1JOURNALCTL(1) journalctl JOURNALCTL(1)
2
6 journalctl - Print log entries from the systemd journal
7
9 journalctl [OPTIONS...] [MATCHES...]
10
12 journalctl is used to print the log entries stored in the journal by
13 systemd-journald.service(8) and systemd-journal-remote.service(8).
14 If called without parameters, it will show the contents of the journal
16 accessible to the calling user, starting with the oldest entry
17 collected.
18 If one or more match arguments are passed, the output is filtered
20 accordingly. A match is in the format "FIELD=VALUE", e.g.
21 "_SYSTEMD_UNIT=httpd.service", referring to the components of a
22 structured journal entry. See systemd.journal-fields(7) for a list of
23 well-known fields. If multiple matches are specified matching different
24 fields, the log entries are filtered by both, i.e. the resulting output
25 will show only entries matching all the specified matches of this kind.
26 If two matches apply to the same field, then they are automatically
27 matched as alternatives, i.e. the resulting output will show entries
28 matching any of the specified matches for the same field. Finally, the
29 character "+" may appear as a separate word between other terms on the
30 command line. This causes all matches before and after to be combined
31 in a disjunction (i.e. logical OR).
32 It is also possible to filter the entries by specifying an absolute
34 file path as an argument. The file path may be a file or a symbolic
35 link and the file must exist at the time of the query. If a file path
36 refers to an executable binary, an "_EXE=" match for the canonicalized
37 binary path is added to the query. If a file path refers to an
38 executable script, a "_COMM=" match for the script name is added to the
39 query. If a file path refers to a device node, "_KERNEL_DEVICE="
40 matches for the kernel name of the device and for each of its ancestor
41 devices is added to the query. Symbolic links are dereferenced, kernel
42 names are synthesized, and parent devices are identified from the
43 environment at the time of the query. In general, a device node is the
44 best proxy for an actual device, as log entries do not usually contain
45 fields that identify an actual device. For the resulting log entries to
46 be correct for the actual device, the relevant parts of the environment
47 at the time the entry was logged, in particular the actual device
48 corresponding to the device node, must have been the same as those at
49 the time of the query. Because device nodes generally change their
50 corresponding devices across reboots, specifying a device node path
51 causes the resulting entries to be restricted to those from the current
52 boot.
53 Additional constraints may be added using options --boot, --unit=,
55 etc., to further limit what entries will be shown (logical AND).
56 Output is interleaved from all accessible journal files, whether they
58 are rotated or currently being written, and regardless of whether they
59 belong to the system itself or are accessible user journals. The
60 --header option can be used to identify which files are being shown.
61 The set of journal files which will be used can be modified using the
63 --user, --system, --directory, and --file options, see below.
64 All users are granted access to their private per-user journals.
66 However, by default, only root and users who are members of a few
67 special groups are granted access to the system journal and the
68 journals of other users. Members of the groups "systemd-journal",
69 "adm", and "wheel" can read all journal files. Note that the two latter
70 groups traditionally have additional privileges specified by the
71 distribution. Members of the "wheel" group can often perform
72 administrative tasks.
73 The output is paged through less by default, and long lines are
75 "truncated" to screen width. The hidden part can be viewed by using the
76 left-arrow and right-arrow keys. Paging can be disabled; see the
77 --no-pager option and the "Environment" section below.
78 When outputting to a tty, lines are colored according to priority:
80 lines of level ERROR and higher are colored red; lines of level NOTICE
81 and higher are highlighted; lines of level DEBUG are colored lighter
82 grey; other lines are displayed normally.
83 To write entries to the journal, a few methods may be used. In general,
85 output from systemd units is automatically connected to the journal,
86 see systemd-journald.service(8). In addition, systemd-cat(1) may be
87 used to send messages to the journal directly.
88
90 The following options control where to read journal records from:
91 --system, --user
93 Show messages from system services and the kernel (with --system).
94 Show messages from service of current user (with --user). If
95 neither is specified, show all messages that the user can see.
96 The --user option affects how --unit arguments are treated. See
98 --unit.
99 -M, --machine=
101 Show messages from a running, local container. Specify a container
102 name to connect to.
103 -m, --merge
105 Show entries interleaved from all available journals, including
106 remote ones.
107 -D DIR, --directory=DIR
109 Takes a directory path as argument. If specified, journalctl will
110 operate on the specified journal directory DIR instead of the
111 default runtime and system journal paths.
112 --file=GLOB
114 Takes a file glob as an argument. If specified, journalctl will
115 operate on the specified journal files matching GLOB instead of the
116 default runtime and system journal paths. May be specified multiple
117 times, in which case files will be suitably interleaved.
118 --root=ROOT
120 Takes a directory path as an argument. If specified, journalctl
121 will operate on journal directories and catalog file hierarchy
122 underneath the specified directory instead of the root directory
123 (e.g. --update-catalog will create
124 ROOT/var/lib/systemd/catalog/database, and journal files under
125 ROOT/run/journal/ or ROOT/var/log/journal/ will be displayed).
126 --image=IMAGE
128 Takes a path to a disk image file or block device node. If
129 specified, journalctl will operate on the file system in the
130 indicated disk image. This option is similar to --root=, but
131 operates on file systems stored in disk images or block devices,
132 thus providing an easy way to extract log data from disk images.
133 The disk image should either contain just a file system or a set of
134 file systems within a GPT partition table, following the
135 Discoverable Partitions Specification[1]. For further information
136 on supported disk images, see systemd-nspawn(1)'s switch of the
137 same name.
138 --namespace=NAMESPACE
140 Takes a journal namespace identifier string as argument. If not
141 specified the data collected by the default namespace is shown. If
142 specified shows the log data of the specified namespace instead. If
143 the namespace is specified as "*" data from all namespaces is
144 shown, interleaved. If the namespace identifier is prefixed with
145 "+" data from the specified namespace and the default namespace is
146 shown, interleaved, but no other. For details about journal
147 namespaces see systemd-journald.service(8).
148
150 The following options control how to filter journal records:
151 -S, --since=, -U, --until=
153 Start showing entries on or newer than the specified date, or on or
154 older than the specified date, respectively. Date specifications
155 should be of the format "2012-10-30 18:17:16". If the time part is
156 omitted, "00:00:00" is assumed. If only the seconds component is
157 omitted, ":00" is assumed. If the date component is omitted, the
158 current day is assumed. Alternatively the strings "yesterday",
159 "today", "tomorrow" are understood, which refer to 00:00:00 of the
160 day before the current day, the current day, or the day after the
161 current day, respectively. "now" refers to the current time.
162 Finally, relative times may be specified, prefixed with "-" or "+",
163 referring to times before or after the current time, respectively.
164 For complete time and date specification, see systemd.time(7). Note
165 that --output=short-full prints timestamps that follow precisely
166 this format.
167 -c, --cursor=
169 Start showing entries from the location in the journal specified by
170 the passed cursor.
171 --after-cursor=
173 Start showing entries from the location in the journal after the
174 location specified by the passed cursor. The cursor is shown when
175 the --show-cursor option is used.
176 --cursor-file=FILE
178 If FILE exists and contains a cursor, start showing entries after
179 this location. Otherwise show entries according to the other given
180 options. At the end, write the cursor of the last entry to FILE.
181 Use this option to continually read the journal by sequentially
182 calling journalctl.
183 -b [[ID][±offset]|all], --boot[=[ID][±offset]|all]
185 Show messages from a specific boot. This will add a match for
186 "_BOOT_ID=".
187 The argument may be empty, in which case logs for the current boot
189 will be shown.
190 If the boot ID is omitted, a positive offset will look up the boots
192 starting from the beginning of the journal, and an
193 equal-or-less-than zero offset will look up boots starting from the
194 end of the journal. Thus, 1 means the first boot found in the
195 journal in chronological order, 2 the second and so on; while -0 is
196 the last boot, -1 the boot before last, and so on. An empty offset
197 is equivalent to specifying -0, except when the current boot is not
198 the last boot (e.g. because --directory was specified to look at
199 logs from a different machine).
200 If the 32-character ID is specified, it may optionally be followed
202 by offset which identifies the boot relative to the one given by
203 boot ID. Negative values mean earlier boots and positive values
204 mean later boots. If offset is not specified, a value of zero is
205 assumed, and the logs for the boot given by ID are shown.
206 The special argument all can be used to negate the effect of an
208 earlier use of -b.
209 -u, --unit=UNIT|PATTERN
211 Show messages for the specified systemd unit UNIT (such as a
212 service unit), or for any of the units matched by PATTERN. If a
213 pattern is specified, a list of unit names found in the journal is
214 compared with the specified pattern and all that match are used.
215 For each unit name, a match is added for messages from the unit
216 ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages
217 from systemd and messages about coredumps for the specified unit. A
218 match is also added for "_SYSTEMD_SLICE=UNIT", such that if the
219 provided UNIT is a systemd.slice(5) unit, all logs of children of
220 the slice will be shown.
221 With --user, all --unit arguments will be converted to match user
223 messages as if specified with --user-unit.
224 This parameter can be specified multiple times.
226 --user-unit=
228 Show messages for the specified user session unit. This will add a
229 match for messages from the unit ("_SYSTEMD_USER_UNIT=" and
230 "_UID=") and additional matches for messages from session systemd
231 and messages about coredumps for the specified unit. A match is
232 also added for "_SYSTEMD_USER_SLICE=UNIT", such that if the
233 provided UNIT is a systemd.slice(5) unit, all logs of children of
234 the unit will be shown.
235 This parameter can be specified multiple times.
237 -t, --identifier=SYSLOG_IDENTIFIER
239 Show messages for the specified syslog identifier
240 SYSLOG_IDENTIFIER.
241 This parameter can be specified multiple times.
243 -p, --priority=
245 Filter output by message priorities or priority ranges. Takes
246 either a single numeric or textual log level (i.e. between
247 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in
248 the form FROM..TO. The log levels are the usual syslog log levels
249 as documented in syslog(3), i.e. "emerg" (0), "alert" (1),
250 "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6),
251 "debug" (7). If a single log level is specified, all messages with
252 this log level or a lower (hence more important) log level are
253 shown. If a range is specified, all messages within the range are
254 shown, including both the start and the end value of the range.
255 This will add "PRIORITY=" matches for the specified priorities.
256 --facility=
258 Filter output by syslog facility. Takes a comma-separated list of
259 numbers or facility names. The names are the usual syslog
260 facilities as documented in syslog(3). --facility=help may be used
261 to display a list of known facility names and exit.
262 -g, --grep=
264 Filter output to entries where the MESSAGE= field matches the
265 specified regular expression. PERL-compatible regular expressions
266 are used, see pcre2pattern(3) for a detailed description of the
267 syntax.
268 If the pattern is all lowercase, matching is case insensitive.
270 Otherwise, matching is case sensitive. This can be overridden with
271 the --case-sensitive option, see below.
272 When used with --lines=, --reverse is implied.
274 --case-sensitive[=BOOLEAN]
276 Make pattern matching case sensitive or case insensitive.
277 -k, --dmesg
279 Show only kernel messages. This implies -b and adds the match
280 "_TRANSPORT=kernel".
281
283 The following options control how journal records are printed:
284 -o, --output=
286 Controls the formatting of the journal entries that are shown.
287 Takes one of the following options:
288 short
290 is the default and generates an output that is mostly identical
291 to the formatting of classic syslog files, showing one line per
292 journal entry.
293 short-full
295 is very similar, but shows timestamps in the format the
296 --since= and --until= options accept. Unlike the timestamp
297 information shown in short output mode this mode includes
298 weekday, year and timezone information in the output, and is
299 locale-independent.
300 short-iso
302 is very similar, but shows ISO 8601 wallclock timestamps.
303 short-iso-precise
305 as for short-iso but includes full microsecond precision.
306 short-precise
308 is very similar, but shows classic syslog timestamps with full
309 microsecond precision.
310 short-monotonic
312 is very similar, but shows monotonic timestamps instead of
313 wallclock timestamps.
314 short-delta
316 as for short-monotonic but includes the time difference to the
317 previous entry. Maybe unreliable time differences are marked by
318 a "*".
319 short-unix
321 is very similar, but shows seconds passed since January 1st
322 1970 UTC instead of wallclock timestamps ("UNIX time"). The
323 time is shown with microsecond accuracy.
324 verbose
326 shows the full-structured entry items with all fields.
327 export
329 serializes the journal into a binary (but mostly text-based)
330 stream suitable for backups and network transfer (see Journal
331 Export Format[2] for more information). To import the binary
332 stream back into native journald format use systemd-journal-
333 remote(8).
334 json
336 formats entries as JSON objects, separated by newline
337 characters (see Journal JSON Format[3] for more information).
338 Field values are generally encoded as JSON strings, with three
339 exceptions:
340 1. Fields larger than 4096 bytes are encoded as null values.
342 (This may be turned off by passing --all, but be aware that
343 this may allocate overly long JSON objects.)
344 2. Journal entries permit non-unique fields within the same
346 log entry. JSON does not allow non-unique fields within
347 objects. Due to this, if a non-unique field is encountered
348 a JSON array is used as field value, listing all field
349 values as elements.
350 3. Fields containing non-printable or non-UTF8 bytes are
352 encoded as arrays containing the raw bytes individually
353 formatted as unsigned numbers.
354 Note that this encoding is reversible (with the exception of
356 the size limit).
357 json-pretty
359 formats entries as JSON data structures, but formats them in
360 multiple lines in order to make them more readable by humans.
361 json-sse
363 formats entries as JSON data structures, but wraps them in a
364 format suitable for Server-Sent Events[4].
365 json-seq
367 formats entries as JSON data structures, but prefixes them with
368 an ASCII Record Separator character (0x1E) and suffixes them
369 with an ASCII Line Feed character (0x0A), in accordance with
370 JavaScript Object Notation (JSON) Text Sequences[5]
371 ("application/json-seq").
372 cat
374 generates a very terse output, only showing the actual message
375 of each journal entry with no metadata, not even a timestamp.
376 If combined with the --output-fields= option will output the
377 listed fields for each log record, instead of the message.
378 with-unit
380 similar to short-full, but prefixes the unit and user unit
381 names instead of the traditional syslog identifier. Useful when
382 using templated instances, as it will include the arguments in
383 the unit names.
384 --output-fields=
386 A comma separated list of the fields which should be included in
387 the output. This has an effect only for the output modes which
388 would normally show all fields (verbose, export, json, json-pretty,
389 json-sse and json-seq), as well as on cat. For the former, the
390 "__CURSOR", "__REALTIME_TIMESTAMP", "__MONOTONIC_TIMESTAMP", and
391 "_BOOT_ID" fields are always printed.
392 -n, --lines=
394 Show the most recent journal events and limit the number of events
395 shown. If --follow is used, this option is implied. The argument is
396 a positive integer or "all" to disable line limiting. The default
397 value is 10 if no argument is given.
398 When used with --grep=, --reverse is implied.
400 -r, --reverse
402 Reverse output so that the newest entries are displayed first.
403 --show-cursor
405 The cursor is shown after the last entry after two dashes:
406 -- cursor: s=0639...
408 The format of the cursor is private and subject to change.
410 --utc
412 Express time in Coordinated Universal Time (UTC).
413 -x, --catalog
415 Augment log lines with explanation texts from the message catalog.
416 This will add explanatory help texts to log messages in the output
417 where this is available. These short help texts will explain the
418 context of an error or log event, possible solutions, as well as
419 pointers to support forums, developer documentation, and any other
420 relevant manuals. Note that help texts are not available for all
421 messages, but only for selected ones. For more information on the
422 message catalog, please refer to the Message Catalog Developer
423 Documentation[6].
424 Note: when attaching journalctl output to bug reports, please do
426 not use -x.
427 --no-hostname
429 Don't show the hostname field of log messages originating from the
430 local host. This switch has an effect only on the short family of
431 output modes (see above).
432 Note: this option does not remove occurrences of the hostname from
434 log entries themselves, so it does not prevent the hostname from
435 being visible in the logs.
436 --no-full, --full, -l
438 Ellipsize fields when they do not fit in available columns. The
439 default is to show full fields, allowing them to wrap or be
440 truncated by the pager, if one is used.
441 The old options -l/--full are not useful anymore, except to undo
443 --no-full.
444 -a, --all
446 Show all fields in full, even if they include unprintable
447 characters or are very long. By default, fields with unprintable
448 characters are abbreviated as "blob data". (Note that the pager may
449 escape unprintable characters again.)
450 -f, --follow
452 Show only the most recent journal entries, and continuously print
453 new entries as they are appended to the journal.
454 --no-tail
456 Show all stored output lines, even in follow mode. Undoes the
457 effect of --lines=.
458 -q, --quiet
460 Suppresses all informational messages (i.e. "-- Journal begins at
461 ...", "-- Reboot --"), any warning messages regarding inaccessible
462 system journals when run as a normal user.
463
465 The following options control page support:
466 --no-pager
468 Do not pipe output into a pager.
469 -e, --pager-end
471 Immediately jump to the end of the journal inside the implied pager
472 tool. This implies -n1000 to guarantee that the pager will not
473 buffer logs of unbounded size. This may be overridden with an
474 explicit -n with some other numeric value, while -nall will disable
475 this cap. Note that this option is only supported for the less(1)
476 pager.
477
479 The following options may be used together with the --setup-keys
480 command described below:
481 --interval=
483 Specifies the change interval for the sealing key when generating
484 an FSS key pair with --setup-keys. Shorter intervals increase CPU
485 consumption but shorten the time range of undetectable journal
486 alterations. Defaults to 15min.
487 --verify-key=
489 Specifies the FSS verification key to use for the --verify
490 operation.
491 --force
493 When --setup-keys is passed and Forward Secure Sealing (FSS) has
494 already been configured, recreate FSS keys.
495
497 The following commands are understood. If none is specified the default
498 is to display journal records.
499 -N, --fields
501 Print all field names currently used in all entries of the journal.
502 -F, --field=
504 Print all possible data values the specified field can take in all
505 entries of the journal.
506 --list-boots
508 Show a tabular list of boot numbers (relative to the current boot),
509 their IDs, and the timestamps of the first and last message
510 pertaining to the boot.
511 --disk-usage
513 Shows the current disk usage of all journal files. This shows the
514 sum of the disk usage of all archived and active journal files.
515 --vacuum-size=, --vacuum-time=, --vacuum-files=
517 --vacuum-size= removes the oldest archived journal files until the
518 disk space they use falls below the specified size. Accepts the
519 usual "K", "M", "G" and "T" suffixes (to the base of 1024).
520 --vacuum-time= removes archived journal files older than the
522 specified timespan. Accepts the usual "s" (default), "m", "h",
523 "days", "months", "weeks" and "years" suffixes, see systemd.time(7)
524 for details.
525 --vacuum-files= leaves only the specified number of separate
527 journal files.
528 Note that running --vacuum-size= has only an indirect effect on the
530 output shown by --disk-usage, as the latter includes active journal
531 files, while the vacuuming operation only operates on archived
532 journal files. Similarly, --vacuum-files= might not actually reduce
533 the number of journal files to below the specified number, as it
534 will not remove active journal files.
535 --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
537 in a single invocation to enforce any combination of a size, a time
538 and a number of files limit on the archived journal files.
539 Specifying any of these three parameters as zero is equivalent to
540 not enforcing the specific limit, and is thus redundant.
541 These three switches may also be combined with --rotate into one
543 command. If so, all active files are rotated first, and the
544 requested vacuuming operation is executed right after. The rotation
545 has the effect that all currently active files are archived (and
546 potentially new, empty journal files opened as replacement), and
547 hence the vacuuming operation has the greatest effect as it can
548 take all log data written so far into account.
549 --verify
551 Check the journal file for internal consistency. If the file has
552 been generated with FSS enabled and the FSS verification key has
553 been specified with --verify-key=, authenticity of the journal file
554 is verified.
555 --sync
557 Asks the journal daemon to write all yet unwritten journal data to
558 the backing file system and synchronize all journals. This call
559 does not return until the synchronization operation is complete.
560 This command guarantees that any log messages written before its
561 invocation are safely stored on disk at the time it returns.
562 --relinquish-var
564 Asks the journal daemon for the reverse operation to --flush: if
565 requested the daemon will write further log data to
566 /run/log/journal/ and stops writing to /var/log/journal/. A
567 subsequent call to --flush causes the log output to switch back to
568 /var/log/journal/, see above.
569 --smart-relinquish-var
571 Similar to --relinquish-var, but executes no operation if the root
572 file system and /var/log/journal/ reside on the same mount point.
573 This operation is used during system shutdown in order to make the
574 journal daemon stop writing data to /var/log/journal/ in case that
575 directory is located on a mount point that needs to be unmounted.
576 --flush
578 Asks the journal daemon to flush any log data stored in
579 /run/log/journal/ into /var/log/journal/, if persistent storage is
580 enabled. This call does not return until the operation is complete.
581 Note that this call is idempotent: the data is only flushed from
582 /run/log/journal/ into /var/log/journal/ once during system runtime
583 (but see --relinquish-var below), and this command exits cleanly
584 without executing any operation if this has already happened. This
585 command effectively guarantees that all data is flushed to
586 /var/log/journal/ at the time it returns.
587 --rotate
589 Asks the journal daemon to rotate journal files. This call does not
590 return until the rotation operation is complete. Journal file
591 rotation has the effect that all currently active journal files are
592 marked as archived and renamed, so that they are never written to
593 in future. New (empty) journal files are then created in their
594 place. This operation may be combined with --vacuum-size=,
595 --vacuum-time= and --vacuum-file= into a single command, see above.
596 --header
598 Instead of showing journal contents, show internal header
599 information of the journal fields accessed.
600 This option is particularly useful when trying to identify
602 out-of-order journal entries, as happens for example when the
603 machine is booted with the wrong system time.
604 --list-catalog [128-bit-ID...]
606 List the contents of the message catalog as a table of message IDs,
607 plus their short description strings.
608 If any 128-bit-IDs are specified, only those entries are shown.
610 --dump-catalog [128-bit-ID...]
612 Show the contents of the message catalog, with entries separated by
613 a line consisting of two dashes and the ID (the format is the same
614 as .catalog files).
615 If any 128-bit-IDs are specified, only those entries are shown.
617 --update-catalog
619 Update the message catalog index. This command needs to be executed
620 each time new catalog files are installed, removed, or updated to
621 rebuild the binary catalog index.
622 --setup-keys
624 Instead of showing journal contents, generate a new key pair for
625 Forward Secure Sealing (FSS). This will generate a sealing key and
626 a verification key. The sealing key is stored in the journal data
627 directory and shall remain on the host. The verification key should
628 be stored externally. Refer to the Seal= option in journald.conf(5)
629 for information on Forward Secure Sealing and for a link to a
630 refereed scholarly paper detailing the cryptographic theory it is
631 based on.
632 -h, --help
634 Print a short help text and exit.
635 --version
637 Print a short version string and exit.
638
640 On success, 0 is returned; otherwise, a non-zero failure code is
641 returned.
642
644 $SYSTEMD_LOG_LEVEL
645 The maximum log level of emitted messages (messages with a higher
646 log level, i.e. less important ones, will be suppressed). Either
647 one of (in order of decreasing importance) emerg, alert, crit, err,
648 warning, notice, info, debug, or an integer in the range 0...7. See
649 syslog(3) for more information.
650 $SYSTEMD_LOG_COLOR
652 A boolean. If true, messages written to the tty will be colored
653 according to priority.
654 This setting is only useful when messages are written directly to
656 the terminal, because journalctl(1) and other tools that display
657 logs will color messages based on the log level on their own.
658 $SYSTEMD_LOG_TIME
660 A boolean. If true, console log messages will be prefixed with a
661 timestamp.
662 This setting is only useful when messages are written directly to
664 the terminal or a file, because journalctl(1) and other tools that
665 display logs will attach timestamps based on the entry metadata on
666 their own.
667 $SYSTEMD_LOG_LOCATION
669 A boolean. If true, messages will be prefixed with a filename and
670 line number in the source code where the message originates.
671 Note that the log location is often attached as metadata to journal
673 entries anyway. Including it directly in the message text can
674 nevertheless be convenient when debugging programs.
675 $SYSTEMD_LOG_TID
677 A boolean. If true, messages will be prefixed with the current
678 numerical thread ID (TID).
679 Note that the this information is attached as metadata to journal
681 entries anyway. Including it directly in the message text can
682 nevertheless be convenient when debugging programs.
683 $SYSTEMD_LOG_TARGET
685 The destination for log messages. One of console (log to the
686 attached tty), console-prefixed (log to the attached tty but with
687 prefixes encoding the log level and "facility", see syslog(3), kmsg
688 (log to the kernel circular log buffer), journal (log to the
689 journal), journal-or-kmsg (log to the journal if available, and to
690 kmsg otherwise), auto (determine the appropriate log target
691 automatically, the default), null (disable log output).
692 $SYSTEMD_PAGER
694 Pager to use when --no-pager is not given; overrides $PAGER. If
695 neither $SYSTEMD_PAGER nor $PAGER are set, a set of well-known
696 pager implementations are tried in turn, including less(1) and
697 more(1), until one is found. If no pager implementation is
698 discovered no pager is invoked. Setting this environment variable
699 to an empty string or the value "cat" is equivalent to passing
700 --no-pager.
701 Note: if $SYSTEMD_PAGERSECURE is not set, $SYSTEMD_PAGER (as well
703 as $PAGER) will be silently ignored.
704 $SYSTEMD_LESS
706 Override the options passed to less (by default "FRSXMK").
707 Users might want to change two options in particular:
709 K
711 This option instructs the pager to exit immediately when Ctrl+C
712 is pressed. To allow less to handle Ctrl+C itself to switch
713 back to the pager command prompt, unset this option.
714 If the value of $SYSTEMD_LESS does not include "K", and the
716 pager that is invoked is less, Ctrl+C will be ignored by the
717 executable, and needs to be handled by the pager.
718 X
720 This option instructs the pager to not send termcap
721 initialization and deinitialization strings to the terminal. It
722 is set by default to allow command output to remain visible in
723 the terminal even after the pager exits. Nevertheless, this
724 prevents some pager functionality from working, in particular
725 paged output cannot be scrolled with the mouse.
726 See less(1) for more discussion.
728 $SYSTEMD_LESSCHARSET
730 Override the charset passed to less (by default "utf-8", if the
731 invoking terminal is determined to be UTF-8 compatible).
732 $SYSTEMD_PAGERSECURE
734 Takes a boolean argument. When true, the "secure" mode of the pager
735 is enabled; if false, disabled. If $SYSTEMD_PAGERSECURE is not set
736 at all, secure mode is enabled if the effective UID is not the same
737 as the owner of the login session, see geteuid(2) and
738 sd_pid_get_owner_uid(3). In secure mode, LESSSECURE=1 will be set
739 when invoking the pager, and the pager shall disable commands that
740 open or create new files or start new subprocesses. When
741 $SYSTEMD_PAGERSECURE is not set at all, pagers which are not known
742 to implement secure mode will not be used. (Currently only less(1)
743 implements secure mode.)
744 Note: when commands are invoked with elevated privileges, for
746 example under sudo(8) or pkexec(1), care must be taken to ensure
747 that unintended interactive features are not enabled. "Secure" mode
748 for the pager may be enabled automatically as describe above.
749 Setting SYSTEMD_PAGERSECURE=0 or not removing it from the inherited
750 environment allows the user to invoke arbitrary commands. Note that
751 if the $SYSTEMD_PAGER or $PAGER variables are to be honoured,
752 $SYSTEMD_PAGERSECURE must be set too. It might be reasonable to
753 completely disable the pager using --no-pager instead.
754 $SYSTEMD_COLORS
756 Takes a boolean argument. When true, systemd and related utilities
757 will use colors in their output, otherwise the output will be
758 monochrome. Additionally, the variable can take one of the
759 following special values: "16", "256" to restrict the use of colors
760 to the base 16 or 256 ANSI colors, respectively. This can be
761 specified to override the automatic decision based on $TERM and
762 what the console is connected to.
763 $SYSTEMD_URLIFY
765 The value must be a boolean. Controls whether clickable links
766 should be generated in the output for terminal emulators supporting
767 this. This can be specified to override the decision that systemd
768 makes based on $TERM and other conditions.
769
771 Without arguments, all collected logs are shown unfiltered:
772 journalctl
774 With one match specified, all entries with a field matching the
776 expression are shown:
777 journalctl _SYSTEMD_UNIT=avahi-daemon.service
779 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
780 If two different fields are matched, only entries matching both
782 expressions at the same time are shown:
783 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
785 If two matches refer to the same field, all entries matching either
787 expression are shown:
788 journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
790 If the separator "+" is used, two expressions may be combined in a
792 logical OR. The following will show all messages from the Avahi service
793 process with the PID 28097 plus all messages from the D-Bus service
794 (from any of its processes):
795 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
797 To show all fields emitted by a unit and about the unit, option
799 -u/--unit= should be used. journalctl -u name expands to a complex
800 filter similar to
801 _SYSTEMD_UNIT=name.service
803 + UNIT=name.service _PID=1
804 + OBJECT_SYSTEMD_UNIT=name.service _UID=0
805 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
806 (see systemd.journal-fields(7) for an explanation of those patterns).
808 Show all logs generated by the D-Bus executable:
810 journalctl /usr/bin/dbus-daemon
812 Show all kernel logs from previous boot:
814 journalctl -k -b -1
816 Show a live log display from a system service apache.service:
818 journalctl -f -u apache
820
822 systemd(1), systemd-cat(1), systemd-journald.service(8), systemctl(1),
823 coredumpctl(1), systemd.journal-fields(7), journald.conf(5),
824 systemd.time(7), systemd-journal-remote.service(8), systemd-journal-
825 upload.service(8)
826
828 1. Discoverable Partitions Specification
829 https://uapi-group.org/specifications/specs/discoverable_partitions_specification
830 2. Journal Export Format
832 https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-export-format
833 3. Journal JSON Format
835 https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-json-format
836 4. Server-Sent Events
838 https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
839 5. JavaScript Object Notation (JSON) Text Sequences
841 https://tools.ietf.org/html/rfc7464
842 6. Message Catalog Developer Documentation
844 https://www.freedesktop.org/wiki/Software/systemd/catalog
845systemd 253 JOURNALCTL(1)