1JOURNALCTL(1) journalctl JOURNALCTL(1)
2
6 journalctl - Query the systemd journal
7
9 journalctl [OPTIONS...] [MATCHES...]
10
12 journalctl may be used to query the contents of the systemd(1) journal
13 as written by systemd-journald.service(8).
14 If called without parameters, it will show the full contents of the
16 journal, starting with the oldest entry collected.
17 If one or more match arguments are passed, the output is filtered
19 accordingly. A match is in the format "FIELD=VALUE", e.g.
20 "_SYSTEMD_UNIT=httpd.service", referring to the components of a
21 structured journal entry. See systemd.journal-fields(7) for a list of
22 well-known fields. If multiple matches are specified matching different
23 fields, the log entries are filtered by both, i.e. the resulting output
24 will show only entries matching all the specified matches of this kind.
25 If two matches apply to the same field, then they are automatically
26 matched as alternatives, i.e. the resulting output will show entries
27 matching any of the specified matches for the same field. Finally, the
28 character "+" may appear as a separate word between other terms on the
29 command line. This causes all matches before and after to be combined
30 in a disjunction (i.e. logical OR).
31 It is also possible to filter the entries by specifying an absolute
33 file path as an argument. The file path may be a file or a symbolic
34 link and the file must exist at the time of the query. If a file path
35 refers to an executable binary, an "_EXE=" match for the canonicalized
36 binary path is added to the query. If a file path refers to an
37 executable script, a "_COMM=" match for the script name is added to the
38 query. If a file path refers to a device node, "_KERNEL_DEVICE="
39 matches for the kernel name of the device and for each of its ancestor
40 devices is added to the query. Symbolic links are dereferenced, kernel
41 names are synthesized, and parent devices are identified from the
42 environment at the time of the query. In general, a device node is the
43 best proxy for an actual device, as log entries do not usually contain
44 fields that identify an actual device. For the resulting log entries to
45 be correct for the actual device, the relevant parts of the environment
46 at the time the entry was logged, in particular the actual device
47 corresponding to the device node, must have been the same as those at
48 the time of the query. Because device nodes generally change their
49 corresponding devices across reboots, specifying a device node path
50 causes the resulting entries to be restricted to those from the current
51 boot.
52 Additional constraints may be added using options --boot, --unit=,
54 etc., to further limit what entries will be shown (logical AND).
55 Output is interleaved from all accessible journal files, whether they
57 are rotated or currently being written, and regardless of whether they
58 belong to the system itself or are accessible user journals.
59 The set of journal files which will be used can be modified using the
61 --user, --system, --directory, and --file options, see below.
62 All users are granted access to their private per-user journals.
64 However, by default, only root and users who are members of a few
65 special groups are granted access to the system journal and the
66 journals of other users. Members of the groups "systemd-journal",
67 "adm", and "wheel" can read all journal files. Note that the two latter
68 groups traditionally have additional privileges specified by the
69 distribution. Members of the "wheel" group can often perform
70 administrative tasks.
71 The output is paged through less by default, and long lines are
73 "truncated" to screen width. The hidden part can be viewed by using the
74 left-arrow and right-arrow keys. Paging can be disabled; see the
75 --no-pager option and the "Environment" section below.
76 When outputting to a tty, lines are colored according to priority:
78 lines of level ERROR and higher are colored red; lines of level NOTICE
79 and higher are highlighted; lines of level DEBUG are colored lighter
80 grey; other lines are displayed normally.
81
83 The following options are understood:
84 --no-full, --full, -l
86 Ellipsize fields when they do not fit in available columns. The
87 default is to show full fields, allowing them to wrap or be
88 truncated by the pager, if one is used.
89 The old options -l/--full are not useful anymore, except to undo
91 --no-full.
92 -a, --all
94 Show all fields in full, even if they include unprintable
95 characters or are very long. By default, fields with unprintable
96 characters are abbreviated as "blob data". (Note that the pager may
97 escape unprintable characters again.)
98 -f, --follow
100 Show only the most recent journal entries, and continuously print
101 new entries as they are appended to the journal.
102 -e, --pager-end
104 Immediately jump to the end of the journal inside the implied pager
105 tool. This implies -n1000 to guarantee that the pager will not
106 buffer logs of unbounded size. This may be overridden with an
107 explicit -n with some other numeric value, while -nall will disable
108 this cap. Note that this option is only supported for the less(1)
109 pager.
110 -n, --lines=
112 Show the most recent journal events and limit the number of events
113 shown. If --follow is used, this option is implied. The argument is
114 a positive integer or "all" to disable line limiting. The default
115 value is 10 if no argument is given.
116 --no-tail
118 Show all stored output lines, even in follow mode. Undoes the
119 effect of --lines=.
120 -r, --reverse
122 Reverse output so that the newest entries are displayed first.
123 -o, --output=
125 Controls the formatting of the journal entries that are shown.
126 Takes one of the following options:
127 short
129 is the default and generates an output that is mostly identical
130 to the formatting of classic syslog files, showing one line per
131 journal entry.
132 short-full
134 is very similar, but shows timestamps in the format the
135 --since= and --until= options accept. Unlike the timestamp
136 information shown in short output mode this mode includes
137 weekday, year and timezone information in the output, and is
138 locale-independent.
139 short-iso
141 is very similar, but shows ISO 8601 wallclock timestamps.
142 short-iso-precise
144 as for short-iso but includes full microsecond precision.
145 short-precise
147 is very similar, but shows classic syslog timestamps with full
148 microsecond precision.
149 short-monotonic
151 is very similar, but shows monotonic timestamps instead of
152 wallclock timestamps.
153 short-unix
155 is very similar, but shows seconds passed since January 1st
156 1970 UTC instead of wallclock timestamps ("UNIX time"). The
157 time is shown with microsecond accuracy.
158 verbose
160 shows the full-structured entry items with all fields.
161 export
163 serializes the journal into a binary (but mostly text-based)
164 stream suitable for backups and network transfer (see Journal
165 Export Format[1] for more information). To import the binary
166 stream back into native journald format use systemd-journal-
167 remote(8).
168 json
170 formats entries as JSON objects, separated by newline
171 characters (see Journal JSON Format[2] for more information).
172 Field values are generally encoded as JSON strings, with three
173 exceptions:
174 1. Fields larger than 4096 bytes are encoded as null values.
176 (This may be turned off by passing --all, but be aware that
177 this may allocate overly long JSON objects.)
178 2. Journal entries permit non-unique fields within the same
180 log entry. JSON does not allow non-unique fields within
181 objects. Due to this, if a non-unique field is encountered
182 a JSON array is used as field value, listing all field
183 values as elements.
184 3. Fields containing non-printable or non-UTF8 bytes are
186 encoded as arrays containing the raw bytes individually
187 formatted as unsigned numbers.
188 Note that this encoding is reversible (with the exception of
190 the size limit).
191 json-pretty
193 formats entries as JSON data structures, but formats them in
194 multiple lines in order to make them more readable by humans.
195 json-sse
197 formats entries as JSON data structures, but wraps them in a
198 format suitable for Server-Sent Events[3].
199 json-seq
201 formats entries as JSON data structures, but prefixes them with
202 an ASCII Record Separator character (0x1E) and suffixes them
203 with an ASCII Line Feed character (0x0A), in accordance with
204 JavaScript Object Notation (JSON) Text Sequences[4]
205 ("application/json-seq").
206 cat
208 generates a very terse output, only showing the actual message
209 of each journal entry with no metadata, not even a timestamp.
210 with-unit
212 similar to short-full, but prefixes the unit and user unit
213 names instead of the traditional syslog identifier. Useful when
214 using templated instances, as it will include the arguments in
215 the unit names.
216 --output-fields=
218 A comma separated list of the fields which should be included in
219 the output. This only has an effect for the output modes which
220 would normally show all fields (verbose, export, json, json-pretty,
221 json-sse and json-seq). The "__CURSOR", "__REALTIME_TIMESTAMP",
222 "__MONOTONIC_TIMESTAMP", and "_BOOT_ID" fields are always printed.
223 --utc
225 Express time in Coordinated Universal Time (UTC).
226 --no-hostname
228 Don't show the hostname field of log messages originating from the
229 local host. This switch only has an effect on the short family of
230 output modes (see above).
231 -x, --catalog
233 Augment log lines with explanation texts from the message catalog.
234 This will add explanatory help texts to log messages in the output
235 where this is available. These short help texts will explain the
236 context of an error or log event, possible solutions, as well as
237 pointers to support forums, developer documentation, and any other
238 relevant manuals. Note that help texts are not available for all
239 messages, but only for selected ones. For more information on the
240 message catalog, please refer to the Message Catalog Developer
241 Documentation[5].
242 Note: when attaching journalctl output to bug reports, please do
244 not use -x.
245 -q, --quiet
247 Suppresses all informational messages (i.e. "-- Logs begin at ...",
248 "-- Reboot --"), any warning messages regarding inaccessible system
249 journals when run as a normal user.
250 -m, --merge
252 Show entries interleaved from all available journals, including
253 remote ones.
254 -b [[ID][±offset]|all], --boot[=[ID][±offset]|all]
256 Show messages from a specific boot. This will add a match for
257 "_BOOT_ID=".
258 The argument may be empty, in which case logs for the current boot
260 will be shown.
261 If the boot ID is omitted, a positive offset will look up the boots
263 starting from the beginning of the journal, and an
264 equal-or-less-than zero offset will look up boots starting from the
265 end of the journal. Thus, 1 means the first boot found in the
266 journal in chronological order, 2 the second and so on; while -0 is
267 the last boot, -1 the boot before last, and so on. An empty offset
268 is equivalent to specifying -0, except when the current boot is not
269 the last boot (e.g. because --directory was specified to look at
270 logs from a different machine).
271 If the 32-character ID is specified, it may optionally be followed
273 by offset which identifies the boot relative to the one given by
274 boot ID. Negative values mean earlier boots and positive values
275 mean later boots. If offset is not specified, a value of zero is
276 assumed, and the logs for the boot given by ID are shown.
277 The special argument all can be used to negate the effect of an
279 earlier use of -b.
280 --list-boots
282 Show a tabular list of boot numbers (relative to the current boot),
283 their IDs, and the timestamps of the first and last message
284 pertaining to the boot.
285 -k, --dmesg
287 Show only kernel messages. This implies -b and adds the match
288 "_TRANSPORT=kernel".
289 -t, --identifier=SYSLOG_IDENTIFIER
291 Show messages for the specified syslog identifier
292 SYSLOG_IDENTIFIER.
293 This parameter can be specified multiple times.
295 -u, --unit=UNIT|PATTERN
297 Show messages for the specified systemd unit UNIT (such as a
298 service unit), or for any of the units matched by PATTERN. If a
299 pattern is specified, a list of unit names found in the journal is
300 compared with the specified pattern and all that match are used.
301 For each unit name, a match is added for messages from the unit
302 ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages
303 from systemd and messages about coredumps for the specified unit. A
304 match is also added for "_SYSTEMD_SLICE=UNIT", such that if the
305 provided UNIT is a systemd.slice(5) unit, all logs of the children
306 of the slice will be logged.
307 This parameter can be specified multiple times.
309 --user-unit=
311 Show messages for the specified user session unit. This will add a
312 match for messages from the unit ("_SYSTEMD_USER_UNIT=" and
313 "_UID=") and additional matches for messages from session systemd
314 and messages about coredumps for the specified unit. A match is
315 also added for "_SYSTEMD_USER_SLICE=UNIT", such that if the
316 provided UNIT is a systemd.slice(5) unit, all logs of the children
317 of the unit will be logged.
318 This parameter can be specified multiple times.
320 -p, --priority=
322 Filter output by message priorities or priority ranges. Takes
323 either a single numeric or textual log level (i.e. between
324 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in
325 the form FROM..TO. The log levels are the usual syslog log levels
326 as documented in syslog(3), i.e. "emerg" (0), "alert" (1),
327 "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6),
328 "debug" (7). If a single log level is specified, all messages with
329 this log level or a lower (hence more important) log level are
330 shown. If a range is specified, all messages within the range are
331 shown, including both the start and the end value of the range.
332 This will add "PRIORITY=" matches for the specified priorities.
333 --facility=
335 Filter output by syslog facility. Takes a comma-separated list of
336 numbers or facility names. The names are the usual syslog
337 facilities as documented in syslog(3). --facility=help may be used
338 to display a list of known facility names and exit.
339 -g, --grep=
341 Filter output to entries where the MESSAGE= field matches the
342 specified regular expression. PERL-compatible regular expressions
343 are used, see pcre2pattern(3) for a detailed description of the
344 syntax.
345 If the pattern is all lowercase, matching is case insensitive.
347 Otherwise, matching is case sensitive. This can be overridden with
348 the --case-sensitive option, see below.
349 --case-sensitive[=BOOLEAN]
351 Make pattern matching case sensitive or case insenstive.
352 -c, --cursor=
354 Start showing entries from the location in the journal specified by
355 the passed cursor.
356 --cursor-file=FILE
358 If FILE exists and contains a cursor, start showing entries after
359 this location. Otherwise the show entries according the other given
360 options. At the end, write the cursor of the last entry to FILE.
361 Use this option to continually read the journal by sequentially
362 calling journalctl.
363 --after-cursor=
365 Start showing entries from the location in the journal after the
366 location specified by the passed cursor. The cursor is shown when
367 the --show-cursor option is used.
368 --show-cursor
370 The cursor is shown after the last entry after two dashes:
371 -- cursor: s=0639...
373 The format of the cursor is private and subject to change.
375 -S, --since=, -U, --until=
377 Start showing entries on or newer than the specified date, or on or
378 older than the specified date, respectively. Date specifications
379 should be of the format "2012-10-30 18:17:16". If the time part is
380 omitted, "00:00:00" is assumed. If only the seconds component is
381 omitted, ":00" is assumed. If the date component is omitted, the
382 current day is assumed. Alternatively the strings "yesterday",
383 "today", "tomorrow" are understood, which refer to 00:00:00 of the
384 day before the current day, the current day, or the day after the
385 current day, respectively. "now" refers to the current time.
386 Finally, relative times may be specified, prefixed with "-" or "+",
387 referring to times before or after the current time, respectively.
388 For complete time and date specification, see systemd.time(7). Note
389 that --output=short-full prints timestamps that follow precisely
390 this format.
391 -F, --field=
393 Print all possible data values the specified field can take in all
394 entries of the journal.
395 -N, --fields
397 Print all field names currently used in all entries of the journal.
398 --system, --user
400 Show messages from system services and the kernel (with --system).
401 Show messages from service of current user (with --user). If
402 neither is specified, show all messages that the user can see.
403 -M, --machine=
405 Show messages from a running, local container. Specify a container
406 name to connect to.
407 -D DIR, --directory=DIR
409 Takes a directory path as argument. If specified, journalctl will
410 operate on the specified journal directory DIR instead of the
411 default runtime and system journal paths.
412 --file=GLOB
414 Takes a file glob as an argument. If specified, journalctl will
415 operate on the specified journal files matching GLOB instead of the
416 default runtime and system journal paths. May be specified multiple
417 times, in which case files will be suitably interleaved.
418 --root=ROOT
420 Takes a directory path as an argument. If specified, journalctl
421 will operate on journal directories and catalog file hierarchy
422 underneath the specified directory instead of the root directory
423 (e.g. --update-catalog will create
424 ROOT/var/lib/systemd/catalog/database, and journal files under
425 ROOT/run/journal or ROOT/var/log/journal will be displayed).
426 --namespace=NAMESPACE
428 Takes a journal namespace identifier string as argument. If not
429 specified the data collected by the default namespace is shown. If
430 specified shows the log data of the specified namespace instead. If
431 the namespace is specified as "*" data from all namespaces is
432 shown, interleaved. If the namespace identifier is prefixed with
433 "+" data from the specified namespace and the default namespace is
434 shown, interleaved, but no other. For details about journal
435 namespaces see systemd-journald.service(8).
436 --header
438 Instead of showing journal contents, show internal header
439 information of the journal fields accessed.
440 --disk-usage
442 Shows the current disk usage of all journal files. This shows the
443 sum of the disk usage of all archived and active journal files.
444 --vacuum-size=, --vacuum-time=, --vacuum-files=
446 Removes the oldest archived journal files until the disk space they
447 use falls below the specified size (specified with the usual "K",
448 "M", "G" and "T" suffixes), or all archived journal files contain
449 no data older than the specified timespan (specified with the usual
450 "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or
451 no more than the specified number of separate journal files remain.
452 Note that running --vacuum-size= has only an indirect effect on the
453 output shown by --disk-usage, as the latter includes active journal
454 files, while the vacuuming operation only operates on archived
455 journal files. Similarly, --vacuum-files= might not actually reduce
456 the number of journal files to below the specified number, as it
457 will not remove active journal files.
458 --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
460 in a single invocation to enforce any combination of a size, a time
461 and a number of files limit on the archived journal files.
462 Specifying any of these three parameters as zero is equivalent to
463 not enforcing the specific limit, and is thus redundant.
464 These three switches may also be combined with --rotate into one
466 command. If so, all active files are rotated first, and the
467 requested vacuuming operation is executed right after. The rotation
468 has the effect that all currently active files are archived (and
469 potentially new, empty journal files opened as replacement), and
470 hence the vacuuming operation has the greatest effect as it can
471 take all log data written so far into account.
472 --list-catalog [128-bit-ID...]
474 List the contents of the message catalog as a table of message IDs,
475 plus their short description strings.
476 If any 128-bit-IDs are specified, only those entries are shown.
478 --dump-catalog [128-bit-ID...]
480 Show the contents of the message catalog, with entries separated by
481 a line consisting of two dashes and the ID (the format is the same
482 as .catalog files).
483 If any 128-bit-IDs are specified, only those entries are shown.
485 --update-catalog
487 Update the message catalog index. This command needs to be executed
488 each time new catalog files are installed, removed, or updated to
489 rebuild the binary catalog index.
490 --setup-keys
492 Instead of showing journal contents, generate a new key pair for
493 Forward Secure Sealing (FSS). This will generate a sealing key and
494 a verification key. The sealing key is stored in the journal data
495 directory and shall remain on the host. The verification key should
496 be stored externally. Refer to the Seal= option in journald.conf(5)
497 for information on Forward Secure Sealing and for a link to a
498 refereed scholarly paper detailing the cryptographic theory it is
499 based on.
500 --force
502 When --setup-keys is passed and Forward Secure Sealing (FSS) has
503 already been configured, recreate FSS keys.
504 --interval=
506 Specifies the change interval for the sealing key when generating
507 an FSS key pair with --setup-keys. Shorter intervals increase CPU
508 consumption but shorten the time range of undetectable journal
509 alterations. Defaults to 15min.
510 --verify
512 Check the journal file for internal consistency. If the file has
513 been generated with FSS enabled and the FSS verification key has
514 been specified with --verify-key=, authenticity of the journal file
515 is verified.
516 --verify-key=
518 Specifies the FSS verification key to use for the --verify
519 operation.
520 --sync
522 Asks the journal daemon to write all yet unwritten journal data to
523 the backing file system and synchronize all journals. This call
524 does not return until the synchronization operation is complete.
525 This command guarantees that any log messages written before its
526 invocation are safely stored on disk at the time it returns.
527 --flush
529 Asks the journal daemon to flush any log data stored in
530 /run/log/journal/ into /var/log/journal/, if persistent storage is
531 enabled. This call does not return until the operation is complete.
532 Note that this call is idempotent: the data is only flushed from
533 /run/log/journal/ into /var/log/journal once during system runtime
534 (but see --relinquish-var below), and this command exits cleanly
535 without executing any operation if this has already happened. This
536 command effectively guarantees that all data is flushed to
537 /var/log/journal at the time it returns.
538 --relinquish-var
540 Asks the journal daemon for the reverse operation to --flush: if
541 requested the daemon will write further log data to
542 /run/log/journal/ and stops writing to /var/log/journal/. A
543 subsequent call to --flush causes the log output to switch back to
544 /var/log/journal/, see above.
545 --smart-relinquish-var
547 Similar to --relinquish-var but executes no operation if the root
548 file system and /var/lib/journal/ reside on the same mount point.
549 This operation is used during system shutdown in order to make the
550 journal daemon stop writing data to /var/log/journal/ in case that
551 directory is located on a mount point that needs to be unmounted.
552 --rotate
554 Asks the journal daemon to rotate journal files. This call does not
555 return until the rotation operation is complete. Journal file
556 rotation has the effect that all currently active journal files are
557 marked as archived and renamed, so that they are never written to
558 in future. New (empty) journal files are then created in their
559 place. This operation may be combined with --vacuum-size=,
560 --vacuum-time= and --vacuum-file= into a single command, see above.
561 -h, --help
563 Print a short help text and exit.
564 --version
566 Print a short version string and exit.
567 --no-pager
569 Do not pipe output into a pager.
570
572 On success, 0 is returned; otherwise, a non-zero failure code is
573 returned.
574
576 $SYSTEMD_PAGER
577 Pager to use when --no-pager is not given; overrides $PAGER. If
578 neither $SYSTEMD_PAGER nor $PAGER are set, a set of well-known
579 pager implementations are tried in turn, including less(1) and
580 more(1), until one is found. If no pager implementation is
581 discovered no pager is invoked. Setting this environment variable
582 to an empty string or the value "cat" is equivalent to passing
583 --no-pager.
584 $SYSTEMD_LESS
586 Override the options passed to less (by default "FRSXMK").
587 Users might want to change two options in particular:
589 K
591 This option instructs the pager to exit immediately when Ctrl+C
592 is pressed. To allow less to handle Ctrl+C itself to switch
593 back to the pager command prompt, unset this option.
594 If the value of $SYSTEMD_LESS does not include "K", and the
596 pager that is invoked is less, Ctrl+C will be ignored by the
597 executable, and needs to be handled by the pager.
598 X
600 This option instructs the pager to not send termcap
601 initialization and deinitialization strings to the terminal. It
602 is set by default to allow command output to remain visible in
603 the terminal even after the pager exits. Nevertheless, this
604 prevents some pager functionality from working, in particular
605 paged output cannot be scrolled with the mouse.
606 See less(1) for more discussion.
608 $SYSTEMD_LESSCHARSET
610 Override the charset passed to less (by default "utf-8", if the
611 invoking terminal is determined to be UTF-8 compatible).
612 $SYSTEMD_COLORS
614 The value must be a boolean. Controls whether colorized output
615 should be generated. This can be specified to override the decision
616 that systemd makes based on $TERM and what the console is connected
617 to.
618 $SYSTEMD_URLIFY
620 The value must be a boolean. Controls whether clickable links
621 should be generated in the output for terminal emulators supporting
622 this. This can be specified to override the decision that systemd
623 makes based on $TERM and other conditions.
624
626 Without arguments, all collected logs are shown unfiltered:
627 journalctl
629 With one match specified, all entries with a field matching the
631 expression are shown:
632 journalctl _SYSTEMD_UNIT=avahi-daemon.service
634 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
635 If two different fields are matched, only entries matching both
637 expressions at the same time are shown:
638 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
640 If two matches refer to the same field, all entries matching either
642 expression are shown:
643 journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
645 If the separator "+" is used, two expressions may be combined in a
647 logical OR. The following will show all messages from the Avahi service
648 process with the PID 28097 plus all messages from the D-Bus service
649 (from any of its processes):
650 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
652 To show all fields emitted by a unit and about the unit, option
654 -u/--unit= should be used. journalctl -u name expands to a complex
655 filter similar to
656 _SYSTEMD_UNIT=name.service
658 + UNIT=name.service _PID=1
659 + OBJECT_SYSTEMD_UNIT=name.service _UID=0
660 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
661 (see systemd.journal-fields(5) for an explanation of those patterns).
664 Show all logs generated by the D-Bus executable:
666 journalctl /usr/bin/dbus-daemon
668 Show all kernel logs from previous boot:
670 journalctl -k -b -1
672 Show a live log display from a system service apache.service:
674 journalctl -f -u apache
676
678 systemd(1), systemd-journald.service(8), systemctl(1), coredumpctl(1),
679 systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd-
680 journal-remote.service(8), systemd-journal-upload.service(8)
681
683 1. Journal Export Format
684 https://www.freedesktop.org/wiki/Software/systemd/export
685 2. Journal JSON Format
687 https://www.freedesktop.org/wiki/Software/systemd/json
688 3. Server-Sent Events
690 https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
691 4. JavaScript Object Notation (JSON) Text Sequences
693 https://tools.ietf.org/html/rfc7464
694 5. Message Catalog Developer Documentation
696 https://www.freedesktop.org/wiki/Software/systemd/catalog
697systemd 245 JOURNALCTL(1)