kind.
25 If two matches apply to the same field, then they are automatically
26 matched as alternatives, i.e. the resulting output will show entries
27 matching any of the specified matches for the same field. Finally, the
28 character "+" may appear as a separate word between other terms on the
29 command line. This causes all matches before and after to be combined
30 in a disjunction (i.e. logical OR).
31 It is also possible to filter the entries by specifying an absolute
33 file path as an argument. The file path may be a file or a symbolic
34 link and the file must exist at the time of the query. If a file path
35 refers to an executable binary, an "_EXE=" match for the canonicalized
36 binary path is added to the query. If a file path refers to an
37 executable script, a "_COMM=" match for the script name is added to the
38 query. If a file path refers to a device node, "_KERNEL_DEVICE="
39 matches for the kernel name of the device and for each of its ancestor
40 devices is added to the query. Symbolic links are dereferenced, kernel
41 names are synthesized, and parent devices are identified from the
42 environment at the time of the query. In general, a device node is the
43 best proxy for an actual device, as log entries do not usually contain
44 fields that identify an actual device. For the resulting log entries to
45 be correct for the actual device, the relevant parts of the environment
46 at the time the entry was logged, in particular the actual device
47 corresponding to the device node, must have been the same as those at
48 the time of the query. Because device nodes generally change their
49 corresponding devices across reboots, specifying a device node path
50 causes the resulting entries to be restricted to those from the current
51 boot.
52 Additional constraints may be added using options --boot, --unit=,
54 etc., to further limit what entries will be shown (logical AND).
55 Output is interleaved from all accessible journal files, whether they
57 are rotated or currently being written, and regardless of whether they
58 belong to the system itself or are accessible user journals.
59 The set of journal files which will be used can be modified using the
61 --user, --system, --directory, and --file options, see below.
62 All users are granted access to their private per-user journals.
64 However, by default, only root and users who are members of a few
65 special groups are granted access to the system journal and the
66 journals of other users. Members of the groups "systemd-journal",
67 "adm", and "wheel" can read all journal files. Note that the two latter
68 groups traditionally have additional privileges specified by the
69 distribution. Members of the "wheel" group can often perform
70 administrative tasks.
71 The output is paged through less by default, and long lines are
73 "truncated" to screen width. The hidden part can be viewed by using the
74 left-arrow and right-arrow keys. Paging can be disabled; see the
75 --no-pager option and the "Environment" section below.
76 When outputting to a tty, lines are colored according to priority:
78 lines of level ERROR and higher are colored red; lines of level NOTICE
79 and higher are highlighted; lines of level DEBUG are colored lighter
80 grey; other lines are displayed normally.
81
83 The following options are understood:
84 --no-full, --full, -l
86 Ellipsize fields when they do not fit in available columns. The
87 default is to show full fields, allowing them to wrap or be
88 truncated by the pager, if one is used.
89 The old options -l/--full are not useful anymore, except to undo
91 --no-full.
92 -a, --all
94 Show all fields in full, even if they include unprintable
95 characters or are very long. By default, fields with unprintable
96 characters are abbreviated as "blob data". (Note that the pager may
97 escape unprintable characters again.)
98 -f, --follow
100 Show only the most recent journal entries, and continuously print
101 new entries as they are appended to the journal.
102 -e, --pager-end
104 Immediately jump to the end of the journal inside the implied pager
105 tool. This implies -n1000 to guarantee that the pager will not
106 buffer logs of unbounded size. This may be overridden with an
107 explicit -n with some other numeric value, while -nall will disable
108 this cap. Note that this option is only supported for the less(1)
109 pager.
110 -n, --lines=
112 Show the most recent journal events and limit the number of events
113 shown. If --follow is used, this option is implied. The argument is
114 a positive integer or "all" to disable line limiting. The default
115 value is 10 if no argument is given.
116 --no-tail
118 Show all stored output lines, even in follow mode. Undoes the
119 effect of --lines=.
120 -r, --reverse
122 Reverse output so that the newest entries are displayed first.
123 -o, --output=
125 Controls the formatting of the journal entries that are shown.
126 Takes one of the following options:
127 short
129 is the default and generates an output that is mostly identical
130 to the formatting of classic syslog files, showing one line per
131 journal entry.
132 short-full
134 is very similar, but shows timestamps in the format the
135 --since= and --until= options accept. Unlike the timestamp
136 information shown in short output mode this mode includes
137 weekday, year and timezone information in the output, and is
138 locale-independent.
139 short-iso
141 is very similar, but shows ISO 8601 wallclock timestamps.
142 short-iso-precise
144 as for short-iso but includes full microsecond precision.
145 short-precise
147 is very similar, but shows classic syslog timestamps with full
148 microsecond precision.
149 short-monotonic
151 is very similar, but shows monotonic timestamps instead of
152 wallclock timestamps.
153 short-unix
155 is very similar, but shows seconds passed since January 1st
156 1970 UTC instead of wallclock timestamps ("UNIX time"). The
157 time is shown with microsecond accuracy.
158 verbose
160 shows the full-structured entry items with all fields.
161 export
163 serializes the journal into a binary (but mostly text-based)
164 stream suitable for backups and network transfer (see Journal
165 Export Format[1] for more information). To import the binary
166 stream back into native journald format use systemd-journal-
167 remote(8).
168 json
170 formats entries as JSON objects, separated by newline
171 characters (see Journal JSON Format[2] for more information).
172 Field values are generally encoded as JSON strings, with three
173 exceptions:
174 1. Fields larger than 4096 bytes are encoded as null values.
176 (This may be turned off by passing --all, but be aware that
177 this may allocate overly long JSON objects.)
178 2. Journal entries permit non-unique fields within the same
180 log entry. JSON does not allow non-unique fields within
181 objects. Due to this, if a non-unique field is encountered
182 a JSON array is used as field value, listing all field
183 values as elements.
184 3. Fields containing non-printable or non-UTF8 bytes are
186 encoded as arrays containing the raw bytes individually
187 formatted as unsigned numbers.
188 Note that this encoding is reversible (with the exception of
190 the size limit).
191 json-pretty
193 formats entries as JSON data structures, but formats them in
194 multiple lines in order to make them more readable by humans.
195 json-sse
197 formats entries as JSON data structures, but wraps them in a
198 format suitable for Server-Sent Events[3].
199 json-seq
201 formats entries as JSON data structures, but prefixes them with
202 an ASCII Record Separator character (0x1E) and suffixes them
203 with an ASCII Line Feed character (0x0A), in accordance with
204 JavaScript Object Notation (JSON) Text Sequences[4]
205 ("application/json-seq").
206 cat
208 generates a very terse output, only showing the actual message
209 of each journal entry with no metadata, not even a timestamp.
210 with-unit
212 similar to short-full, but prefixes the unit and user unit
213 names instead of the traditional syslog identifier. Useful when
214 using templated instances, as it will include the arguments in
215 the unit names.
216 --output-fields=
218 A comma separated list of the fields which should be included in
219 the output. This only has an effect for the output modes which
220 would normally show all fields (verbose, export, json, json-pretty,
221 json-sse and json-seq). The "__CURSOR", "__REALTIME_TIMESTAMP",
222 "__MONOTONIC_TIMESTAMP", and "_BOOT_ID" fields are always printed.
223 --utc
225 Express time in Coordinated Universal Time (UTC).
226 --no-hostname
228 Don't show the hostname field of log messages originating from the
229 local host. This switch only has an effect on the short family of
230 output modes (see above).
231 -x, --catalog
233 Augment log lines with explanation texts from the message catalog.
234 This will add explanatory help texts to log messages in the output
235 where this is available. These short help texts will explain the
236 context of an error or log event, possible solutions, as well as
237 pointers to support forums, developer documentation, and any other
238 relevant manuals. Note that help texts are not available for all
239 messages, but only for selected ones. For more information on the
240 message catalog, please refer to the Message Catalog Developer
241 Documentation[5].
242 Note: when attaching journalctl output to bug reports, please do
244 not use -x.
245 -q, --quiet
247 Suppresses all informational messages (i.e. "-- Logs begin at ...",
248 "-- Reboot --"), any warning messages regarding inaccessible system
249 journals when run as a normal user.
250 -m, --merge
252 Show entries interleaved from all available journals, including
253 remote ones.
254 -b [[ID][±offset]|all], --boot[=[ID][±offset]|all]
256 Show messages from a specific boot. This will add a match for
257 "_BOOT_ID=".
258 The argument may be empty, in which case logs for the current boot
260 will be shown.
261 If the boot ID is omitted, a positive offset will look up the boots
263 starting from the beginning of the journal, and an
264 equal-or-less-than zero offset will look up boots starting from the
265 end of the journal. Thus, 1 means the first boot found in the
266 journal in chronological order, 2 the second and so on; while -0 is
267 the last boot, -1 the boot before last, and so on. An empty offset
268 is equivalent to specifying -0, except when the current boot is not
269 the last boot (e.g. because --directory was specified to look at
270 logs from a different machine).
271 If the 32-character ID is specified, it may optionally be followed
273 by offset which identifies the boot relative to the one given by
274 boot ID. Negative values mean earlier boots and positive values
275 mean later boots. If offset is not specified, a value of zero is
276 assumed, and the logs for the boot given by ID are shown.
277 The special argument all can be used to negate the effect of an
279 earlier use of -b.
280 --list-boots
282 Show a tabular list of boot numbers (relative to the current boot),
283 their IDs, and the timestamps of the first and last message
284 pertaining to the boot.
285 -k, --dmesg
287 Show only kernel messages. This implies -b and adds the match
288 "_TRANSPORT=kernel".
289 -t, --identifier=SYSLOG_IDENTIFIER
291 Show messages for the specified syslog identifier
292 SYSLOG_IDENTIFIER.
293 This parameter can be specified multiple times.
295 -u, --unit=UNIT|PATTERN
297 Show messages for the specified systemd unit UNIT (such as a
298 service unit), or for any of the units matched by PATTERN. If a
299 pattern is specified, a list of unit names found in the journal is
300 compared with the specified pattern and all that match are used.
301 For each unit name, a match is added for messages from the unit
302 ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages
303 from systemd and messages about coredumps for the specified unit. A
304 match is also added for "_SYSTEMD_SLICE=UNIT", such that if the
305 provided UNIT is a systemd.slice(5) unit, all logs of the children
306 of the slice will be logged.
307 This parameter can be specified multiple times.
309 --user-unit=
311 Show messages for the specified user session unit. This will add a
312 match for messages from the unit ("_SYSTEMD_USER_UNIT=" and
313 "_UID=") and additional matches for messages from session systemd
314 and messages about coredumps for the specified unit. A match is
315 also added for "_SYSTEMD_USER_SLICE=UNIT", such that if the
316 provided UNIT is a systemd.slice(5) unit, all logs of the children
317 of the unit will be logged.
318 This parameter can be specified multiple times.
320 -p, --priority=
322 Filter output by message priorities or priority ranges. Takes
323 either a single numeric or textual log level (i.e. between
324 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in
325 the form FROM..TO. The log levels are the usual syslog log levels
326 as documented in syslog(3), i.e. "emerg" (0), "alert" (1),
327 "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6),
328 "debug" (7). If a single log level is specified, all messages with
329 this log level or a lower (hence more important) log level are
330 shown. If a range is specified, all messages within the range are
331 shown, including both the start and the end value of the range.
332 This will add "PRIORITY=" matches for the specified priorities.
333 -g, --grep=
335 Filter output to entries where the MESSAGE= field matches the
336 specified regular expression. PERL-compatible regular expressions
337 are used, see pcre2pattern(3) for a detailed description of the
338 syntax.
339 If the pattern is all lowercase, matching is case insensitive.
341 Otherwise, matching is case sensitive. This can be overridden with
342 the --case-sensitive option, see below.
343 --case-sensitive[=BOOLEAN]
345 Make pattern matching case sensitive or case insenstive.
346 -c, --cursor=
348 Start showing entries from the location in the journal specified by
349 the passed cursor.
350 --cursor-file=FILE
352 If FILE exists and contains a cursor, start showing entries after
353 this location. Otherwise the show entries according the other given
354 options. At the end, write the cursor of the last entry to FILE.
355 Use this option to continually read the journal by sequentially
356 calling journalctl.
357 --after-cursor=
359 Start showing entries from the location in the journal after the
360 location specified by the passed cursor. The cursor is shown when
361 the --show-cursor option is used.
362 --show-cursor
364 The cursor is shown after the last entry after two dashes:
365 -- cursor: s=0639...
367 The format of the cursor is private and subject to change.
369 -S, --since=, -U, --until=
371 Start showing entries on or newer than the specified date, or on or
372 older than the specified date, respectively. Date specifications
373 should be of the format "2012-10-30 18:17:16". If the time part is
374 omitted, "00:00:00" is assumed. If only the seconds component is
375 omitted, ":00" is assumed. If the date component is omitted, the
376 current day is assumed. Alternatively the strings "yesterday",
377 "today", "tomorrow" are understood, which refer to 00:00:00 of the
378 day before the current day, the current day, or the day after the
379 current day, respectively. "now" refers to the current time.
380 Finally, relative times may be specified, prefixed with "-" or "+",
381 referring to times before or after the current time, respectively.
382 For complete time and date specification, see systemd.time(7). Note
383 that --output=short-full prints timestamps that follow precisely
384 this format.
385 -F, --field=
387 Print all possible data values the specified field can take in all
388 entries of the journal.
389 -N, --fields
391 Print all field names currently used in all entries of the journal.
392 --system, --user
394 Show messages from system services and the kernel (with --system).
395 Show messages from service of current user (with --user). If
396 neither is specified, show all messages that the user can see.
397 -M, --machine=
399 Show messages from a running, local container. Specify a container
400 name to connect to.
401 -D DIR, --directory=DIR
403 Takes a directory path as argument. If specified, journalctl will
404 operate on the specified journal directory DIR instead of the
405 default runtime and system journal paths.
406 --file=GLOB
408 Takes a file glob as an argument. If specified, journalctl will
409 operate on the specified journal files matching GLOB instead of the
410 default runtime and system journal paths. May be specified multiple
411 times, in which case files will be suitably interleaved.
412 --root=ROOT
414 Takes a directory path as an argument. If specified, journalctl
415 will operate on journal directories and catalog file hierarchy
416 underneath the specified directory instead of the root directory
417 (e.g. --update-catalog will create
418 ROOT/var/lib/systemd/catalog/database, and journal files under
419 ROOT/run/journal or ROOT/var/log/journal will be displayed).
420 --header
422 Instead of showing journal contents, show internal header
423 information of the journal fields accessed.
424 --disk-usage
426 Shows the current disk usage of all journal files. This shows the
427 sum of the disk usage of all archived and active journal files.
428 --vacuum-size=, --vacuum-time=, --vacuum-files=
430 Removes the oldest archived journal files until the disk space they
431 use falls below the specified size (specified with the usual "K",
432 "M", "G" and "T" suffixes), or all archived journal files contain
433 no data older than the specified timespan (specified with the usual
434 "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or
435 no more than the specified number of separate journal files remain.
436 Note that running --vacuum-size= has only an indirect effect on the
437 output shown by --disk-usage, as the latter includes active journal
438 files, while the vacuuming operation only operates on archived
439 journal files. Similarly, --vacuum-files= might not actually reduce
440 the number of journal files to below the specified number, as it
441 will not remove active journal files.
442 --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
444 in a single invocation to enforce any combination of a size, a time
445 and a number of files limit on the archived journal files.
446 Specifying any of these three parameters as zero is equivalent to
447 not enforcing the specific limit, and is thus redundant.
448 These three switches may also be combined with --rotate into one
450 command. If so, all active files are rotated first, and the
451 requested vacuuming operation is executed right after. The rotation
452 has the effect that all currently active files are archived (and
453 potentially new, empty journal files opened as replacement), and
454 hence the vacuuming operation has the greatest effect as it can
455 take all log data written so far into account.
456 --list-catalog [128-bit-ID...]
458 List the contents of the message catalog as a table of message IDs,
459 plus their short description strings.
460 If any 128-bit-IDs are specified, only those entries are shown.
462 --dump-catalog [128-bit-ID...]
464 Show the contents of the message catalog, with entries separated by
465 a line consisting of two dashes and the ID (the format is the same
466 as .catalog files).
467 If any 128-bit-IDs are specified, only those entries are shown.
469 --update-catalog
471 Update the message catalog index. This command needs to be executed
472 each time new catalog files are installed, removed, or updated to
473 rebuild the binary catalog index.
474 --setup-keys
476 Instead of showing journal contents, generate a new key pair for
477 Forward Secure Sealing (FSS). This will generate a sealing key and
478 a verification key. The sealing key is stored in the journal data
479 directory and shall remain on the host. The verification key should
480 be stored externally. Refer to the Seal= option in journald.conf(5)
481 for information on Forward Secure Sealing and for a link to a
482 refereed scholarly paper detailing the cryptographic theory it is
483 based on.
484 --force
486 When --setup-keys is passed and Forward Secure Sealing (FSS) has
487 already been configured, recreate FSS keys.
488 --interval=
490 Specifies the change interval for the sealing key when generating
491 an FSS key pair with --setup-keys. Shorter intervals increase CPU
492 consumption but shorten the time range of undetectable journal
493 alterations. Defaults to 15min.
494 --verify
496 Check the journal file for internal consistency. If the file has
497 been generated with FSS enabled and the FSS verification key has
498 been specified with --verify-key=, authenticity of the journal file
499 is verified.
500 --verify-key=
502 Specifies the FSS verification key to use for the --verify
503 operation.
504 --sync
506 Asks the journal daemon to write all yet unwritten journal data to
507 the backing file system and synchronize all journals. This call
508 does not return until the synchronization operation is complete.
509 This command guarantees that any log messages written before its
510 invocation are safely stored on disk at the time it returns.
511 --flush
513 Asks the journal daemon to flush any log data stored in
514 /run/log/journal/ into /var/log/journal/, if persistent storage is
515 enabled. This call does not return until the operation is complete.
516 Note that this call is idempotent: the data is only flushed from
517 /run/log/journal/ into /var/log/journal once during system runtime
518 (but see --relinquish-var below), and this command exits cleanly
519 without executing any operation if this has already happened. This
520 command effectively guarantees that all data is flushed to
521 /var/log/journal at the time it returns.
522 --relinquish-var
524 Asks the journal daemon for the reverse operation to --flush: if
525 requested the daemon will write further log data to
526 /run/log/journal/ and stops writing to /var/log/journal/. A
527 subsequent call to --flush causes the log output to switch back to
528 /var/log/journal/, see above.
529 --smart-relinquish-var
531 Similar to --relinquish-var but executes no operation if the root
532 file system and /var/lib/journal/ reside on the same mount point.
533 This operation is used during system shutdown in order to make the
534 journal daemon stop writing data to /var/log/journal/ in case that
535 directory is located on a mount point that needs to be unmounted.
536 --rotate
538 Asks the journal daemon to rotate journal files. This call does not
539 return until the rotation operation is complete. Journal file
540 rotation has the effect that all currently active journal files are
541 marked as archived and renamed, so that they are never written to
542 in future. New (empty) journal files are then created in their
543 place. This operation may be combined with --vacuum-size=,
544 --vacuum-time= and --vacuum-file= into a single command, see above.
545 -h, --help
547 Print a short help text and exit.
548 --version
550 Print a short version string and exit.
551 --no-pager
553 Do not pipe output into a pager.
554
556 On success, 0 is returned; otherwise, a non-zero failure code is
557 returned.
558
560 $SYSTEMD_PAGER
561 Pager to use when --no-pager is not given; overrides $PAGER. If
562 neither $SYSTEMD_PAGER nor $PAGER are set, a set of well-known
563 pager implementations are tried in turn, including less(1) and
564 more(1), until one is found. If no pager implementation is
565 discovered no pager is invoked. Setting this environment variable
566 to an empty string or the value "cat" is equivalent to passing
567 --no-pager.
568 $SYSTEMD_LESS
570 Override the options passed to less (by default "FRSXMK").
571 Users might want to change two options in particular:
573 K
575 This option instructs the pager to exit immediately when Ctrl+C
576 is pressed. To allow less to handle Ctrl+C itself to switch
577 back to the pager command prompt, unset this option.
578 If the value of $SYSTEMD_LESS does not include "K", and the
580 pager that is invoked is less, Ctrl+C will be ignored by the
581 executable, and needs to be handled by the pager.
582 X
584 This option instructs the pager to not send termcap
585 initialization and deinitialization strings to the terminal. It
586 is set by default to allow command output to remain visible in
587 the terminal even after the pager exits. Nevertheless, this
588 prevents some pager functionality from working, in particular
589 paged output cannot be scrolled with the mouse.
590 See less(1) for more discussion.
592 $SYSTEMD_LESSCHARSET
594 Override the charset passed to less (by default "utf-8", if the
595 invoking terminal is determined to be UTF-8 compatible).
596 $SYSTEMD_COLORS
598 The value must be a boolean. Controls whether colorized output
599 should be generated. This can be specified to override the decision
600 that systemd makes based on $TERM and what the console is connected
601 to.
602 $SYSTEMD_URLIFY
604 The value must be a boolean. Controls whether clickable links
605 should be generated in the output for terminal emulators supporting
606 this. This can be specified to override the decision that systemd
607 makes based on $TERM and other conditions.
608
610 Without arguments, all collected logs are shown unfiltered:
611 journalctl
613 With one match specified, all entries with a field matching the
615 expression are shown:
616 journalctl _SYSTEMD_UNIT=avahi-daemon.service
618 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
619 If two different fields are matched, only entries matching both
621 expressions at the same time are shown:
622 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
624 If two matches refer to the same field, all entries matching either
626 expression are shown:
627 journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
629 If the separator "+" is used, two expressions may be combined in a
631 logical OR. The following will show all messages from the Avahi service
632 process with the PID 28097 plus all messages from the D-Bus service
633 (from any of its processes):
634 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
636 To show all fields emitted by a unit and about the unit, option
638 -u/--unit= should be used. journalctl -u name expands to a complex
639 filter similar to
640 _SYSTEMD_UNIT=name.service
642 + UNIT=name.service _PID=1
643 + OBJECT_SYSTEMD_UNIT=name.service _UID=0
644 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
645 (see systemd.journal-fields(5) for an explanation of those patterns).
648 Show all logs generated by the D-Bus executable:
650 journalctl /usr/bin/dbus-daemon
652 Show all kernel logs from previous boot:
654 journalctl -k -b -1
656 Show a live log display from a system service apache.service:
658 journalctl -f -u apache
660
662 systemd(1), systemd-journald.service(8), systemctl(1), coredumpctl(1),
663 systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd-
664 journal-remote.service(8), systemd-journal-upload.service(8)
665
667 1. Journal Export Format
668 https://www.freedesktop.org/wiki/Software/systemd/export
669 2. Journal JSON Format
671 https://www.freedesktop.org/wiki/Software/systemd/json
672 3. Server-Sent Events
674 https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
675 4. JavaScript Object Notation (JSON) Text Sequences
677 https://tools.ietf.org/html/rfc7464
678 5. Message Catalog Developer Documentation
680 https://www.freedesktop.org/wiki/Software/systemd/catalog
681systemd 243 JOURNALCTL(1)