'\" t
.TH "JOURNALCTL" "1" "" "systemd 204" "journalctl"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
journalctl \- Query the systemd journal
.SH "SYNOPSIS"
.HP \w'\fBjournalctl\fR\ 'u
\fBjournalctl\fR [OPTIONS...] [MATCHES...]
.SH "DESCRIPTION"
.PP
\fBjournalctl\fR
may be used to query the contents of the
\fBsystemd\fR(1)
journal as written by
\fBsystemd-journald.service\fR(8)\&.
.PP
If called without parameter it will show the full contents of the journal, starting with the oldest entry collected\&.
.PP
If one or more match arguments are passed the output is filtered accordingly\&. A match is in the format
FIELD=VALUE, e\&.g\&.
_SYSTEMD_UNIT=httpd\&.service, referring to the components of a structured journal entry\&. See
\fBsystemd.journal-fields\fR(7)
for a list of well\-known fields\&. If multiple matches are specified matching different fields the log entries are filtered by both, i\&.e\&. the resulting output will show only entries matching all the specified matches of this kind\&. If two matches apply to the same field, then they are automatically matched as alternatives, i\&.e\&. the resulting output will show entries matching any of the specified matches for the same field\&. Finally, if the character "+" appears as separate word on the command line all matches before and after are combined in a disjunction (i\&.e\&. logical OR)\&.
.PP
As shortcuts for a few types of field/value matches file paths may be specified\&. If a file path refers to an executable file, this is equivalent to an
_EXE=
match for the canonicalized binary path\&. Similar, if a path refers to a device node, this is equivalent to a
_KERNEL_DEVICE=
match for the device\&.
.PP
Output is interleaved from all accessible journal files, whether they are rotated or currently being written, and regardless whether they belong to the system itself or are accessible user journals\&.
.PP
All users are granted access to their private per\-user journals\&. However, by default only root and users who are members of the
adm
group get access to the system journal and the journals of other users\&.
.SH "OPTIONS"
.PP
The following options are understood:
.PP
\fB\-h\fR, \fB\-\-help\fR
.RS 4
Prints a short help text and exits\&.
.RE
.PP
\fB\-\-version\fR
.RS 4
Prints a short version string and exits\&.
.RE
.PP
\fB\-\-no\-pager\fR
.RS 4
Do not pipe output into a pager\&.
.RE
.PP
\fB\-\-full\fR
.RS 4
Show all (printable) fields in full\&.
.RE
.PP
\fB\-a\fR, \fB\-\-all\fR
.RS 4
Show all fields in full, even if they include unprintable characters or are very long\&.
.RE
.PP
\fB\-f\fR, \fB\-\-follow\fR
.RS 4
Show only the most recent journal entries, and continuously print new entries as they are appended to the journal\&.
.RE
.PP
\fB\-e\fR, \fB\-\-pager\-end\fR
.RS 4
Immediately jump to the end of the journal inside the implied pager tool\&. This implies
\fB\-n1000\fR
to guarantee that the pager won\*(Aqt buffer logs of unbounded size\&. This may be overridden with an explicit
\fB\-n\fR
with some other numeric value on the command line\&. Note that this option is only supported for the
\fBless\fR(1)
pager\&.
.RE
.PP
\fB\-n\fR, \fB\-\-lines=\fR
.RS 4
Show the most recent journal events and limit the number of events shown\&. If
\fB\-\-follow\fR
is used, this option is implied\&. The argument, a positive integer, is optional, and defaults to 10\&.
.RE
.PP
\fB\-\-no\-tail\fR
.RS 4
Show all stored output lines, even in follow mode\&. Undoes the effect of
\fB\-\-lines=\fR\&.
.RE
.PP
\fB\-r\fR, \fB\-\-reverse\fR
.RS 4
Reverse output, so the newest entries are displayed first\&.
.RE
.PP
\fB\-o\fR, \fB\-\-output=\fR
.RS 4
Controls the formatting of the journal entries that are shown\&. Takes one of
short,
short\-monotonic,
verbose,
export,
json,
json\-pretty,
json\-sse,
cat\&.
short
is the default and generates an output that is mostly identical to the formatting of classic syslog log files, showing one line per journal entry\&.
short\-monotonic
is very similar but shows monotonic timestamps instead of wallclock timestamps\&.
verbose
shows the full structured entry items with all fields\&.
export
serializes the journal into a binary (but mostly text\-based) stream suitable for backups and network transfer (see
\m[blue]\fBJournal Export Format\fR\m[]\&\s-2\u[1]\d\s+2
for more information)\&.
json
formats entries as JSON data structures, one per line (see
\m[blue]\fBJournal JSON Format\fR\m[]\&\s-2\u[2]\d\s+2
for more information)\&.
json\-pretty
also formats entries as JSON data structures, but formats them in multiple lines in order to make them more readable for humans\&.
json\-sse
also formats entries as JSON data structures, but wraps them in a format suitable for
\m[blue]\fBServer\-Sent Events\fR\m[]\&\s-2\u[3]\d\s+2\&.
cat
generates a very terse output only showing the actual message of each journal entry with no meta data, not even a timestamp\&.
.RE
.PP
\fB\-x\fR, \fB\-\-catalog\fR
.RS 4
Augment log lines with explanation texts from the message catalog\&. This will add explanatory help texts to log messages in the output where this is available\&. These short help texts will explain the context of an error or log event, possible solutions, as well as pointers to support forums, developer documentation and any other relevant manuals\&. Note that help texts are not available for all messages, but only for selected ones\&. For more information on the message catalog please refer to the
\m[blue]\fBMessage Catalog Developer Documentation\fR\m[]\&\s-2\u[4]\d\s+2\&.
.RE
.PP
\fB\-q\fR, \fB\-\-quiet\fR
.RS 4
Suppresses any warning message regarding inaccessible system journals when run as normal user\&.
.RE
.PP
\fB\-m\fR, \fB\-\-merge\fR
.RS 4
Show entries interleaved from all available journals, including remote ones\&.
.RE
.PP
\fB\-b\fR, \fB\-\-this\-boot\fR
.RS 4
Show data only from current boot\&. This will add a match for
_BOOT_ID=
for the current boot ID of the kernel\&.
.RE
.PP
\fB\-u\fR, \fB\-\-unit=\fR
.RS 4
Show messages for the specified systemd unit\&. This will add a match for messages from the unit (_SYSTEMD_UNIT=) and additional matches for messages from systemd and messages about coredumps for the specified unit\&.
.sp
This parameter can be specified multiple times\&.
.RE
.PP
\fB\-\-user\-unit=\fR
.RS 4
Show messages for the specified user session unit\&. This will add a match for messages from the unit (_SYSTEMD_USER_UNIT=
and
_UID=) and additional matches for messages from session systemd and messages about coredumps for the specified unit\&.
.sp
This parameter can be specified multiple times\&.
.RE
.PP
\fB\-p\fR, \fB\-\-priority=\fR
.RS 4
Filter output by message priorities or priority ranges\&. Takes either a single numeric or textual log level (i\&.e\&. between 0/emerg
and 7/debug), or a range of numeric/text log levels in the form FROM\&.\&.TO\&. The log levels are the usual syslog log levels as documented in
\fBsyslog\fR(3), i\&.e\&.
emerg
(0),
alert
(1),
crit
(2),
err
(3),
warning
(4),
notice
(5),
info
(6),
debug
(7)\&. If a single log level is specified all messages with this log level or a lower (hence more important) log level are shown\&. If a range is specified all messages within the range are shown, including both the start and the end value of the range\&. This will add
PRIORITY=
matches for the specified priorities\&.
.RE
.PP
\fB\-c\fR, \fB\-\-cursor=\fR
.RS 4
Start showing entries from the location in the journal specified by the passed cursor\&.
.RE
.PP
\fB\-\-since=\fR, \fB\-\-until=\fR
.RS 4
Start showing entries on or newer than the specified date, or on or older than the specified date, respectively\&. Date specifications should be of the format "2012\-10\-30 18:17:16"\&. If the time part is omitted, 00:00:00 is assumed\&. If only the seconds component is omitted, :00 is assumed\&. If the date component is omitted, the current day is assumed\&. Alternatively the strings
yesterday,
today,
tomorrow
are understood, which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day, respectively\&.
now
refers to the current time\&. Finally, relative times may be specified, prefixed with
\-
or
+, referring to times before or after the current time, respectively\&.
.RE
.PP
\fB\-F\fR, \fB\-\-field=\fR
.RS 4
Print all possible data values the specified field can take in all entries of the journal\&.
.RE
.PP
\fB\-D\fR, \fB\-\-directory=\fR
.RS 4
Takes a directory path as argument\&. If specified journalctl will operate on the specified journal directory instead of the default runtime and system journal paths\&.
.RE
.PP
\fB\-\-root=\fR\fB\fIROOT\fR\fR
.RS 4
Takes a directory path as argument\&. If specified journalctl will operate on catalog file hierarchy underneath the specified directory instead of the root directory (e\&.g\&.
\fB\-\-update\-catalog\fR
will create
\fIROOT\fR/var/lib/systemd/catalog/database)\&.
.RE
.PP
\fB\-\-new\-id128\fR
.RS 4
Instead of showing journal contents generate a new 128 bit ID suitable for identifying messages\&. This is intended for usage by developers who need a new identifier for a new message they introduce and want to make recognizable\&. Will print the new ID in three different formats which can be copied into source code or similar\&.
.RE
.PP
\fB\-\-header\fR
.RS 4
Instead of showing journal contents show internal header information of the journal fields accessed\&.
.RE
.PP
\fB\-\-disk\-usage\fR
.RS 4
Shows the current disk usage of all journal files\&.
.RE
.PP
\fB\-\-list\-catalog \fR\fB[\fIID128\&.\&.\&.\fR]\fR\fB \fR
.RS 4
List the contents of the message catalog, as table of message IDs plus their short description strings\&.
.sp
If any
\fIID128\fRs are specified, only those entries are shown\&.
.RE
.PP
\fB\-\-dump\-catalog \fR\fB[\fIID128\&.\&.\&.\fR]\fR\fB \fR
.RS 4
Show the contents of the message catalog, with entries separated by a line consisting of two dashes and the id (the format is the same as
\&.catalog
files\&.
.sp
If any
\fIID128\fRs are specified, only those entries are shown\&.
.RE
.PP
\fB\-\-update\-catalog\fR
.RS 4
Update the message catalog index\&. This command needs to be executed each time new catalog files are installed, removed or updated to rebuild the binary catalog index\&.
.RE
.PP
\fB\-\-setup\-keys\fR
.RS 4
Instead of showing journal contents generate a new key pair for Forward Secure Sealing (FSS)\&. This will generate a sealing key and a verification key\&. The sealing key is stored in the journal data directory and shall remain on the host\&. The verification key should be stored externally\&.
.RE
.PP
\fB\-\-interval=\fR
.RS 4
Specifies the change interval for the sealing key, when generating an FSS key pair with
\fB\-\-setup\-keys\fR\&. Shorter intervals increase CPU consumption but shorten the time range of undetectable journal alterations\&. Defaults to 15min\&.
.RE
.PP
\fB\-\-verify\fR
.RS 4
Check the journal file for internal consistency\&. If the file has been generated with FSS enabled, and the FSS verification key has been specified with
\fB\-\-verify\-key=\fR
authenticity of the journal file is verified\&.
.RE
.PP
\fB\-\-verify\-key=\fR
.RS 4
Specifies the FSS verification key to use for the
\fB\-\-verify\fR
operation\&.
.RE
.SH "EXIT STATUS"
.PP
On success 0 is returned, a non\-zero failure code otherwise\&.
.SH "ENVIRONMENT"
.PP
\fI$SYSTEMD_PAGER\fR
.RS 4
Pager to use when
\fB\-\-no\-pager\fR
is not given; overrides
\fI$PAGER\fR\&. Setting this to an empty string or the value
cat
is equivalent to passing
\fB\-\-no\-pager\fR\&.
.RE
.SH "EXAMPLES"
.PP
Without arguments all collected logs are shown unfiltered:
.sp
.if n \{\
.RS 4
.\}
.nf
journalctl
.fi
.if n \{\
.RE
.\}
.PP
With one match specified all entries with a field matching the expression are shown:
.sp
.if n \{\
.RS 4
.\}
.nf
journalctl _SYSTEMD_UNIT=avahi\-daemon\&.service
.fi
.if n \{\
.RE
.\}
.PP
If two different fields are matched only entries matching both expressions at the same time are shown:
.sp
.if n \{\
.RS 4
.\}
.nf
journalctl _SYSTEMD_UNIT=avahi\-daemon\&.service _PID=28097
.fi
.if n \{\
.RE
.\}
.PP
If two matches refer to the same field all entries matching either expression are shown:
.sp
.if n \{\
.RS 4
.\}
.nf
journalctl _SYSTEMD_UNIT=avahi\-daemon\&.service _SYSTEMD_UNIT=dbus\&.service
.fi
.if n \{\
.RE
.\}
.PP
If the separator "+" is used two expressions may be combined in a logical OR\&. The following will show all messages from the Avahi service process with the PID 28097 plus all messages from the D\-Bus service (from any of its processes):
.sp
.if n \{\
.RS 4
.\}
.nf
journalctl _SYSTEMD_UNIT=avahi\-daemon\&.service _PID=28097 + _SYSTEMD_UNIT=dbus\&.service
.fi
.if n \{\
.RE
.\}
.PP
Show all logs generated by the D\-Bus executable:
.sp
.if n \{\
.RS 4
.\}
.nf
journalctl /usr/bin/dbus\-daemon
.fi
.if n \{\
.RE
.\}
.PP
Show all logs of the kernel device node
/dev/sda:
.sp
.if n \{\
.RS 4
.\}
.nf
journalctl /dev/sda
.fi
.if n \{\
.RE
.\}
.SH "SEE ALSO"
.PP

\fBsystemd\fR(1),
\fBsystemd-journald.service\fR(8),
\fBsystemctl\fR(1),
\fBsystemd.journal-fields\fR(7),
\fBjournald.conf\fR(5)
.SH "NOTES"
.IP " 1." 4
Journal Export Format
.RS 4
\%http://www.freedesktop.org/wiki/Software/systemd/export
.RE
.IP " 2." 4
Journal JSON Format
.RS 4
\%http://www.freedesktop.org/wiki/Software/systemd/json
.RE
.IP " 3." 4
Server-Sent Events
.RS 4
\%https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events
.RE
.IP " 4." 4
Message Catalog Developer Documentation
.RS 4
\%http://www.freedesktop.org/wiki/Software/systemd/catalog
.RE