1JOURNALCTL(1) journalctl JOURNALCTL(1)
2
6 journalctl - Query the systemd journal
7
9 journalctl [OPTIONS...] [MATCHES...]
10
12 journalctl may be used to query the contents of the systemd(1) journal
13 as written by systemd-journald.service(8).
14 If called without parameters, it will show the full contents of the
16 journal, starting with the oldest entry collected.
17 If one or more match arguments are passed, the output is filtered
19 accordingly. A match is in the format "FIELD=VALUE", e.g.
20 "_SYSTEMD_UNIT=httpd.service", referring to the components of a
21 structured journal entry. See systemd.journal-fields(7) for a list of
22 well-known fields. If multiple matches are specified matching different
23 fields, the log entries are filtered by both, i.e. the resulting output
24 will show only entries matching all the specified matches of this kind.
25 If two matches apply to the same field, then they are automatically
26 matched as alternatives, i.e. the resulting output will show entries
27 matching any of the specified matches for the same field. Finally, the
28 character "+" may appear as a separate word between other terms on the
29 command line. This causes all matches before and after to be combined
30 in a disjunction (i.e. logical OR).
31 It is also possible to filter the entries by specifying an absolute
33 file path as an argument. The file path may be a file or a symbolic
34 link and the file must exist at the time of the query. If a file path
35 refers to an executable binary, an "_EXE=" match for the canonicalized
36 binary path is added to the query. If a file path refers to an
37 executable script, a "_COMM=" match for the script name is added to the
38 query. If a file path refers to a device node, "_KERNEL_DEVICE="
39 matches for the kernel name of the device and for each of its ancestor
40 devices is added to the query. Symbolic links are dereferenced, kernel
41 names are synthesized, and parent devices are identified from the
42 environment at the time of the query. In general, a device node is the
43 best proxy for an actual device, as log entries do not usually contain
44 fields that identify an actual device. For the resulting log entries to
45 be correct for the actual device, the relevant parts of the environment
46 at the time the entry was logged, in particular the actual device
47 corresponding to the device node, must have been the same as those at
48 the time of the query. Because device nodes generally change their
49 corresponding devices across reboots, specifying a device node path
50 causes the resulting entries to be restricted to those from the current
51 boot.
52 Additional constraints may be added using options --boot, --unit=,
54 etc., to further limit what entries will be shown (logical AND).
55 Output is interleaved from all accessible journal files, whether they
57 are rotated or currently being written, and regardless of whether they
58 belong to the system itself or are accessible user journals. The
59 --header option can be used to identify which files are being shown.
60 The set of journal files which will be used can be modified using the
62 --user, --system, --directory, and --file options, see below.
63 All users are granted access to their private per-user journals.
65 However, by default, only root and users who are members of a few
66 special groups are granted access to the system journal and the
67 journals of other users. Members of the groups "systemd-journal",
68 "adm", and "wheel" can read all journal files. Note that the two latter
69 groups traditionally have additional privileges specified by the
70 distribution. Members of the "wheel" group can often perform
71 administrative tasks.
72 The output is paged through less by default, and long lines are
74 "truncated" to screen width. The hidden part can be viewed by using the
75 left-arrow and right-arrow keys. Paging can be disabled; see the
76 --no-pager option and the "Environment" section below.
77 When outputting to a tty, lines are colored according to priority:
79 lines of level ERROR and higher are colored red; lines of level NOTICE
80 and higher are highlighted; lines of level DEBUG are colored lighter
81 grey; other lines are displayed normally.
82
84 The following options are understood:
85 --no-full, --full, -l
87 Ellipsize fields when they do not fit in available columns. The
88 default is to show full fields, allowing them to wrap or be
89 truncated by the pager, if one is used.
90 The old options -l/--full are not useful anymore, except to undo
92 --no-full.
93 -a, --all
95 Show all fields in full, even if they include unprintable
96 characters or are very long. By default, fields with unprintable
97 characters are abbreviated as "blob data". (Note that the pager may
98 escape unprintable characters again.)
99 -f, --follow
101 Show only the most recent journal entries, and continuously print
102 new entries as they are appended to the journal.
103 -e, --pager-end
105 Immediately jump to the end of the journal inside the implied pager
106 tool. This implies -n1000 to guarantee that the pager will not
107 buffer logs of unbounded size. This may be overridden with an
108 explicit -n with some other numeric value, while -nall will disable
109 this cap. Note that this option is only supported for the less(1)
110 pager.
111 -n, --lines=
113 Show the most recent journal events and limit the number of events
114 shown. If --follow is used, this option is implied. The argument is
115 a positive integer or "all" to disable line limiting. The default
116 value is 10 if no argument is given.
117 --no-tail
119 Show all stored output lines, even in follow mode. Undoes the
120 effect of --lines=.
121 -r, --reverse
123 Reverse output so that the newest entries are displayed first.
124 -o, --output=
126 Controls the formatting of the journal entries that are shown.
127 Takes one of the following options:
128 short
130 is the default and generates an output that is mostly identical
131 to the formatting of classic syslog files, showing one line per
132 journal entry.
133 short-full
135 is very similar, but shows timestamps in the format the
136 --since= and --until= options accept. Unlike the timestamp
137 information shown in short output mode this mode includes
138 weekday, year and timezone information in the output, and is
139 locale-independent.
140 short-iso
142 is very similar, but shows ISO 8601 wallclock timestamps.
143 short-iso-precise
145 as for short-iso but includes full microsecond precision.
146 short-precise
148 is very similar, but shows classic syslog timestamps with full
149 microsecond precision.
150 short-monotonic
152 is very similar, but shows monotonic timestamps instead of
153 wallclock timestamps.
154 short-unix
156 is very similar, but shows seconds passed since January 1st
157 1970 UTC instead of wallclock timestamps ("UNIX time"). The
158 time is shown with microsecond accuracy.
159 verbose
161 shows the full-structured entry items with all fields.
162 export
164 serializes the journal into a binary (but mostly text-based)
165 stream suitable for backups and network transfer (see Journal
166 Export Format[1] for more information). To import the binary
167 stream back into native journald format use systemd-journal-
168 remote(8).
169 json
171 formats entries as JSON objects, separated by newline
172 characters (see Journal JSON Format[2] for more information).
173 Field values are generally encoded as JSON strings, with three
174 exceptions:
175 1. Fields larger than 4096 bytes are encoded as null values.
177 (This may be turned off by passing --all, but be aware that
178 this may allocate overly long JSON objects.)
179 2. Journal entries permit non-unique fields within the same
181 log entry. JSON does not allow non-unique fields within
182 objects. Due to this, if a non-unique field is encountered
183 a JSON array is used as field value, listing all field
184 values as elements.
185 3. Fields containing non-printable or non-UTF8 bytes are
187 encoded as arrays containing the raw bytes individually
188 formatted as unsigned numbers.
189 Note that this encoding is reversible (with the exception of
191 the size limit).
192 json-pretty
194 formats entries as JSON data structures, but formats them in
195 multiple lines in order to make them more readable by humans.
196 json-sse
198 formats entries as JSON data structures, but wraps them in a
199 format suitable for Server-Sent Events[3].
200 json-seq
202 formats entries as JSON data structures, but prefixes them with
203 an ASCII Record Separator character (0x1E) and suffixes them
204 with an ASCII Line Feed character (0x0A), in accordance with
205 JavaScript Object Notation (JSON) Text Sequences[4]
206 ("application/json-seq").
207 cat
209 generates a very terse output, only showing the actual message
210 of each journal entry with no metadata, not even a timestamp.
211 If combined with the --output-fields= option will output the
212 listed fields for each log record, instead of the message.
213 with-unit
215 similar to short-full, but prefixes the unit and user unit
216 names instead of the traditional syslog identifier. Useful when
217 using templated instances, as it will include the arguments in
218 the unit names.
219 --output-fields=
221 A comma separated list of the fields which should be included in
222 the output. This has an effect only for the output modes which
223 would normally show all fields (verbose, export, json, json-pretty,
224 json-sse and json-seq), as well as on cat. For the former, the
225 "__CURSOR", "__REALTIME_TIMESTAMP", "__MONOTONIC_TIMESTAMP", and
226 "_BOOT_ID" fields are always printed.
227 --utc
229 Express time in Coordinated Universal Time (UTC).
230 --no-hostname
232 Don't show the hostname field of log messages originating from the
233 local host. This switch has an effect only on the short family of
234 output modes (see above).
235 Note: this option does not remove occurrences of the hostname from
237 log entries themselves, so it does not prevent the hostname from
238 being visible in the logs.
239 -x, --catalog
241 Augment log lines with explanation texts from the message catalog.
242 This will add explanatory help texts to log messages in the output
243 where this is available. These short help texts will explain the
244 context of an error or log event, possible solutions, as well as
245 pointers to support forums, developer documentation, and any other
246 relevant manuals. Note that help texts are not available for all
247 messages, but only for selected ones. For more information on the
248 message catalog, please refer to the Message Catalog Developer
249 Documentation[5].
250 Note: when attaching journalctl output to bug reports, please do
252 not use -x.
253 -q, --quiet
255 Suppresses all informational messages (i.e. "-- Journal begins at
256 ...", "-- Reboot --"), any warning messages regarding inaccessible
257 system journals when run as a normal user.
258 -m, --merge
260 Show entries interleaved from all available journals, including
261 remote ones.
262 -b [[ID][±offset]|all], --boot[=[ID][±offset]|all]
264 Show messages from a specific boot. This will add a match for
265 "_BOOT_ID=".
266 The argument may be empty, in which case logs for the current boot
268 will be shown.
269 If the boot ID is omitted, a positive offset will look up the boots
271 starting from the beginning of the journal, and an
272 equal-or-less-than zero offset will look up boots starting from the
273 end of the journal. Thus, 1 means the first boot found in the
274 journal in chronological order, 2 the second and so on; while -0 is
275 the last boot, -1 the boot before last, and so on. An empty offset
276 is equivalent to specifying -0, except when the current boot is not
277 the last boot (e.g. because --directory was specified to look at
278 logs from a different machine).
279 If the 32-character ID is specified, it may optionally be followed
281 by offset which identifies the boot relative to the one given by
282 boot ID. Negative values mean earlier boots and positive values
283 mean later boots. If offset is not specified, a value of zero is
284 assumed, and the logs for the boot given by ID are shown.
285 The special argument all can be used to negate the effect of an
287 earlier use of -b.
288 --list-boots
290 Show a tabular list of boot numbers (relative to the current boot),
291 their IDs, and the timestamps of the first and last message
292 pertaining to the boot.
293 -k, --dmesg
295 Show only kernel messages. This implies -b and adds the match
296 "_TRANSPORT=kernel".
297 -t, --identifier=SYSLOG_IDENTIFIER
299 Show messages for the specified syslog identifier
300 SYSLOG_IDENTIFIER.
301 This parameter can be specified multiple times.
303 -u, --unit=UNIT|PATTERN
305 Show messages for the specified systemd unit UNIT (such as a
306 service unit), or for any of the units matched by PATTERN. If a
307 pattern is specified, a list of unit names found in the journal is
308 compared with the specified pattern and all that match are used.
309 For each unit name, a match is added for messages from the unit
310 ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages
311 from systemd and messages about coredumps for the specified unit. A
312 match is also added for "_SYSTEMD_SLICE=UNIT", such that if the
313 provided UNIT is a systemd.slice(5) unit, all logs of children of
314 the slice will be shown.
315 This parameter can be specified multiple times.
317 --user-unit=
319 Show messages for the specified user session unit. This will add a
320 match for messages from the unit ("_SYSTEMD_USER_UNIT=" and
321 "_UID=") and additional matches for messages from session systemd
322 and messages about coredumps for the specified unit. A match is
323 also added for "_SYSTEMD_USER_SLICE=UNIT", such that if the
324 provided UNIT is a systemd.slice(5) unit, all logs of children of
325 the unit will be shown.
326 This parameter can be specified multiple times.
328 -p, --priority=
330 Filter output by message priorities or priority ranges. Takes
331 either a single numeric or textual log level (i.e. between
332 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in
333 the form FROM..TO. The log levels are the usual syslog log levels
334 as documented in syslog(3), i.e. "emerg" (0), "alert" (1),
335 "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6),
336 "debug" (7). If a single log level is specified, all messages with
337 this log level or a lower (hence more important) log level are
338 shown. If a range is specified, all messages within the range are
339 shown, including both the start and the end value of the range.
340 This will add "PRIORITY=" matches for the specified priorities.
341 --facility=
343 Filter output by syslog facility. Takes a comma-separated list of
344 numbers or facility names. The names are the usual syslog
345 facilities as documented in syslog(3). --facility=help may be used
346 to display a list of known facility names and exit.
347 -g, --grep=
349 Filter output to entries where the MESSAGE= field matches the
350 specified regular expression. PERL-compatible regular expressions
351 are used, see pcre2pattern(3) for a detailed description of the
352 syntax.
353 If the pattern is all lowercase, matching is case insensitive.
355 Otherwise, matching is case sensitive. This can be overridden with
356 the --case-sensitive option, see below.
357 --case-sensitive[=BOOLEAN]
359 Make pattern matching case sensitive or case insensitive.
360 -c, --cursor=
362 Start showing entries from the location in the journal specified by
363 the passed cursor.
364 --cursor-file=FILE
366 If FILE exists and contains a cursor, start showing entries after
367 this location. Otherwise show entries according to the other given
368 options. At the end, write the cursor of the last entry to FILE.
369 Use this option to continually read the journal by sequentially
370 calling journalctl.
371 --after-cursor=
373 Start showing entries from the location in the journal after the
374 location specified by the passed cursor. The cursor is shown when
375 the --show-cursor option is used.
376 --show-cursor
378 The cursor is shown after the last entry after two dashes:
379 -- cursor: s=0639...
381 The format of the cursor is private and subject to change.
383 -S, --since=, -U, --until=
385 Start showing entries on or newer than the specified date, or on or
386 older than the specified date, respectively. Date specifications
387 should be of the format "2012-10-30 18:17:16". If the time part is
388 omitted, "00:00:00" is assumed. If only the seconds component is
389 omitted, ":00" is assumed. If the date component is omitted, the
390 current day is assumed. Alternatively the strings "yesterday",
391 "today", "tomorrow" are understood, which refer to 00:00:00 of the
392 day before the current day, the current day, or the day after the
393 current day, respectively. "now" refers to the current time.
394 Finally, relative times may be specified, prefixed with "-" or "+",
395 referring to times before or after the current time, respectively.
396 For complete time and date specification, see systemd.time(7). Note
397 that --output=short-full prints timestamps that follow precisely
398 this format.
399 -F, --field=
401 Print all possible data values the specified field can take in all
402 entries of the journal.
403 -N, --fields
405 Print all field names currently used in all entries of the journal.
406 --system, --user
408 Show messages from system services and the kernel (with --system).
409 Show messages from service of current user (with --user). If
410 neither is specified, show all messages that the user can see.
411 -M, --machine=
413 Show messages from a running, local container. Specify a container
414 name to connect to.
415 -D DIR, --directory=DIR
417 Takes a directory path as argument. If specified, journalctl will
418 operate on the specified journal directory DIR instead of the
419 default runtime and system journal paths.
420 --file=GLOB
422 Takes a file glob as an argument. If specified, journalctl will
423 operate on the specified journal files matching GLOB instead of the
424 default runtime and system journal paths. May be specified multiple
425 times, in which case files will be suitably interleaved.
426 --root=ROOT
428 Takes a directory path as an argument. If specified, journalctl
429 will operate on journal directories and catalog file hierarchy
430 underneath the specified directory instead of the root directory
431 (e.g. --update-catalog will create
432 ROOT/var/lib/systemd/catalog/database, and journal files under
433 ROOT/run/journal/ or ROOT/var/log/journal/ will be displayed).
434 --image=IMAGE
436 Takes a path to a disk image file or block device node. If
437 specified, journalctl will operate on the file system in the
438 indicated disk image. This is similar to --root= but operates on
439 file systems stored in disk images or block devices, thus providing
440 an easy way to extract log data from disk images. The disk image
441 should either contain just a file system or a set of file systems
442 within a GPT partition table, following the Discoverable Partitions
443 Specification[6]. For further information on supported disk images,
444 see systemd-nspawn(1)'s switch of the same name.
445 --namespace=NAMESPACE
447 Takes a journal namespace identifier string as argument. If not
448 specified the data collected by the default namespace is shown. If
449 specified shows the log data of the specified namespace instead. If
450 the namespace is specified as "*" data from all namespaces is
451 shown, interleaved. If the namespace identifier is prefixed with
452 "+" data from the specified namespace and the default namespace is
453 shown, interleaved, but no other. For details about journal
454 namespaces see systemd-journald.service(8).
455 --header
457 Instead of showing journal contents, show internal header
458 information of the journal fields accessed.
459 This option is particularly useful when trying to identify
461 out-of-order journal entries, as happens for example when the
462 machine is booted with the wrong system time.
463 --disk-usage
465 Shows the current disk usage of all journal files. This shows the
466 sum of the disk usage of all archived and active journal files.
467 --vacuum-size=, --vacuum-time=, --vacuum-files=
469 Removes the oldest archived journal files until the disk space they
470 use falls below the specified size (specified with the usual "K",
471 "M", "G" and "T" suffixes), or all archived journal files contain
472 no data older than the specified timespan (specified with the usual
473 "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or
474 no more than the specified number of separate journal files remain.
475 Note that running --vacuum-size= has only an indirect effect on the
476 output shown by --disk-usage, as the latter includes active journal
477 files, while the vacuuming operation only operates on archived
478 journal files. Similarly, --vacuum-files= might not actually reduce
479 the number of journal files to below the specified number, as it
480 will not remove active journal files.
481 --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
483 in a single invocation to enforce any combination of a size, a time
484 and a number of files limit on the archived journal files.
485 Specifying any of these three parameters as zero is equivalent to
486 not enforcing the specific limit, and is thus redundant.
487 These three switches may also be combined with --rotate into one
489 command. If so, all active files are rotated first, and the
490 requested vacuuming operation is executed right after. The rotation
491 has the effect that all currently active files are archived (and
492 potentially new, empty journal files opened as replacement), and
493 hence the vacuuming operation has the greatest effect as it can
494 take all log data written so far into account.
495 --list-catalog [128-bit-ID...]
497 List the contents of the message catalog as a table of message IDs,
498 plus their short description strings.
499 If any 128-bit-IDs are specified, only those entries are shown.
501 --dump-catalog [128-bit-ID...]
503 Show the contents of the message catalog, with entries separated by
504 a line consisting of two dashes and the ID (the format is the same
505 as .catalog files).
506 If any 128-bit-IDs are specified, only those entries are shown.
508 --update-catalog
510 Update the message catalog index. This command needs to be executed
511 each time new catalog files are installed, removed, or updated to
512 rebuild the binary catalog index.
513 --setup-keys
515 Instead of showing journal contents, generate a new key pair for
516 Forward Secure Sealing (FSS). This will generate a sealing key and
517 a verification key. The sealing key is stored in the journal data
518 directory and shall remain on the host. The verification key should
519 be stored externally. Refer to the Seal= option in journald.conf(5)
520 for information on Forward Secure Sealing and for a link to a
521 refereed scholarly paper detailing the cryptographic theory it is
522 based on.
523 --force
525 When --setup-keys is passed and Forward Secure Sealing (FSS) has
526 already been configured, recreate FSS keys.
527 --interval=
529 Specifies the change interval for the sealing key when generating
530 an FSS key pair with --setup-keys. Shorter intervals increase CPU
531 consumption but shorten the time range of undetectable journal
532 alterations. Defaults to 15min.
533 --verify
535 Check the journal file for internal consistency. If the file has
536 been generated with FSS enabled and the FSS verification key has
537 been specified with --verify-key=, authenticity of the journal file
538 is verified.
539 --verify-key=
541 Specifies the FSS verification key to use for the --verify
542 operation.
543 --sync
545 Asks the journal daemon to write all yet unwritten journal data to
546 the backing file system and synchronize all journals. This call
547 does not return until the synchronization operation is complete.
548 This command guarantees that any log messages written before its
549 invocation are safely stored on disk at the time it returns.
550 --flush
552 Asks the journal daemon to flush any log data stored in
553 /run/log/journal/ into /var/log/journal/, if persistent storage is
554 enabled. This call does not return until the operation is complete.
555 Note that this call is idempotent: the data is only flushed from
556 /run/log/journal/ into /var/log/journal/ once during system runtime
557 (but see --relinquish-var below), and this command exits cleanly
558 without executing any operation if this has already happened. This
559 command effectively guarantees that all data is flushed to
560 /var/log/journal/ at the time it returns.
561 --relinquish-var
563 Asks the journal daemon for the reverse operation to --flush: if
564 requested the daemon will write further log data to
565 /run/log/journal/ and stops writing to /var/log/journal/. A
566 subsequent call to --flush causes the log output to switch back to
567 /var/log/journal/, see above.
568 --smart-relinquish-var
570 Similar to --relinquish-var but executes no operation if the root
571 file system and /var/lib/journal/ reside on the same mount point.
572 This operation is used during system shutdown in order to make the
573 journal daemon stop writing data to /var/log/journal/ in case that
574 directory is located on a mount point that needs to be unmounted.
575 --rotate
577 Asks the journal daemon to rotate journal files. This call does not
578 return until the rotation operation is complete. Journal file
579 rotation has the effect that all currently active journal files are
580 marked as archived and renamed, so that they are never written to
581 in future. New (empty) journal files are then created in their
582 place. This operation may be combined with --vacuum-size=,
583 --vacuum-time= and --vacuum-file= into a single command, see above.
584 -h, --help
586 Print a short help text and exit.
587 --version
589 Print a short version string and exit.
590 --no-pager
592 Do not pipe output into a pager.
593
595 On success, 0 is returned; otherwise, a non-zero failure code is
596 returned.
597
599 $SYSTEMD_LOG_LEVEL
600 The maximum log level of emitted messages (messages with a higher
601 log level, i.e. less important ones, will be suppressed). Either
602 one of (in order of decreasing importance) emerg, alert, crit, err,
603 warning, notice, info, debug, or an integer in the range 0...7. See
604 syslog(3) for more information.
605 $SYSTEMD_LOG_COLOR
607 A boolean. If true, messages written to the tty will be colored
608 according to priority.
609 This setting is only useful when messages are written directly to
611 the terminal, because journalctl(1) and other tools that display
612 logs will color messages based on the log level on their own.
613 $SYSTEMD_LOG_TIME
615 A boolean. If true, console log messages will be prefixed with a
616 timestamp.
617 This setting is only useful when messages are written directly to
619 the terminal or a file, because journalctl(1) and other tools that
620 display logs will attach timestamps based on the entry metadata on
621 their own.
622 $SYSTEMD_LOG_LOCATION
624 A boolean. If true, messages will be prefixed with a filename and
625 line number in the source code where the message originates.
626 Note that the log location is often attached as metadata to journal
628 entries anyway. Including it directly in the message text can
629 nevertheless be convenient when debugging programs.
630 $SYSTEMD_LOG_TID
632 A boolean. If true, messages will be prefixed with the current
633 numerical thread ID (TID).
634 Note that the this information is attached as metadata to journal
636 entries anyway. Including it directly in the message text can
637 nevertheless be convenient when debugging programs.
638 $SYSTEMD_LOG_TARGET
640 The destination for log messages. One of console (log to the
641 attached tty), console-prefixed (log to the attached tty but with
642 prefixes encoding the log level and "facility", see syslog(3), kmsg
643 (log to the kernel circular log buffer), journal (log to the
644 journal), journal-or-kmsg (log to the journal if available, and to
645 kmsg otherwise), auto (determine the appropriate log target
646 automatically, the default), null (disable log output).
647 $SYSTEMD_PAGER
649 Pager to use when --no-pager is not given; overrides $PAGER. If
650 neither $SYSTEMD_PAGER nor $PAGER are set, a set of well-known
651 pager implementations are tried in turn, including less(1) and
652 more(1), until one is found. If no pager implementation is
653 discovered no pager is invoked. Setting this environment variable
654 to an empty string or the value "cat" is equivalent to passing
655 --no-pager.
656 Note: if $SYSTEMD_PAGERSECURE is not set, $SYSTEMD_PAGER (as well
658 as $PAGER) will be silently ignored.
659 $SYSTEMD_LESS
661 Override the options passed to less (by default "FRSXMK").
662 Users might want to change two options in particular:
664 K
666 This option instructs the pager to exit immediately when Ctrl+C
667 is pressed. To allow less to handle Ctrl+C itself to switch
668 back to the pager command prompt, unset this option.
669 If the value of $SYSTEMD_LESS does not include "K", and the
671 pager that is invoked is less, Ctrl+C will be ignored by the
672 executable, and needs to be handled by the pager.
673 X
675 This option instructs the pager to not send termcap
676 initialization and deinitialization strings to the terminal. It
677 is set by default to allow command output to remain visible in
678 the terminal even after the pager exits. Nevertheless, this
679 prevents some pager functionality from working, in particular
680 paged output cannot be scrolled with the mouse.
681 See less(1) for more discussion.
683 $SYSTEMD_LESSCHARSET
685 Override the charset passed to less (by default "utf-8", if the
686 invoking terminal is determined to be UTF-8 compatible).
687 $SYSTEMD_PAGERSECURE
689 Takes a boolean argument. When true, the "secure" mode of the pager
690 is enabled; if false, disabled. If $SYSTEMD_PAGERSECURE is not set
691 at all, secure mode is enabled if the effective UID is not the same
692 as the owner of the login session, see geteuid(2) and
693 sd_pid_get_owner_uid(3). In secure mode, LESSSECURE=1 will be set
694 when invoking the pager, and the pager shall disable commands that
695 open or create new files or start new subprocesses. When
696 $SYSTEMD_PAGERSECURE is not set at all, pagers which are not known
697 to implement secure mode will not be used. (Currently only less(1)
698 implements secure mode.)
699 Note: when commands are invoked with elevated privileges, for
701 example under sudo(8) or pkexec(1), care must be taken to ensure
702 that unintended interactive features are not enabled. "Secure" mode
703 for the pager may be enabled automatically as describe above.
704 Setting SYSTEMD_PAGERSECURE=0 or not removing it from the inherited
705 environment allows the user to invoke arbitrary commands. Note that
706 if the $SYSTEMD_PAGER or $PAGER variables are to be honoured,
707 $SYSTEMD_PAGERSECURE must be set too. It might be reasonable to
708 completely disable the pager using --no-pager instead.
709 $SYSTEMD_COLORS
711 Takes a boolean argument. When true, systemd and related utilities
712 will use colors in their output, otherwise the output will be
713 monochrome. Additionally, the variable can take one of the
714 following special values: "16", "256" to restrict the use of colors
715 to the base 16 or 256 ANSI colors, respectively. This can be
716 specified to override the automatic decision based on $TERM and
717 what the console is connected to.
718 $SYSTEMD_URLIFY
720 The value must be a boolean. Controls whether clickable links
721 should be generated in the output for terminal emulators supporting
722 this. This can be specified to override the decision that systemd
723 makes based on $TERM and other conditions.
724
726 Without arguments, all collected logs are shown unfiltered:
727 journalctl
729 With one match specified, all entries with a field matching the
731 expression are shown:
732 journalctl _SYSTEMD_UNIT=avahi-daemon.service
734 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
735 If two different fields are matched, only entries matching both
737 expressions at the same time are shown:
738 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
740 If two matches refer to the same field, all entries matching either
742 expression are shown:
743 journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
745 If the separator "+" is used, two expressions may be combined in a
747 logical OR. The following will show all messages from the Avahi service
748 process with the PID 28097 plus all messages from the D-Bus service
749 (from any of its processes):
750 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
752 To show all fields emitted by a unit and about the unit, option
754 -u/--unit= should be used. journalctl -u name expands to a complex
755 filter similar to
756 _SYSTEMD_UNIT=name.service
758 + UNIT=name.service _PID=1
759 + OBJECT_SYSTEMD_UNIT=name.service _UID=0
760 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
761 (see systemd.journal-fields(7) for an explanation of those patterns).
764 Show all logs generated by the D-Bus executable:
766 journalctl /usr/bin/dbus-daemon
768 Show all kernel logs from previous boot:
770 journalctl -k -b -1
772 Show a live log display from a system service apache.service:
774 journalctl -f -u apache
776
778 systemd(1), systemd-journald.service(8), systemctl(1), coredumpctl(1),
779 systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd-
780 journal-remote.service(8), systemd-journal-upload.service(8)
781
783 1. Journal Export Format
784 https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-export-format
785 2. Journal JSON Format
787 https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-json-format
788 3. Server-Sent Events
790 https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
791 4. JavaScript Object Notation (JSON) Text Sequences
793 https://tools.ietf.org/html/rfc7464
794 5. Message Catalog Developer Documentation
796 https://www.freedesktop.org/wiki/Software/systemd/catalog
797 6. Discoverable Partitions Specification
799 https://systemd.io/DISCOVERABLE_PARTITIONS
800systemd 251 JOURNALCTL(1)