JOURNALCTL(1) journalctl JOURNALCTL(1) (NAME) journalctl - systemd (SYNOPSIS) journalctl [OPTIONS...] [MATCHES...] (DESCRIPTION) journalctl systemd-journald.service(8) systemd-journal-remote.service(8) . . (match) . "FIELD=VALUE" "_SYSTEMD_UNIT=httpd.service" . systemd.journal-fields(7) . . . "+" . ( OR ) . . (symbolic link) . "_EXE=" (canonicalized) . "_COMM=" . (device node) "_KERNEL_DEVICE=" . . . . (reboot) . --boot --unit= (AND ). (rotated) . --header . --user --system --directory= --file= . . (root) . "systemd-journal" "adm" "wheel" . . "wheel" . less (<<>>) . . --no-pager << (ENVIRONMENT)>> . tty : ERROR WARNING NOTICE (highlight) INFO DEBUG . . systemd systemd-journald.service(8) . systemd-cat(1) . (SOURCE OPTIONS) : --system, --user ( --system). ( --user). . --user --unit= . --unit= . --user (persistent logging) Storage= journald.conf(5) . 205. -M, --machine= . . 209. -m, --merge (remote). 190. -D DIR, --directory=DIR . journalctl DIR . 187. -i GLOB, --file=GLOB (file glob) . journalctl GLOB . . 205. --root=ROOT . journalctl ( --update-catalog ROOT/var/lib/systemd/catalog/database ROOT/run/journal/ ROOT/var/log/journal/ ). 201. --image=IMAGE . journalctl . --root= . GPT (Discoverable Partitions Specification)[1] . systemd-nspawn(1)' . 247. --image-policy=policy systemd.image-policy(7) . --image= ( ) . "*" . --namespace=NAMESPACE (namespace) . . . "*" . "+" . systemd- journald.service(8) . 245. (FILTERING OPTIONS) : -S, --since=, -U, --until= . "2012-10-30 18:17:16" . "00:00:00" . ":00" . . "yesterday" () "today" () "tomorrow" () 00:00:00 . "now" () . "-" "+" . systemd.time(7) . --output=short-full . 195. -c, --cursor= (cursor) . 193. --after-cursor= . --show-cursor . 206. --cursor-file=FILE FILE . . FILE . journalctl . 242. -b [[ID][+-offset]|all], --boot[=[ID][+-offset]|all] . "_BOOT_ID=" . . offset offset . 1 2 -0 -1 . offset -0 ( --directory= ). ID offset ID . . offset ID . all -b . 186. -u, --unit=UNIT|PATTERN systemd UNIT ( ) PATTERN. . ("_SYSTEMD_UNIT=UNIT") systemd (coredump) . "_SYSTEMD_SLICE=UNIT" UNIT systemd.slice(5) (slice) . --user --unit= --user-unit= . . 195. --user-unit= . ("_SYSTEMD_USER_UNIT=" "_UID=") systemd coredump . "_SYSTEMD_USER_SLICE=UNIT" UNIT systemd.slice(5) . . 198. -I, --invocation=ID[+-offset]|offset (invocation) . "_SYSTEMD_INVOCATION_ID=" "OBJECT_SYSTEMD_INVOCATION_ID=" "INVOCATION_ID=" "USER_INVOCATION_ID=" . offset systemd . 1 2 0 -1 . ID +-offset ID . . +-offset ID . -I --invocation=0 . -u/--unit= --user-unit= . -b/--boot= . 257. -t, --identifier=SYSLOG_IDENTIFIER syslog SYSLOG_IDENTIFIER. . 217. -T, --exclude-identifier=SYSLOG_IDENTIFIER syslog SYSLOG_IDENTIFIER. . 256. -p, --priority= . ( 0/"emerg" 7/"debug") / FROM..TO . syslog syslog(3) "emerg" (0) "alert" (1) "crit" (2) "err" (3) "warning" (4) "notice" (5) "info" (6) "debug" (7). ( ) . . "PRIORITY=" . 188. --facility= (facility) syslog. . syslog syslog(3) . --facility=help facility . 245. -g, --grep= MESSAGE= (regular expression) . PERL pcre2pattern(3) . (case insensitive) . . --case-sensitive . --lines= ( "+") --reverse . 237. --case-sensitive[=BOOLEAN] . 237. -k, --dmesg (). -b "_TRANSPORT=kernel" . 205. (OUTPUT OPTIONS) : -o, --output= . : short syslog . 206. short-full --since= --until= . short (locale) . 232. short-iso RFC 3339[2] ISO 8601 . 206. short-iso-precise short-iso . 234. short-precise syslog . 207. short-monotonic (monotonic) (wallclock) . 206. short-delta short-monotonic . "*" . 252. short-unix UTC (<< >>). . 230. verbose . 206. export ( ) ( Journal Export Format[3] ). journald systemd-journal-remote(8) . 206. json JSON (newline) ( Journal JSON Format[4] ). JSON : 1. null . ( --all JSON .) 2. . JSON . JSON . 3. UTF-8 . ( ). 206. json-pretty JSON . 206. json-sse JSON Server-Sent Events[5] . 206. json-seq JSON JavaScript Object Notation (JSON) Text Sequences[6] ("application/json-seq") ASCII (0x1E) ASCII (0x0A) . 240. cat . --output-fields= . 206. with-unit short-full syslog . (templated instances) . 239. --truncate-newline . 254. --output-fields= . (verbose export json json-pretty json-sse json-seq) cat. "__CURSOR" "__REALTIME_TIMESTAMP" "__MONOTONIC_TIMESTAMP" "_BOOT_ID" . 236. -n, --lines= . "all" . "+" . . --follow . "+" --grep= --reverse . -r, --reverse . 198. --show-cursor : -- cursor: s=0639... . 209. --utc (UTC). 217. -x, --catalog . . . . Journal Message Catalogs[7] . : journalctl -x . 196. --no-hostname (hostname) . short ( ). : . 230. --no-full, --full, -l (...) . . -l/--full --no-full. 196. -a, --all . "blob data" . ( .) -f, --follow . --no-tail (follow). --lines= . -q, --quiet ( "-- Journal begins at ..." "-- Reboot --") . (PAGER CONTROL OPTIONS) (pager) : --no-pager (pipe) . -e, --pager-end . -n1000 . -n -nall . less(1) . 198. FSS (FORWARD SECURE SEALING (FSS) OPTIONS) --setup-keys : --interval= (sealing key) FSS --setup-keys . (CPU) . 15min . 189. --verify-key= FSS --verify . 189. --force --setup-keys (FSS) FSS . 206. (COMMANDS) . : -N, --fields . 229. -F, --field= . 195. --list-boots ( ) . -n/--lines=[+]N ( "+") ( ) N . -r/--reverse . 209. --list-invocations (invocation IDs) . -u/--unit= --user-unit= . ( ) . -b/-boot . -n/--lines=[+]N ( "+") ( ) N . -r/--reverse . 257. --disk-usage . . 190. --vacuum-size=, --vacuum-time=, --vacuum-files= --vacuum-size= . "K" "M" "G" "T" ( ) . --vacuum-time= . "s" () "m" "h" "days" "weeks" "months" "years" systemd.time(7) . --vacuum-files= . --vacuum-size= --disk-usage (vacuuming) . --vacuum-files= . --vacuum-size= --vacuum-time= --vacuum-files= . . --rotate . (rotate) . ( ) . 218. --verify . FSS FSS --verify-key= . 189. --sync (synchronize) . . . 228. --relinquish-var --flush : /run/log/journal/ /var/log/journal/ . --flush /var/log/journal/ . 243. --smart-relinquish-var --relinquish-var /var/log/journal/ (mount point) . (shutdown) /var/log/journal/ unmount . 243. --flush /run/log/journal/ /var/log/journal/ (flush) . . (idempotent) : /run/log/journal/ /var/log/journal/ ( --relinquish-var ) . /var/log/journal/ . 217. --rotate (rotate ). . . () . --vacuum-size= --vacuum-time= --vacuum-file= . 227. --header (header) . . 187. --list-catalog [128-bit-ID...] . 128-bit-ID . 196. --dump-catalog [128-bit-ID...] ( .catalog ). 128-bit-ID . 199. --update-catalog (index) . . 196. --setup-keys (FSS) . (sealing key) (verification key) . . . Forward Secure Sealing Seal= journald.conf(5) . 189. -h, --help . --version . (EXIT STATUS) 0 . (ENVIRONMENT) $SYSTEMD_LOG_LEVEL ( ). . ( ): emerg alert crit err warning notice info debug 0...7. syslog(3) . console syslog kmsg journal ( SYSTEMD_LOG_LEVEL=debug,console:info debug info ). . $SYSTEMD_LOG_COLOR . true tty . journalctl(1) . $SYSTEMD_LOG_TIME . true . journalctl(1) . $SYSTEMD_LOG_LOCATION . true . . (debugging) . $SYSTEMD_LOG_TID . true (TID) . . . $SYSTEMD_LOG_TARGET . : console ( tty ) console-prefixed ( tty "facility" syslog(3) ) kmsg ( ) journal ( ) journal-or-kmsg ( kmsg) auto ( ) null ( ). $SYSTEMD_LOG_RATELIMIT_KMSG kmsg (ratelimit) . . "true" . systemd kmsg . $SYSTEMD_PAGER, $PAGER --no-pager . $SYSTEMD_PAGER $PAGER . $SYSTEMD_PAGER $PAGER less(1) more(1) . . "cat" --no-pager . : $SYSTEMD_PAGERSECURE $SYSTEMD_PAGER $PAGER ( "cat" "") . $SYSTEMD_LESS less ( "FRSXMK"). : K Ctrl+C . less Ctrl+C . $SYSTEMD_LESS "K" less Ctrl+C . X termcap . . . $LESS less systemd . less(1) . $SYSTEMD_LESSCHARSET (charset) less ( "utf-8" UTF-8 ). $LESSCHARSET less systemd . $SYSTEMD_PAGERSECURE less(1) <<>> (shell) . sudo(8) pkexec(1) (security boundary) . . << >> (secure mode) ( ). << >> --no-pager PAGER=cat . . true << >> . << >> LESSSECURE=1 . less(1) << >> . false . SYSTEMD_PAGERSECURE=0 . $SYSTEMD_PAGERSECURE systemd << >> . UID (effective UID) ( geteuid(2) sd_pid_get_owner_uid(3) ) sudo(8) ( $SUDO_UID [8]) << >> . SYSTEMD_PAGERSECURE=1 << >> . . $SYSTEMD_PAGERSECURE . $SYSTEMD_PAGER $PAGER ( ) $SYSTEMD_PAGERSECURE . $SYSTEMD_COLORS . true systemd (monochrome) . "16" "256" ANSI . $TERM . $SYSTEMD_URLIFY . . systemd $TERM . (EXAMPLES) : journalctl : journalctl _SYSTEMD_UNIT=avahi-daemon.service journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope : journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 : journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service "+" OR . Avahi PID D-Bus ( ) : journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service -u/--unit= . journalctl -u name : _SYSTEMD_UNIT=name.service + UNIT=name.service _PID=1 + OBJECT_SYSTEMD_UNIT=name.service _UID=0 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1 ( systemd.journal-fields(7) ). D-Bus: journalctl /usr/bin/dbus-daemon () : journalctl -k -b -1 apache.service: journalctl -f -u apache (SEE ALSO) systemd(1), systemd-cat(1), systemd-journald.service(8), systemctl(1), coredumpctl(1), systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd-journal-remote.service(8), systemd-journal- upload.service(8) (NOTES) 1. Discoverable Partitions Specification https://uapi- group.org/specifications/specs/discoverable_partitions_specification 2. RFC 3339 https://tools.ietf.org/html/rfc3339 3. Journal Export Format https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-export-format 4. Journal JSON Format https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-json-format 5. Server-Sent Events https://developer.mozilla.org/en-US/docs/Server- sent_events/Using_server-sent_events 6. JavaScript Object Notation (JSON) Text Sequences https://tools.ietf.org/html/rfc7464 7. Journal Message Catalogs https://systemd.io/CATALOG 8. $SUDO_UID . systemd 257.13 JOURNALCTL(1)