1JOURNALCTL(1) journalctl JOURNALCTL(1)
2
6 journalctl - Print log entries from the systemd journal
7
9 journalctl [OPTIONS...] [MATCHES...]
10
12 journalctl is used to print the log entries stored in the journal by
13 systemd-journald.service(8) and systemd-journal-remote.service(8).
14 If called without parameters, it will show the contents of the journal
16 accessible to the calling user, starting with the oldest entry
17 collected.
18 If one or more match arguments are passed, the output is filtered
20 accordingly. A match is in the format "FIELD=VALUE", e.g.
21 "_SYSTEMD_UNIT=httpd.service", referring to the components of a
22 structured journal entry. See systemd.journal-fields(7) for a list of
23 well-known fields. If multiple matches are specified matching different
24 fields, the log entries are filtered by both, i.e. the resulting output
25 will show only entries matching all the specified matches of this kind.
26 If two matches apply to the same field, then they are automatically
27 matched as alternatives, i.e. the resulting output will show entries
28 matching any of the specified matches for the same field. Finally, the
29 character "+" may appear as a separate word between other terms on the
30 command line. This causes all matches before and after to be combined
31 in a disjunction (i.e. logical OR).
32 It is also possible to filter the entries by specifying an absolute
34 file path as an argument. The file path may be a file or a symbolic
35 link and the file must exist at the time of the query. If a file path
36 refers to an executable binary, an "_EXE=" match for the canonicalized
37 binary path is added to the query. If a file path refers to an
38 executable script, a "_COMM=" match for the script name is added to the
39 query. If a file path refers to a device node, "_KERNEL_DEVICE="
40 matches for the kernel name of the device and for each of its ancestor
41 devices is added to the query. Symbolic links are dereferenced, kernel
42 names are synthesized, and parent devices are identified from the
43 environment at the time of the query. In general, a device node is the
44 best proxy for an actual device, as log entries do not usually contain
45 fields that identify an actual device. For the resulting log entries to
46 be correct for the actual device, the relevant parts of the environment
47 at the time the entry was logged, in particular the actual device
48 corresponding to the device node, must have been the same as those at
49 the time of the query. Because device nodes generally change their
50 corresponding devices across reboots, specifying a device node path
51 causes the resulting entries to be restricted to those from the current
52 boot.
53 Additional constraints may be added using options --boot, --unit=,
55 etc., to further limit what entries will be shown (logical AND).
56 Output is interleaved from all accessible journal files, whether they
58 are rotated or currently being written, and regardless of whether they
59 belong to the system itself or are accessible user journals. The
60 --header option can be used to identify which files are being shown.
61 The set of journal files which will be used can be modified using the
63 --user, --system, --directory, and --file options, see below.
64 All users are granted access to their private per-user journals.
66 However, by default, only root and users who are members of a few
67 special groups are granted access to the system journal and the
68 journals of other users. Members of the groups "systemd-journal",
69 "adm", and "wheel" can read all journal files. Note that the two latter
70 groups traditionally have additional privileges specified by the
71 distribution. Members of the "wheel" group can often perform
72 administrative tasks.
73 The output is paged through less by default, and long lines are
75 "truncated" to screen width. The hidden part can be viewed by using the
76 left-arrow and right-arrow keys. Paging can be disabled; see the
77 --no-pager option and the "Environment" section below.
78 When outputting to a tty, lines are colored according to priority:
80 lines of level ERROR and higher are colored red; lines of level WARNING
81 are colored yellow; lines of level NOTICE are highlighted; lines of
82 level INFO are displayed normally; lines of level DEBUG are colored
83 grey.
84 To write entries to the journal, a few methods may be used. In general,
86 output from systemd units is automatically connected to the journal,
87 see systemd-journald.service(8). In addition, systemd-cat(1) may be
88 used to send messages to the journal directly.
89
91 The following options control where to read journal records from:
92 --system, --user
94 Show messages from system services and the kernel (with --system).
95 Show messages from service of current user (with --user). If
96 neither is specified, show all messages that the user can see.
97 The --user option affects how --unit= arguments are treated. See
99 --unit=.
100 Note that --user only works if persistent logging is enabled, via
102 the Storage= setting in journald.conf(5).
103 -M, --machine=
105 Show messages from a running, local container. Specify a container
106 name to connect to.
107 -m, --merge
109 Show entries interleaved from all available journals, including
110 remote ones.
111 -D DIR, --directory=DIR
113 Takes a directory path as argument. If specified, journalctl will
114 operate on the specified journal directory DIR instead of the
115 default runtime and system journal paths.
116 --file=GLOB
118 Takes a file glob as an argument. If specified, journalctl will
119 operate on the specified journal files matching GLOB instead of the
120 default runtime and system journal paths. May be specified multiple
121 times, in which case files will be suitably interleaved.
122 --root=ROOT
124 Takes a directory path as an argument. If specified, journalctl
125 will operate on journal directories and catalog file hierarchy
126 underneath the specified directory instead of the root directory
127 (e.g. --update-catalog will create
128 ROOT/var/lib/systemd/catalog/database, and journal files under
129 ROOT/run/journal/ or ROOT/var/log/journal/ will be displayed).
130 --image=IMAGE
132 Takes a path to a disk image file or block device node. If
133 specified, journalctl will operate on the file system in the
134 indicated disk image. This option is similar to --root=, but
135 operates on file systems stored in disk images or block devices,
136 thus providing an easy way to extract log data from disk images.
137 The disk image should either contain just a file system or a set of
138 file systems within a GPT partition table, following the
139 Discoverable Partitions Specification[1]. For further information
140 on supported disk images, see systemd-nspawn(1)'s switch of the
141 same name.
142 --image-policy=policy
144 Takes an image policy string as argument, as per systemd.image-
145 policy(7). The policy is enforced when operating on the disk image
146 specified via --image=, see above. If not specified defaults to the
147 "*" policy, i.e. all recognized file systems in the image are used.
148 --namespace=NAMESPACE
150 Takes a journal namespace identifier string as argument. If not
151 specified the data collected by the default namespace is shown. If
152 specified shows the log data of the specified namespace instead. If
153 the namespace is specified as "*" data from all namespaces is
154 shown, interleaved. If the namespace identifier is prefixed with
155 "+" data from the specified namespace and the default namespace is
156 shown, interleaved, but no other. For details about journal
157 namespaces see systemd-journald.service(8).
158
160 The following options control how to filter journal records:
161 -S, --since=, -U, --until=
163 Start showing entries on or newer than the specified date, or on or
164 older than the specified date, respectively. Date specifications
165 should be of the format "2012-10-30 18:17:16". If the time part is
166 omitted, "00:00:00" is assumed. If only the seconds component is
167 omitted, ":00" is assumed. If the date component is omitted, the
168 current day is assumed. Alternatively the strings "yesterday",
169 "today", "tomorrow" are understood, which refer to 00:00:00 of the
170 day before the current day, the current day, or the day after the
171 current day, respectively. "now" refers to the current time.
172 Finally, relative times may be specified, prefixed with "-" or "+",
173 referring to times before or after the current time, respectively.
174 For complete time and date specification, see systemd.time(7). Note
175 that --output=short-full prints timestamps that follow precisely
176 this format.
177 -c, --cursor=
179 Start showing entries from the location in the journal specified by
180 the passed cursor.
181 --after-cursor=
183 Start showing entries from the location in the journal after the
184 location specified by the passed cursor. The cursor is shown when
185 the --show-cursor option is used.
186 --cursor-file=FILE
188 If FILE exists and contains a cursor, start showing entries after
189 this location. Otherwise show entries according to the other given
190 options. At the end, write the cursor of the last entry to FILE.
191 Use this option to continually read the journal by sequentially
192 calling journalctl.
193 -b [[ID][±offset]|all], --boot[=[ID][±offset]|all]
195 Show messages from a specific boot. This will add a match for
196 "_BOOT_ID=".
197 The argument may be empty, in which case logs for the current boot
199 will be shown.
200 If the boot ID is omitted, a positive offset will look up the boots
202 starting from the beginning of the journal, and an
203 equal-or-less-than zero offset will look up boots starting from the
204 end of the journal. Thus, 1 means the first boot found in the
205 journal in chronological order, 2 the second and so on; while -0 is
206 the last boot, -1 the boot before last, and so on. An empty offset
207 is equivalent to specifying -0, except when the current boot is not
208 the last boot (e.g. because --directory was specified to look at
209 logs from a different machine).
210 If the 32-character ID is specified, it may optionally be followed
212 by offset which identifies the boot relative to the one given by
213 boot ID. Negative values mean earlier boots and positive values
214 mean later boots. If offset is not specified, a value of zero is
215 assumed, and the logs for the boot given by ID are shown.
216 The special argument all can be used to negate the effect of an
218 earlier use of -b.
219 -u, --unit=UNIT|PATTERN
221 Show messages for the specified systemd unit UNIT (such as a
222 service unit), or for any of the units matched by PATTERN. If a
223 pattern is specified, a list of unit names found in the journal is
224 compared with the specified pattern and all that match are used.
225 For each unit name, a match is added for messages from the unit
226 ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages
227 from systemd and messages about coredumps for the specified unit. A
228 match is also added for "_SYSTEMD_SLICE=UNIT", such that if the
229 provided UNIT is a systemd.slice(5) unit, all logs of children of
230 the slice will be shown.
231 With --user, all --unit= arguments will be converted to match user
233 messages as if specified with --user-unit=.
234 This parameter can be specified multiple times.
236 --user-unit=
238 Show messages for the specified user session unit. This will add a
239 match for messages from the unit ("_SYSTEMD_USER_UNIT=" and
240 "_UID=") and additional matches for messages from session systemd
241 and messages about coredumps for the specified unit. A match is
242 also added for "_SYSTEMD_USER_SLICE=UNIT", such that if the
243 provided UNIT is a systemd.slice(5) unit, all logs of children of
244 the unit will be shown.
245 This parameter can be specified multiple times.
247 -t, --identifier=SYSLOG_IDENTIFIER
249 Show messages for the specified syslog identifier
250 SYSLOG_IDENTIFIER.
251 This parameter can be specified multiple times.
253 -p, --priority=
255 Filter output by message priorities or priority ranges. Takes
256 either a single numeric or textual log level (i.e. between
257 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in
258 the form FROM..TO. The log levels are the usual syslog log levels
259 as documented in syslog(3), i.e. "emerg" (0), "alert" (1),
260 "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6),
261 "debug" (7). If a single log level is specified, all messages with
262 this log level or a lower (hence more important) log level are
263 shown. If a range is specified, all messages within the range are
264 shown, including both the start and the end value of the range.
265 This will add "PRIORITY=" matches for the specified priorities.
266 --facility=
268 Filter output by syslog facility. Takes a comma-separated list of
269 numbers or facility names. The names are the usual syslog
270 facilities as documented in syslog(3). --facility=help may be used
271 to display a list of known facility names and exit.
272 -g, --grep=
274 Filter output to entries where the MESSAGE= field matches the
275 specified regular expression. PERL-compatible regular expressions
276 are used, see pcre2pattern(3) for a detailed description of the
277 syntax.
278 If the pattern is all lowercase, matching is case insensitive.
280 Otherwise, matching is case sensitive. This can be overridden with
281 the --case-sensitive option, see below.
282 When used with --lines=, --reverse is implied.
284 --case-sensitive[=BOOLEAN]
286 Make pattern matching case sensitive or case insensitive.
287 -k, --dmesg
289 Show only kernel messages. This implies -b and adds the match
290 "_TRANSPORT=kernel".
291
293 The following options control how journal records are printed:
294 -o, --output=
296 Controls the formatting of the journal entries that are shown.
297 Takes one of the following options:
298 short
300 is the default and generates an output that is mostly identical
301 to the formatting of classic syslog files, showing one line per
302 journal entry.
303 short-full
305 is very similar, but shows timestamps in the format the
306 --since= and --until= options accept. Unlike the timestamp
307 information shown in short output mode this mode includes
308 weekday, year and timezone information in the output, and is
309 locale-independent.
310 short-iso
312 is very similar, but shows ISO 8601 wallclock timestamps.
313 short-iso-precise
315 as for short-iso but includes full microsecond precision.
316 --truncate-newline
318 Truncate each log message at the first newline character on
319 output, so that only the first line of each message is
320 displayed.
321 short-precise
323 is very similar, but shows classic syslog timestamps with full
324 microsecond precision.
325 short-monotonic
327 is very similar, but shows monotonic timestamps instead of
328 wallclock timestamps.
329 short-delta
331 as for short-monotonic but includes the time difference to the
332 previous entry. Maybe unreliable time differences are marked by
333 a "*".
334 short-unix
336 is very similar, but shows seconds passed since January 1st
337 1970 UTC instead of wallclock timestamps ("UNIX time"). The
338 time is shown with microsecond accuracy.
339 verbose
341 shows the full-structured entry items with all fields.
342 export
344 serializes the journal into a binary (but mostly text-based)
345 stream suitable for backups and network transfer (see Journal
346 Export Format[2] for more information). To import the binary
347 stream back into native journald format use systemd-journal-
348 remote(8).
349 json
351 formats entries as JSON objects, separated by newline
352 characters (see Journal JSON Format[3] for more information).
353 Field values are generally encoded as JSON strings, with three
354 exceptions:
355 1. Fields larger than 4096 bytes are encoded as null values.
357 (This may be turned off by passing --all, but be aware that
358 this may allocate overly long JSON objects.)
359 2. Journal entries permit non-unique fields within the same
361 log entry. JSON does not allow non-unique fields within
362 objects. Due to this, if a non-unique field is encountered
363 a JSON array is used as field value, listing all field
364 values as elements.
365 3. Fields containing non-printable or non-UTF8 bytes are
367 encoded as arrays containing the raw bytes individually
368 formatted as unsigned numbers.
369 Note that this encoding is reversible (with the exception of
371 the size limit).
372 json-pretty
374 formats entries as JSON data structures, but formats them in
375 multiple lines in order to make them more readable by humans.
376 json-sse
378 formats entries as JSON data structures, but wraps them in a
379 format suitable for Server-Sent Events[4].
380 json-seq
382 formats entries as JSON data structures, but prefixes them with
383 an ASCII Record Separator character (0x1E) and suffixes them
384 with an ASCII Line Feed character (0x0A), in accordance with
385 JavaScript Object Notation (JSON) Text Sequences[5]
386 ("application/json-seq").
387 cat
389 generates a very terse output, only showing the actual message
390 of each journal entry with no metadata, not even a timestamp.
391 If combined with the --output-fields= option will output the
392 listed fields for each log record, instead of the message.
393 with-unit
395 similar to short-full, but prefixes the unit and user unit
396 names instead of the traditional syslog identifier. Useful when
397 using templated instances, as it will include the arguments in
398 the unit names.
399 --output-fields=
401 A comma separated list of the fields which should be included in
402 the output. This has an effect only for the output modes which
403 would normally show all fields (verbose, export, json, json-pretty,
404 json-sse and json-seq), as well as on cat. For the former, the
405 "__CURSOR", "__REALTIME_TIMESTAMP", "__MONOTONIC_TIMESTAMP", and
406 "_BOOT_ID" fields are always printed.
407 -n, --lines=
409 Show the most recent journal events and limit the number of events
410 shown. If --follow is used, this option is implied. The argument is
411 a positive integer or "all" to disable line limiting. The default
412 value is 10 if no argument is given.
413 When used with --grep=, --reverse is implied.
415 -r, --reverse
417 Reverse output so that the newest entries are displayed first.
418 --show-cursor
420 The cursor is shown after the last entry after two dashes:
421 -- cursor: s=0639...
423 The format of the cursor is private and subject to change.
425 --utc
427 Express time in Coordinated Universal Time (UTC).
428 -x, --catalog
430 Augment log lines with explanation texts from the message catalog.
431 This will add explanatory help texts to log messages in the output
432 where this is available. These short help texts will explain the
433 context of an error or log event, possible solutions, as well as
434 pointers to support forums, developer documentation, and any other
435 relevant manuals. Note that help texts are not available for all
436 messages, but only for selected ones. For more information on the
437 message catalog, please refer to the Message Catalog Developer
438 Documentation[6].
439 Note: when attaching journalctl output to bug reports, please do
441 not use -x.
442 --no-hostname
444 Don't show the hostname field of log messages originating from the
445 local host. This switch has an effect only on the short family of
446 output modes (see above).
447 Note: this option does not remove occurrences of the hostname from
449 log entries themselves, so it does not prevent the hostname from
450 being visible in the logs.
451 --no-full, --full, -l
453 Ellipsize fields when they do not fit in available columns. The
454 default is to show full fields, allowing them to wrap or be
455 truncated by the pager, if one is used.
456 The old options -l/--full are not useful anymore, except to undo
458 --no-full.
459 -a, --all
461 Show all fields in full, even if they include unprintable
462 characters or are very long. By default, fields with unprintable
463 characters are abbreviated as "blob data". (Note that the pager may
464 escape unprintable characters again.)
465 -f, --follow
467 Show only the most recent journal entries, and continuously print
468 new entries as they are appended to the journal.
469 --no-tail
471 Show all stored output lines, even in follow mode. Undoes the
472 effect of --lines=.
473 -q, --quiet
475 Suppresses all informational messages (i.e. "-- Journal begins at
476 ...", "-- Reboot --"), any warning messages regarding inaccessible
477 system journals when run as a normal user.
478
480 The following options control page support:
481 --no-pager
483 Do not pipe output into a pager.
484 -e, --pager-end
486 Immediately jump to the end of the journal inside the implied pager
487 tool. This implies -n1000 to guarantee that the pager will not
488 buffer logs of unbounded size. This may be overridden with an
489 explicit -n with some other numeric value, while -nall will disable
490 this cap. Note that this option is only supported for the less(1)
491 pager.
492
494 The following options may be used together with the --setup-keys
495 command described below:
496 --interval=
498 Specifies the change interval for the sealing key when generating
499 an FSS key pair with --setup-keys. Shorter intervals increase CPU
500 consumption but shorten the time range of undetectable journal
501 alterations. Defaults to 15min.
502 --verify-key=
504 Specifies the FSS verification key to use for the --verify
505 operation.
506 --force
508 When --setup-keys is passed and Forward Secure Sealing (FSS) has
509 already been configured, recreate FSS keys.
510
512 The following commands are understood. If none is specified the default
513 is to display journal records.
514 -N, --fields
516 Print all field names currently used in all entries of the journal.
517 -F, --field=
519 Print all possible data values the specified field can take in all
520 entries of the journal.
521 --list-boots
523 Show a tabular list of boot numbers (relative to the current boot),
524 their IDs, and the timestamps of the first and last message
525 pertaining to the boot.
526 --disk-usage
528 Shows the current disk usage of all journal files. This shows the
529 sum of the disk usage of all archived and active journal files.
530 --vacuum-size=, --vacuum-time=, --vacuum-files=
532 --vacuum-size= removes the oldest archived journal files until the
533 disk space they use falls below the specified size. Accepts the
534 usual "K", "M", "G" and "T" suffixes (to the base of 1024).
535 --vacuum-time= removes archived journal files older than the
537 specified timespan. Accepts the usual "s" (default), "m", "h",
538 "days", "months", "weeks" and "years" suffixes, see systemd.time(7)
539 for details.
540 --vacuum-files= leaves only the specified number of separate
542 journal files.
543 Note that running --vacuum-size= has only an indirect effect on the
545 output shown by --disk-usage, as the latter includes active journal
546 files, while the vacuuming operation only operates on archived
547 journal files. Similarly, --vacuum-files= might not actually reduce
548 the number of journal files to below the specified number, as it
549 will not remove active journal files.
550 --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
552 in a single invocation to enforce any combination of a size, a time
553 and a number of files limit on the archived journal files.
554 Specifying any of these three parameters as zero is equivalent to
555 not enforcing the specific limit, and is thus redundant.
556 These three switches may also be combined with --rotate into one
558 command. If so, all active files are rotated first, and the
559 requested vacuuming operation is executed right after. The rotation
560 has the effect that all currently active files are archived (and
561 potentially new, empty journal files opened as replacement), and
562 hence the vacuuming operation has the greatest effect as it can
563 take all log data written so far into account.
564 --verify
566 Check the journal file for internal consistency. If the file has
567 been generated with FSS enabled and the FSS verification key has
568 been specified with --verify-key=, authenticity of the journal file
569 is verified.
570 --sync
572 Asks the journal daemon to write all yet unwritten journal data to
573 the backing file system and synchronize all journals. This call
574 does not return until the synchronization operation is complete.
575 This command guarantees that any log messages written before its
576 invocation are safely stored on disk at the time it returns.
577 --relinquish-var
579 Asks the journal daemon for the reverse operation to --flush: if
580 requested the daemon will write further log data to
581 /run/log/journal/ and stops writing to /var/log/journal/. A
582 subsequent call to --flush causes the log output to switch back to
583 /var/log/journal/, see above.
584 --smart-relinquish-var
586 Similar to --relinquish-var, but executes no operation if the root
587 file system and /var/log/journal/ reside on the same mount point.
588 This operation is used during system shutdown in order to make the
589 journal daemon stop writing data to /var/log/journal/ in case that
590 directory is located on a mount point that needs to be unmounted.
591 --flush
593 Asks the journal daemon to flush any log data stored in
594 /run/log/journal/ into /var/log/journal/, if persistent storage is
595 enabled. This call does not return until the operation is complete.
596 Note that this call is idempotent: the data is only flushed from
597 /run/log/journal/ into /var/log/journal/ once during system runtime
598 (but see --relinquish-var below), and this command exits cleanly
599 without executing any operation if this has already happened. This
600 command effectively guarantees that all data is flushed to
601 /var/log/journal/ at the time it returns.
602 --rotate
604 Asks the journal daemon to rotate journal files. This call does not
605 return until the rotation operation is complete. Journal file
606 rotation has the effect that all currently active journal files are
607 marked as archived and renamed, so that they are never written to
608 in future. New (empty) journal files are then created in their
609 place. This operation may be combined with --vacuum-size=,
610 --vacuum-time= and --vacuum-file= into a single command, see above.
611 --header
613 Instead of showing journal contents, show internal header
614 information of the journal fields accessed.
615 This option is particularly useful when trying to identify
617 out-of-order journal entries, as happens for example when the
618 machine is booted with the wrong system time.
619 --list-catalog [128-bit-ID...]
621 List the contents of the message catalog as a table of message IDs,
622 plus their short description strings.
623 If any 128-bit-IDs are specified, only those entries are shown.
625 --dump-catalog [128-bit-ID...]
627 Show the contents of the message catalog, with entries separated by
628 a line consisting of two dashes and the ID (the format is the same
629 as .catalog files).
630 If any 128-bit-IDs are specified, only those entries are shown.
632 --update-catalog
634 Update the message catalog index. This command needs to be executed
635 each time new catalog files are installed, removed, or updated to
636 rebuild the binary catalog index.
637 --setup-keys
639 Instead of showing journal contents, generate a new key pair for
640 Forward Secure Sealing (FSS). This will generate a sealing key and
641 a verification key. The sealing key is stored in the journal data
642 directory and shall remain on the host. The verification key should
643 be stored externally. Refer to the Seal= option in journald.conf(5)
644 for information on Forward Secure Sealing and for a link to a
645 refereed scholarly paper detailing the cryptographic theory it is
646 based on.
647 -h, --help
649 Print a short help text and exit.
650 --version
652 Print a short version string and exit.
653
655 On success, 0 is returned; otherwise, a non-zero failure code is
656 returned.
657
659 $SYSTEMD_LOG_LEVEL
660 The maximum log level of emitted messages (messages with a higher
661 log level, i.e. less important ones, will be suppressed). Either
662 one of (in order of decreasing importance) emerg, alert, crit, err,
663 warning, notice, info, debug, or an integer in the range 0...7. See
664 syslog(3) for more information.
665 $SYSTEMD_LOG_COLOR
667 A boolean. If true, messages written to the tty will be colored
668 according to priority.
669 This setting is only useful when messages are written directly to
671 the terminal, because journalctl(1) and other tools that display
672 logs will color messages based on the log level on their own.
673 $SYSTEMD_LOG_TIME
675 A boolean. If true, console log messages will be prefixed with a
676 timestamp.
677 This setting is only useful when messages are written directly to
679 the terminal or a file, because journalctl(1) and other tools that
680 display logs will attach timestamps based on the entry metadata on
681 their own.
682 $SYSTEMD_LOG_LOCATION
684 A boolean. If true, messages will be prefixed with a filename and
685 line number in the source code where the message originates.
686 Note that the log location is often attached as metadata to journal
688 entries anyway. Including it directly in the message text can
689 nevertheless be convenient when debugging programs.
690 $SYSTEMD_LOG_TID
692 A boolean. If true, messages will be prefixed with the current
693 numerical thread ID (TID).
694 Note that the this information is attached as metadata to journal
696 entries anyway. Including it directly in the message text can
697 nevertheless be convenient when debugging programs.
698 $SYSTEMD_LOG_TARGET
700 The destination for log messages. One of console (log to the
701 attached tty), console-prefixed (log to the attached tty but with
702 prefixes encoding the log level and "facility", see syslog(3), kmsg
703 (log to the kernel circular log buffer), journal (log to the
704 journal), journal-or-kmsg (log to the journal if available, and to
705 kmsg otherwise), auto (determine the appropriate log target
706 automatically, the default), null (disable log output).
707 $SYSTEMD_LOG_RATELIMIT_KMSG
709 Whether to ratelimit kmsg or not. Takes a boolean. Defaults to
710 "true". If disabled, systemd will not ratelimit messages written to
711 kmsg.
712 $SYSTEMD_PAGER
714 Pager to use when --no-pager is not given; overrides $PAGER. If
715 neither $SYSTEMD_PAGER nor $PAGER are set, a set of well-known
716 pager implementations are tried in turn, including less(1) and
717 more(1), until one is found. If no pager implementation is
718 discovered no pager is invoked. Setting this environment variable
719 to an empty string or the value "cat" is equivalent to passing
720 --no-pager.
721 Note: if $SYSTEMD_PAGERSECURE is not set, $SYSTEMD_PAGER (as well
723 as $PAGER) will be silently ignored.
724 $SYSTEMD_LESS
726 Override the options passed to less (by default "FRSXMK").
727 Users might want to change two options in particular:
729 K
731 This option instructs the pager to exit immediately when Ctrl+C
732 is pressed. To allow less to handle Ctrl+C itself to switch
733 back to the pager command prompt, unset this option.
734 If the value of $SYSTEMD_LESS does not include "K", and the
736 pager that is invoked is less, Ctrl+C will be ignored by the
737 executable, and needs to be handled by the pager.
738 X
740 This option instructs the pager to not send termcap
741 initialization and deinitialization strings to the terminal. It
742 is set by default to allow command output to remain visible in
743 the terminal even after the pager exits. Nevertheless, this
744 prevents some pager functionality from working, in particular
745 paged output cannot be scrolled with the mouse.
746 See less(1) for more discussion.
748 $SYSTEMD_LESSCHARSET
750 Override the charset passed to less (by default "utf-8", if the
751 invoking terminal is determined to be UTF-8 compatible).
752 $SYSTEMD_PAGERSECURE
754 Takes a boolean argument. When true, the "secure" mode of the pager
755 is enabled; if false, disabled. If $SYSTEMD_PAGERSECURE is not set
756 at all, secure mode is enabled if the effective UID is not the same
757 as the owner of the login session, see geteuid(2) and
758 sd_pid_get_owner_uid(3). In secure mode, LESSSECURE=1 will be set
759 when invoking the pager, and the pager shall disable commands that
760 open or create new files or start new subprocesses. When
761 $SYSTEMD_PAGERSECURE is not set at all, pagers which are not known
762 to implement secure mode will not be used. (Currently only less(1)
763 implements secure mode.)
764 Note: when commands are invoked with elevated privileges, for
766 example under sudo(8) or pkexec(1), care must be taken to ensure
767 that unintended interactive features are not enabled. "Secure" mode
768 for the pager may be enabled automatically as describe above.
769 Setting SYSTEMD_PAGERSECURE=0 or not removing it from the inherited
770 environment allows the user to invoke arbitrary commands. Note that
771 if the $SYSTEMD_PAGER or $PAGER variables are to be honoured,
772 $SYSTEMD_PAGERSECURE must be set too. It might be reasonable to
773 completely disable the pager using --no-pager instead.
774 $SYSTEMD_COLORS
776 Takes a boolean argument. When true, systemd and related utilities
777 will use colors in their output, otherwise the output will be
778 monochrome. Additionally, the variable can take one of the
779 following special values: "16", "256" to restrict the use of colors
780 to the base 16 or 256 ANSI colors, respectively. This can be
781 specified to override the automatic decision based on $TERM and
782 what the console is connected to.
783 $SYSTEMD_URLIFY
785 The value must be a boolean. Controls whether clickable links
786 should be generated in the output for terminal emulators supporting
787 this. This can be specified to override the decision that systemd
788 makes based on $TERM and other conditions.
789
791 Without arguments, all collected logs are shown unfiltered:
792 journalctl
794 With one match specified, all entries with a field matching the
796 expression are shown:
797 journalctl _SYSTEMD_UNIT=avahi-daemon.service
799 journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
800 If two different fields are matched, only entries matching both
802 expressions at the same time are shown:
803 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
805 If two matches refer to the same field, all entries matching either
807 expression are shown:
808 journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
810 If the separator "+" is used, two expressions may be combined in a
812 logical OR. The following will show all messages from the Avahi service
813 process with the PID 28097 plus all messages from the D-Bus service
814 (from any of its processes):
815 journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
817 To show all fields emitted by a unit and about the unit, option
819 -u/--unit= should be used. journalctl -u name expands to a complex
820 filter similar to
821 _SYSTEMD_UNIT=name.service
823 + UNIT=name.service _PID=1
824 + OBJECT_SYSTEMD_UNIT=name.service _UID=0
825 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
826 (see systemd.journal-fields(7) for an explanation of those patterns).
828 Show all logs generated by the D-Bus executable:
830 journalctl /usr/bin/dbus-daemon
832 Show all kernel logs from previous boot:
834 journalctl -k -b -1
836 Show a live log display from a system service apache.service:
838 journalctl -f -u apache
840
842 systemd(1), systemd-cat(1), systemd-journald.service(8), systemctl(1),
843 coredumpctl(1), systemd.journal-fields(7), journald.conf(5),
844 systemd.time(7), systemd-journal-remote.service(8), systemd-journal-
845 upload.service(8)
846
848 1. Discoverable Partitions Specification
849 https://uapi-group.org/specifications/specs/discoverable_partitions_specification
850 2. Journal Export Format
852 https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-export-format
853 3. Journal JSON Format
855 https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-json-format
856 4. Server-Sent Events
858 https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
859 5. JavaScript Object Notation (JSON) Text Sequences
861 https://tools.ietf.org/html/rfc7464
862 6. Message Catalog Developer Documentation
864 https://www.freedesktop.org/wiki/Software/systemd/catalog
865systemd 254 JOURNALCTL(1)