1JOURNALCTL(1) journalctl JOURNALCTL(1)
2
3
4
6 journalctl - Query the systemd journal
7
9 journalctl [OPTIONS...] [MATCHES...]
10
12 journalctl may be used to query the contents of the systemd(1) journal
13 as written by systemd-journald.service(8).
14
15 If called without parameters, it will show the full contents of the
16 journal, starting with the oldest entry collected.
17
18 If one or more match arguments are passed, the output is filtered
19 accordingly. A match is in the format "FIELD=VALUE", e.g.
20 "_SYSTEMD_UNIT=httpd.service", referring to the components of a
21 structured journal entry. See systemd.journal-fields(7) for a list of
22 well-known fields. If multiple matches are specified matching different
23 fields, the log entries are filtered by both, i.e. the resulting output
24 will show only entries matching all the specified matches of this kind.
25 If two matches apply to the same field, then they are automatically
26 matched as alternatives, i.e. the resulting output will show entries
27 matching any of the specified matches for the same field. Finally, the
28 character "+" may appear as a separate word between other terms on the
29 command line. This causes all matches before and after to be combined
30 in a disjunction (i.e. logical OR).
31
32 It is also possible to filter the entries by specifying an absolute
33 file path as an argument. The file path may be a file or a symbolic
34 link and the file must exist at the time of the query. If a file path
35 refers to an executable binary, an "_EXE=" match for the canonicalized
36 binary path is added to the query. If a file path refers to an
37 executable script, a "_COMM=" match for the script name is added to the
38 query. If a file path refers to a device node, "_KERNEL_DEVICE="
39 matches for the kernel name of the device and for each of its ancestor
40 devices is added to the query. Symbolic links are dereferenced, kernel
41 names are synthesized, and parent devices are identified from the
42 environment at the time of the query. In general, a device node is the
43 best proxy for an actual device, as log entries do not usually contain
44 fields that identify an actual device. For the resulting log entries to
45 be correct for the actual device, the relevant parts of the environment
46 at the time the entry was logged, in particular the actual device
47 corresponding to the device node, must have been the same as those at
48 the time of the query. Because device nodes generally change their
49 corresponding devices across reboots, specifying a device node path
50 causes the resulting entries to be restricted to those from the current
51 boot.
52
53 Additional constraints may be added using options --boot, --unit=,
54 etc., to further limit what entries will be shown (logical AND).
55
56 Output is interleaved from all accessible journal files, whether they
57 are rotated or currently being written, and regardless of whether they
58 belong to the system itself or are accessible user journals.
59
60 The set of journal files which will be used can be modified using the
61 --user, --system, --directory, and --file options, see below.
62
63 All users are granted access to their private per-user journals.
64 However, by default, only root and users who are members of a few
65 special groups are granted access to the system journal and the
66 journals of other users. Members of the groups "systemd-journal",
67 "adm", and "wheel" can read all journal files. Note that the two latter
68 groups traditionally have additional privileges specified by the
69 distribution. Members of the "wheel" group can often perform
70 administrative tasks.
71
72 The output is paged through less by default, and long lines are
73 "truncated" to screen width. The hidden part can be viewed by using the
74 left-arrow and right-arrow keys. Paging can be disabled; see the
75 --no-pager option and the "Environment" section below.
76
77 When outputting to a tty, lines are colored according to priority:
78 lines of level ERROR and higher are colored red; lines of level NOTICE
79 and higher are highlighted; lines of level DEBUG are colored lighter
80 grey; other lines are displayed normally.
81
83 The following options are understood:
84
85 --no-full, --full, -l
86 Ellipsize fields when they do not fit in available columns. The
87 default is to show full fields, allowing them to wrap or be
88 truncated by the pager, if one is used.
89
90 The old options -l/--full are not useful anymore, except to undo
91 --no-full.
92
93 -a, --all
94 Show all fields in full, even if they include unprintable
95 characters or are very long. By default, fields with unprintable
96 characters are abbreviated as "blob data". (Note that the pager may
97 escape unprintable characters again.)
98
99 -f, --follow
100 Show only the most recent journal entries, and continuously print
101 new entries as they are appended to the journal.
102
103 -e, --pager-end
104 Immediately jump to the end of the journal inside the implied pager
105 tool. This implies -n1000 to guarantee that the pager will not
106 buffer logs of unbounded size. This may be overridden with an
107 explicit -n with some other numeric value, while -nall will disable
108 this cap. Note that this option is only supported for the less(1)
109 pager.
110
111 -n, --lines=
112 Show the most recent journal events and limit the number of events
113 shown. If --follow is used, this option is implied. The argument is
114 a positive integer or "all" to disable line limiting. The default
115 value is 10 if no argument is given.
116
117 --no-tail
118 Show all stored output lines, even in follow mode. Undoes the
119 effect of --lines=.
120
121 -r, --reverse
122 Reverse output so that the newest entries are displayed first.
123
124 -o, --output=
125 Controls the formatting of the journal entries that are shown.
126 Takes one of the following options:
127
128 short
129 is the default and generates an output that is mostly identical
130 to the formatting of classic syslog files, showing one line per
131 journal entry.
132
133 short-full
134 is very similar, but shows timestamps in the format the
135 --since= and --until= options accept. Unlike the timestamp
136 information shown in short output mode this mode includes
137 weekday, year and timezone information in the output, and is
138 locale-independent.
139
140 short-iso
141 is very similar, but shows ISO 8601 wallclock timestamps.
142
143 short-iso-precise
144 as for short-iso but includes full microsecond precision.
145
146 short-precise
147 is very similar, but shows classic syslog timestamps with full
148 microsecond precision.
149
150 short-monotonic
151 is very similar, but shows monotonic timestamps instead of
152 wallclock timestamps.
153
154 short-unix
155 is very similar, but shows seconds passed since January 1st
156 1970 UTC instead of wallclock timestamps ("UNIX time"). The
157 time is shown with microsecond accuracy.
158
159 verbose
160 shows the full-structured entry items with all fields.
161
162 export
163 serializes the journal into a binary (but mostly text-based)
164 stream suitable for backups and network transfer (see Journal
165 Export Format[1] for more information). To import the binary
166 stream back into native journald format use systemd-journal-
167 remote(8).
168
169 json
170 formats entries as JSON objects, separated by newline
171 characters (see Journal JSON Format[2] for more information).
172 Field values are generally encoded as JSON strings, with three
173 exceptions:
174
175 1. Fields larger than 4096 bytes are encoded as null values.
176 (This may be turned off by passing --all, but be aware that
177 this may allocate overly long JSON objects.)
178
179 2. Journal entries permit non-unique fields within the same
180 log entry. JSON does not allow non-unique fields within
181 objects. Due to this, if a non-unique field is encountered
182 a JSON array is used as field value, listing all field
183 values as elements.
184
185 3. Fields containing non-printable or non-UTF8 bytes are
186 encoded as arrays containing the raw bytes individually
187 formatted as unsigned numbers.
188
189 Note that this encoding is reversible (with the exception of
190 the size limit).
191
192 json-pretty
193 formats entries as JSON data structures, but formats them in
194 multiple lines in order to make them more readable by humans.
195
196 json-sse
197 formats entries as JSON data structures, but wraps them in a
198 format suitable for Server-Sent Events[3].
199
200 json-seq
201 formats entries as JSON data structures, but prefixes them with
202 an ASCII Record Separator character (0x1E) and suffixes them
203 with an ASCII Line Feed character (0x0A), in accordance with
204 JavaScript Object Notation (JSON) Text Sequences[4]
205 ("application/json-seq").
206
207 cat
208 generates a very terse output, only showing the actual message
209 of each journal entry with no metadata, not even a timestamp.
210
211 with-unit
212 similar to short-full, but prefixes the unit and user unit
213 names instead of the traditional syslog identifier. Useful when
214 using templated instances, as it will include the arguments in
215 the unit names.
216
217 --output-fields=
218 A comma separated list of the fields which should be included in
219 the output. This only has an effect for the output modes which
220 would normally show all fields (verbose, export, json, json-pretty,
221 json-sse and json-seq). The "__CURSOR", "__REALTIME_TIMESTAMP",
222 "__MONOTONIC_TIMESTAMP", and "_BOOT_ID" fields are always printed.
223
224 --utc
225 Express time in Coordinated Universal Time (UTC).
226
227 --no-hostname
228 Don't show the hostname field of log messages originating from the
229 local host. This switch only has an effect on the short family of
230 output modes (see above).
231
232 -x, --catalog
233 Augment log lines with explanation texts from the message catalog.
234 This will add explanatory help texts to log messages in the output
235 where this is available. These short help texts will explain the
236 context of an error or log event, possible solutions, as well as
237 pointers to support forums, developer documentation, and any other
238 relevant manuals. Note that help texts are not available for all
239 messages, but only for selected ones. For more information on the
240 message catalog, please refer to the Message Catalog Developer
241 Documentation[5].
242
243 Note: when attaching journalctl output to bug reports, please do
244 not use -x.
245
246 -q, --quiet
247 Suppresses all informational messages (i.e. "-- Logs begin at ...",
248 "-- Reboot --"), any warning messages regarding inaccessible system
249 journals when run as a normal user.
250
251 -m, --merge
252 Show entries interleaved from all available journals, including
253 remote ones.
254
255 -b [[ID][±offset]|all], --boot[=[ID][±offset]|all]
256 Show messages from a specific boot. This will add a match for
257 "_BOOT_ID=".
258
259 The argument may be empty, in which case logs for the current boot
260 will be shown.
261
262 If the boot ID is omitted, a positive offset will look up the boots
263 starting from the beginning of the journal, and an
264 equal-or-less-than zero offset will look up boots starting from the
265 end of the journal. Thus, 1 means the first boot found in the
266 journal in chronological order, 2 the second and so on; while -0 is
267 the last boot, -1 the boot before last, and so on. An empty offset
268 is equivalent to specifying -0, except when the current boot is not
269 the last boot (e.g. because --directory was specified to look at
270 logs from a different machine).
271
272 If the 32-character ID is specified, it may optionally be followed
273 by offset which identifies the boot relative to the one given by
274 boot ID. Negative values mean earlier boots and positive values
275 mean later boots. If offset is not specified, a value of zero is
276 assumed, and the logs for the boot given by ID are shown.
277
278 The special argument all can be used to negate the effect of an
279 earlier use of -b.
280
281 --list-boots
282 Show a tabular list of boot numbers (relative to the current boot),
283 their IDs, and the timestamps of the first and last message
284 pertaining to the boot.
285
286 -k, --dmesg
287 Show only kernel messages. This implies -b and adds the match
288 "_TRANSPORT=kernel".
289
290 -t, --identifier=SYSLOG_IDENTIFIER
291 Show messages for the specified syslog identifier
292 SYSLOG_IDENTIFIER.
293
294 This parameter can be specified multiple times.
295
296 -u, --unit=UNIT|PATTERN
297 Show messages for the specified systemd unit UNIT (such as a
298 service unit), or for any of the units matched by PATTERN. If a
299 pattern is specified, a list of unit names found in the journal is
300 compared with the specified pattern and all that match are used.
301 For each unit name, a match is added for messages from the unit
302 ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages
303 from systemd and messages about coredumps for the specified unit. A
304 match is also added for "_SYSTEMD_SLICE=UNIT", such that if the
305 provided UNIT is a systemd.slice(5) unit, all logs of the children
306 of the slice will be logged.
307
308 This parameter can be specified multiple times.
309
310 --user-unit=
311 Show messages for the specified user session unit. This will add a
312 match for messages from the unit ("_SYSTEMD_USER_UNIT=" and
313 "_UID=") and additional matches for messages from session systemd
314 and messages about coredumps for the specified unit. A match is
315 also added for "_SYSTEMD_USER_SLICE=UNIT", such that if the
316 provided UNIT is a systemd.slice(5) unit, all logs of the children
317 of the unit will be logged.
318
319 This parameter can be specified multiple times.
320
321 -p, --priority=
322 Filter output by message priorities or priority ranges. Takes
323 either a single numeric or textual log level (i.e. between
324 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in
325 the form FROM..TO. The log levels are the usual syslog log levels
326 as documented in syslog(3), i.e. "emerg" (0), "alert" (1),
327 "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6),
328 "debug" (7). If a single log level is specified, all messages with
329 this log level or a lower (hence more important) log level are
330 shown. If a range is specified, all messages within the range are
331 shown, including both the start and the end value of the range.
332 This will add "PRIORITY=" matches for the specified priorities.
333
334 --facility=
335 Filter output by syslog facility. Takes a comma-separated list of
336 numbers or facility names. The names are the usual syslog
337 facilities as documented in syslog(3). --facility=help may be used
338 to display a list of known facility names and exit.
339
340 -g, --grep=
341 Filter output to entries where the MESSAGE= field matches the
342 specified regular expression. PERL-compatible regular expressions
343 are used, see pcre2pattern(3) for a detailed description of the
344 syntax.
345
346 If the pattern is all lowercase, matching is case insensitive.
347 Otherwise, matching is case sensitive. This can be overridden with
348 the --case-sensitive option, see below.
349
350 --case-sensitive[=BOOLEAN]
351 Make pattern matching case sensitive or case insenstive.
352
353 -c, --cursor=
354 Start showing entries from the location in the journal specified by
355 the passed cursor.
356
357 --cursor-file=FILE
358 If FILE exists and contains a cursor, start showing entries after
359 this location. Otherwise the show entries according the other given
360 options. At the end, write the cursor of the last entry to FILE.
361 Use this option to continually read the journal by sequentially
362 calling journalctl.
363
364 --after-cursor=
365 Start showing entries from the location in the journal after the
366 location specified by the passed cursor. The cursor is shown when
367 the --show-cursor option is used.
368
369 --show-cursor
370 The cursor is shown after the last entry after two dashes:
371
372 -- cursor: s=0639...
373
374 The format of the cursor is private and subject to change.
375
376 -S, --since=, -U, --until=
377 Start showing entries on or newer than the specified date, or on or
378 older than the specified date, respectively. Date specifications
379 should be of the format "2012-10-30 18:17:16". If the time part is
380 omitted, "00:00:00" is assumed. If only the seconds component is
381 omitted, ":00" is assumed. If the date component is omitted, the
382 current day is assumed. Alternatively the strings "yesterday",
383 "today", "tomorrow" are understood, which refer to 00:00:00 of the
384 day before the current day, the current day, or the day after the
385 current day, respectively. "now" refers to the current time.
386 Finally, relative times may be specified, prefixed with "-" or "+",
387 referring to times before or after the current time, respectively.
388 For complete time and date specification, see systemd.time(7). Note
389 that --output=short-full prints timestamps that follow precisely
390 this format.
391
392 -F, --field=
393 Print all possible data values the specified field can take in all
394 entries of the journal.
395
396 -N, --fields
397 Print all field names currently used in all entries of the journal.
398
399 --system, --user
400 Show messages from system services and the kernel (with --system).
401 Show messages from service of current user (with --user). If
402 neither is specified, show all messages that the user can see.
403
404 -M, --machine=
405 Show messages from a running, local container. Specify a container
406 name to connect to.
407
408 -D DIR, --directory=DIR
409 Takes a directory path as argument. If specified, journalctl will
410 operate on the specified journal directory DIR instead of the
411 default runtime and system journal paths.
412
413 --file=GLOB
414 Takes a file glob as an argument. If specified, journalctl will
415 operate on the specified journal files matching GLOB instead of the
416 default runtime and system journal paths. May be specified multiple
417 times, in which case files will be suitably interleaved.
418
419 --root=ROOT
420 Takes a directory path as an argument. If specified, journalctl
421 will operate on journal directories and catalog file hierarchy
422 underneath the specified directory instead of the root directory
423 (e.g. --update-catalog will create
424 ROOT/var/lib/systemd/catalog/database, and journal files under
425 ROOT/run/journal or ROOT/var/log/journal will be displayed).
426
427 --namespace=NAMESPACE
428 Takes a journal namespace identifier string as argument. If not
429 specified the data collected by the default namespace is shown. If
430 specified shows the log data of the specified namespace instead. If
431 the namespace is specified as "*" data from all namespaces is
432 shown, interleaved. If the namespace identifier is prefixed with
433 "+" data from the specified namespace and the default namespace is
434 shown, interleaved, but no other. For details about journal
435 namespaces see systemd-journald.service(8).
436
437 --header
438 Instead of showing journal contents, show internal header
439 information of the journal fields accessed.
440
441 --disk-usage
442 Shows the current disk usage of all journal files. This shows the
443 sum of the disk usage of all archived and active journal files.
444
445 --vacuum-size=, --vacuum-time=, --vacuum-files=
446 Removes the oldest archived journal files until the disk space they
447 use falls below the specified size (specified with the usual "K",
448 "M", "G" and "T" suffixes), or all archived journal files contain
449 no data older than the specified timespan (specified with the usual
450 "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or
451 no more than the specified number of separate journal files remain.
452 Note that running --vacuum-size= has only an indirect effect on the
453 output shown by --disk-usage, as the latter includes active journal
454 files, while the vacuuming operation only operates on archived
455 journal files. Similarly, --vacuum-files= might not actually reduce
456 the number of journal files to below the specified number, as it
457 will not remove active journal files.
458
459 --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
460 in a single invocation to enforce any combination of a size, a time
461 and a number of files limit on the archived journal files.
462 Specifying any of these three parameters as zero is equivalent to
463 not enforcing the specific limit, and is thus redundant.
464
465 These three switches may also be combined with --rotate into one
466 command. If so, all active files are rotated first, and the
467 requested vacuuming operation is executed right after. The rotation
468 has the effect that all currently active files are archived (and
469 potentially new, empty journal files opened as replacement), and
470 hence the vacuuming operation has the greatest effect as it can
471 take all log data written so far into account.
472
473 --list-catalog [128-bit-ID...]
474 List the contents of the message catalog as a table of message IDs,
475 plus their short description strings.
476
477 If any 128-bit-IDs are specified, only those entries are shown.
478
479 --dump-catalog [128-bit-ID...]
480 Show the contents of the message catalog, with entries separated by
481 a line consisting of two dashes and the ID (the format is the same
482 as .catalog files).
483
484 If any 128-bit-IDs are specified, only those entries are shown.
485
486 --update-catalog
487 Update the message catalog index. This command needs to be executed
488 each time new catalog files are installed, removed, or updated to
489 rebuild the binary catalog index.
490
491 --setup-keys
492 Instead of showing journal contents, generate a new key pair for
493 Forward Secure Sealing (FSS). This will generate a sealing key and
494 a verification key. The sealing key is stored in the journal data
495 directory and shall remain on the host. The verification key should
496 be stored externally. Refer to the Seal= option in journald.conf(5)
497 for information on Forward Secure Sealing and for a link to a
498 refereed scholarly paper detailing the cryptographic theory it is
499 based on.
500
501 --force
502 When --setup-keys is passed and Forward Secure Sealing (FSS) has
503 already been configured, recreate FSS keys.
504
505 --interval=
506 Specifies the change interval for the sealing key when generating
507 an FSS key pair with --setup-keys. Shorter intervals increase CPU
508 consumption but shorten the time range of undetectable journal
509 alterations. Defaults to 15min.
510
511 --verify
512 Check the journal file for internal consistency. If the file has
513 been generated with FSS enabled and the FSS verification key has
514 been specified with --verify-key=, authenticity of the journal file
515 is verified.
516
517 --verify-key=
518 Specifies the FSS verification key to use for the --verify
519 operation.
520
521 --sync
522 Asks the journal daemon to write all yet unwritten journal data to
523 the backing file system and synchronize all journals. This call
524 does not return until the synchronization operation is complete.
525 This command guarantees that any log messages written before its
526 invocation are safely stored on disk at the time it returns.
527
528 --flush
529 Asks the journal daemon to flush any log data stored in
530 /run/log/journal/ into /var/log/journal/, if persistent storage is
531 enabled. This call does not return until the operation is complete.
532 Note that this call is idempotent: the data is only flushed from
533 /run/log/journal/ into /var/log/journal once during system runtime
534 (but see --relinquish-var below), and this command exits cleanly
535 without executing any operation if this has already happened. This
536 command effectively guarantees that all data is flushed to
537 /var/log/journal at the time it returns.
538
539 --relinquish-var
540 Asks the journal daemon for the reverse operation to --flush: if
541 requested the daemon will write further log data to
542 /run/log/journal/ and stops writing to /var/log/journal/. A
543 subsequent call to --flush causes the log output to switch back to
544 /var/log/journal/, see above.
545
546 --smart-relinquish-var
547 Similar to --relinquish-var but executes no operation if the root
548 file system and /var/lib/journal/ reside on the same mount point.
549 This operation is used during system shutdown in order to make the
550 journal daemon stop writing data to /var/log/journal/ in case that
551 directory is located on a mount point that needs to be unmounted.
552
553 --rotate
554 Asks the journal daemon to rotate journal files. This call does not
555 return until the rotation operation is complete. Journal file
556 rotation has the effect that all currently active journal files are
557 marked as archived and renamed, so that they are never written to
558 in future. New (empty) journal files are then created in their
559 place. This operation may be combined with --vacuum-size=,
560 --vacuum-time= and --vacuum-file= into a single command, see above.
561
562 -h, --help
563 Print a short help text and exit.
564
565 --version
566 Print a short version string and exit.
567
568 --no-pager
569 Do not pipe output into a pager.
570
572 On success, 0 is returned; otherwise, a non-zero failure code is
573 returned.
574
576 $SYSTEMD_PAGER
577 Pager to use when --no-pager is not given; overrides $PAGER. If
578 neither $SYSTEMD_PAGER nor $PAGER are set, a set of well-known
579 pager implementations are tried in turn, including less(1) and
580 more(1), until one is found. If no pager implementation is
581 discovered no pager is invoked. Setting this environment variable
582 to an empty string or the value "cat" is equivalent to passing
583 --no-pager.
584
585 $SYSTEMD_LESS
586 Override the options passed to less (by default "FRSXMK").
587
588 Users might want to change two options in particular:
589
590 K
591 This option instructs the pager to exit immediately when Ctrl+C
592 is pressed. To allow less to handle Ctrl+C itself to switch
593 back to the pager command prompt, unset this option.
594
595 If the value of $SYSTEMD_LESS does not include "K", and the
596 pager that is invoked is less, Ctrl+C will be ignored by the
597 executable, and needs to be handled by the pager.
598
599 X
600 This option instructs the pager to not send termcap
601 initialization and deinitialization strings to the terminal. It
602 is set by default to allow command output to remain visible in
603 the terminal even after the pager exits. Nevertheless, this
604 prevents some pager functionality from working, in particular
605 paged output cannot be scrolled with the mouse.
606
607 See less(1) for more discussion.
608
609 $SYSTEMD_LESSCHARSET
610 Override the charset passed to less (by default "utf-8", if the
611 invoking terminal is determined to be UTF-8 compatible).
612
613 $SYSTEMD_COLORS
614 The value must be a boolean. Controls whether colorized output
615 should be generated. This can be specified to override the decision
616 that systemd makes based on $TERM and what the console is connected
617 to.
618
619 $SYSTEMD_URLIFY
620 The value must be a boolean. Controls whether clickable links
621 should be generated in the output for terminal emulators supporting
622 this. This can be specified to override the decision that systemd
623 makes based on $TERM and other conditions.
624
626 Without arguments, all collected logs are shown unfiltered:
627
628 journalctl
629
630 With one match specified, all entries with a field matching the
631 expression are shown:
632
633 journalctl _SYSTEMD_UNIT=avahi-daemon.service
634 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
635
636 If two different fields are matched, only entries matching both
637 expressions at the same time are shown:
638
639 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
640
641 If two matches refer to the same field, all entries matching either
642 expression are shown:
643
644 journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
645
646 If the separator "+" is used, two expressions may be combined in a
647 logical OR. The following will show all messages from the Avahi service
648 process with the PID 28097 plus all messages from the D-Bus service
649 (from any of its processes):
650
651 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
652
653 To show all fields emitted by a unit and about the unit, option
654 -u/--unit= should be used. journalctl -u name expands to a complex
655 filter similar to
656
657 _SYSTEMD_UNIT=name.service
658 + UNIT=name.service _PID=1
659 + OBJECT_SYSTEMD_UNIT=name.service _UID=0
660 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
661
662
663 (see systemd.journal-fields(5) for an explanation of those patterns).
664
665 Show all logs generated by the D-Bus executable:
666
667 journalctl /usr/bin/dbus-daemon
668
669 Show all kernel logs from previous boot:
670
671 journalctl -k -b -1
672
673 Show a live log display from a system service apache.service:
674
675 journalctl -f -u apache
676
678 systemd(1), systemd-journald.service(8), systemctl(1), coredumpctl(1),
679 systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd-
680 journal-remote.service(8), systemd-journal-upload.service(8)
681
683 1. Journal Export Format
684 https://www.freedesktop.org/wiki/Software/systemd/export
685
686 2. Journal JSON Format
687 https://www.freedesktop.org/wiki/Software/systemd/json
688
689 3. Server-Sent Events
690 https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
691
692 4. JavaScript Object Notation (JSON) Text Sequences
693 https://tools.ietf.org/html/rfc7464
694
695 5. Message Catalog Developer Documentation
696 https://www.freedesktop.org/wiki/Software/systemd/catalog
697
698
699
700systemd 245 JOURNALCTL(1)