journalctl(1)

NAME#

journalctl - Print log entries from the systemd journal

SYNOPSIS#

journalctl [OPTIONS...] [MATCHES...]

DESCRIPTION#

journalctl is used to print the log entries stored in the journal by systemd-journald.service(8) and systemd-journal-remote.service(8).

If called without parameters, it will show the contents of the journal accessible to the calling user, starting with the oldest entry collected.

If one or more match arguments are passed, the output is filtered accordingly. A match is in the format "FIELD=VALUE", e.g. "_SYSTEMD_UNIT=httpd.service", referring to the components of a structured journal entry. See systemd.journal-fields(7) for a list of well-known fields. If multiple matches are specified matching different fields, the log entries are filtered by both, i.e. the resulting output will show only entries matching all the specified matches of this kind. If two matches apply to the same field, then they are automatically matched as alternatives, i.e. the resulting output will show entries matching any of the specified matches for the same field. Finally, the character "+" may appear as a separate word between other terms on the command line. This causes all matches before and after to be combined in a disjunction (i.e. logical OR).

It is also possible to filter the entries by specifying an absolute file path as an argument. The file path may be a file or a symbolic link and the file must exist at the time of the query. If a file path refers to an executable binary, an "_EXE=" match for the canonicalized binary path is added to the query. If a file path refers to an executable script, a "_COMM=" match for the script name is added to the query. If a file path refers to a device node, "_KERNEL_DEVICE=" matches for the kernel name of the device and for each of its ancestor devices is added to the query. Symbolic links are dereferenced, kernel names are synthesized, and parent devices are identified from the environment at the time of the query. In general, a device node is the best proxy for an actual device, as log entries do not usually contain fields that identify an actual device. For the resulting log entries to be correct for the actual device, the relevant parts of the environment at the time the entry was logged, in particular the actual device corresponding to the device node, must have been the same as those at the time of the query. Because device nodes generally change their corresponding devices across reboots, specifying a device node path causes the resulting entries to be restricted to those from the current boot.

Additional constraints may be added using options --boot, --unit=, etc., to further limit what entries will be shown (logical AND).

Output is interleaved from all accessible journal files, whether they are rotated or currently being written, and regardless of whether they belong to the system itself or are accessible user journals. The --header option can be used to identify which files are being shown.

The set of journal files which will be used can be modified using the --user, --system, --directory=, and --file= options, see below.

All users are granted access to their private per-user journals. However, by default, only root and users who are members of a few special groups are granted access to the system journal and the journals of other users. Members of the groups "systemd-journal", "adm", and "wheel" can read all journal files. Note that the two latter groups traditionally have additional privileges specified by the distribution. Members of the "wheel" group can often perform administrative tasks.

The output is paged through less by default, and long lines are "truncated" to screen width. The hidden part can be viewed by using the left-arrow and right-arrow keys. Paging can be disabled; see the --no-pager option and the "Environment" section below.

When outputting to a tty, lines are colored according to priority: lines of level ERROR and higher are colored red; lines of level WARNING are colored yellow; lines of level NOTICE are highlighted; lines of level INFO are displayed normally; lines of level DEBUG are colored grey.

To write entries to the journal, a few methods may be used. In general, output from systemd units is automatically connected to the journal, see systemd-journald.service(8). In addition, systemd-cat(1) may be used to send messages to the journal directly.

SOURCE OPTIONS#

The following options control where to read journal records from:

--system, --user

The --user option affects how --unit= arguments are treated. See --unit=.

Note that --user only works if persistent logging is enabled, via the Storage= setting in journald.conf(5).

Added in version 205.

-M, --machine=

Added in version 209.

-m, --merge

Added in version 190.

-DDIR, --directory=DIR

Added in version 187.

-iGLOB, --file=GLOB

Added in version 205.

--root=ROOT

Added in version 201.

--image=IMAGE

Added in version 247.

--image-policy=policy

--namespace=NAMESPACE

Added in version 245.

FILTERING OPTIONS#

The following options control how to filter journal records:

-S, --since=, -U, --until=

Added in version 195.

-c, --cursor=

Added in version 193.

--after-cursor=

Added in version 206.

--cursor-file=FILE

Added in version 242.

-b[[ID][±offset]|all], --boot[=[ID][±offset]|all]

The argument may be empty, in which case logs for the current boot will be shown.

If the boot ID is omitted, a positive offset will look up the boots starting from the beginning of the journal, and an equal-or-less-than zero offset will look up boots starting from the end of the journal. Thus, 1 means the first boot found in the journal in chronological order, 2 the second and so on; while -0 is the last boot, -1 the boot before last, and so on. An empty offset is equivalent to specifying -0, except when the current boot is not the last boot (e.g. because --directory= was specified to look at logs from a different machine).

If the 32-character ID is specified, it may optionally be followed by offset which identifies the boot relative to the one given by boot ID. Negative values mean earlier boots and positive values mean later boots. If offset is not specified, a value of zero is assumed, and the logs for the boot given by ID are shown.

The special argument all can be used to negate the effect of an earlier use of -b.

Added in version 186.

-u, --unit=UNIT|PATTERN

With --user, all --unit= arguments will be converted to match user messages as if specified with --user-unit=.

This parameter can be specified multiple times.

Added in version 195.

--user-unit=

This parameter can be specified multiple times.

Added in version 198.

-I, --invocation=ID[±offset]|offset

A positive offset will look up the invocations of a systemd unit from the beginning of the journal, and zero or a negative offset will look up invocations starting from the end of the journal. Thus, 1 means the first invocation found in the journal in chronological order, 2 the second and so on; while 0 is the latest invocation, -1 the invocation before the latest, and so on.

If the 32-character ID is specified, it may optionally be followed by ±offset which identifies the invocation relative to the one given by invocation ID. Negative values mean earlier invocations and positive values mean later invocations. If ±offset is not specified, a value of zero is assumed, and the logs for the invocation given by ID will be shown.

-I is equivalent to --invocation=0, and logs for the latest invocation will be shown.

When an offset is specified, a unit name must be specified with -u/--unit= or --user-unit= option.

When specified with -b/--boot=, then invocations are searched within the specified boot.

Added in version 257.

-t, --identifier=SYSLOG_IDENTIFIER

This parameter can be specified multiple times.

Added in version 217.

-T, --exclude-identifier=SYSLOG_IDENTIFIER

This parameter can be specified multiple times.

Added in version 256.

-p, --priority=

Added in version 188.

--facility=

Added in version 245.

-g, --grep=

If the pattern is all lowercase, matching is case insensitive. Otherwise, matching is case sensitive. This can be overridden with the --case-sensitive option, see below.

When used with --lines= (not prefixed with "+"), --reverse is implied.

Added in version 237.

--case-sensitive[=BOOLEAN]

Added in version 237.

-k, --dmesg

Added in version 205.

OUTPUT OPTIONS#

The following options control how journal records are printed:

-o, --output=

short

Added in version 206.

short-full

Added in version 232.

short-iso

Added in version 206.

short-iso-precise

Added in version 234.

short-precise

Added in version 207.

short-monotonic

Added in version 206.

short-delta

Added in version 252.

short-unix

Added in version 230.

verbose

Added in version 206.

export

Added in version 206.

json

Note that this encoding is reversible (with the exception of the size limit).

Added in version 206.

json-pretty

Added in version 206.

json-sse

Added in version 206.

json-seq

Added in version 240.

cat

Added in version 206.

with-unit

Added in version 239.

--truncate-newline

Added in version 254.

--output-fields=

Added in version 236.

-n, --lines=

If --follow is used, this option is implied. When not prefixed with "+" and used with --grep=, --reverse is implied.

-r, --reverse

Added in version 198.

--show-cursor

-- cursor: s=0639...

The format of the cursor is private and subject to change.

Added in version 209.

--utc

Added in version 217.

-x, --catalog

Note: when attaching journalctl output to bug reports, please do not use -x.

Added in version 196.

--no-hostname

Note: this option does not remove occurrences of the hostname from log entries themselves, so it does not prevent the hostname from being visible in the logs.

Added in version 230.

--no-full, --full, -l

The old options -l/--full are not useful anymore, except to undo --no-full.

Added in version 196.

-a, --all

-f, --follow

--no-tail

-q, --quiet

PAGER CONTROL OPTIONS#

The following options control page support:

--no-pager

-e, --pager-end

Added in version 198.

FORWARD SECURE SEALING (FSS) OPTIONS#

The following options may be used together with the --setup-keys command described below:

--interval=

Added in version 189.

--verify-key=

Added in version 189.

--force

Added in version 206.

COMMANDS#

The following commands are understood. If none is specified the default is to display journal records:

-N, --fields

Added in version 229.

-F, --field=

Added in version 195.

--list-boots

Added in version 209.

--list-invocations

Added in version 257.

--disk-usage

Added in version 190.

--vacuum-size=, --vacuum-time=, --vacuum-files=

--vacuum-time= removes archived journal files older than the specified timespan. Accepts the usual "s" (default), "m", "h", "days", "weeks", "months", and "years" suffixes, see systemd.time(7) for details.

--vacuum-files= leaves only the specified number of separate journal files.

Note that running --vacuum-size= has only an indirect effect on the output shown by --disk-usage, as the latter includes active journal files, while the vacuuming operation only operates on archived journal files. Similarly, --vacuum-files= might not actually reduce the number of journal files to below the specified number, as it will not remove active journal files.

--vacuum-size=, --vacuum-time= and --vacuum-files= may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing the specific limit, and is thus redundant.

These three switches may also be combined with --rotate into one command. If so, all active files are rotated first, and the requested vacuuming operation is executed right after. The rotation has the effect that all currently active files are archived (and potentially new, empty journal files opened as replacement), and hence the vacuuming operation has the greatest effect as it can take all log data written so far into account.

Added in version 218.

--verify

Added in version 189.

--sync

Added in version 228.

--relinquish-var

Added in version 243.

--smart-relinquish-var

Added in version 243.

--flush

Added in version 217.

--rotate

Added in version 227.

--header

This option is particularly useful when trying to identify out-of-order journal entries, as happens for example when the machine is booted with the wrong system time.

Added in version 187.

--list-catalog[128-bit-ID...]

If any 128-bit-IDs are specified, only those entries are shown.

Added in version 196.

--dump-catalog[128-bit-ID...]

If any 128-bit-IDs are specified, only those entries are shown.

Added in version 199.

--update-catalog

Added in version 196.

--setup-keys

Added in version 189.

-h, --help

--version

EXIT STATUS#

On success, 0 is returned; otherwise, a non-zero failure code is returned.

ENVIRONMENT#

$SYSTEMD_LOG_LEVEL

$SYSTEMD_LOG_COLOR

This setting is only useful when messages are written directly to the terminal, because journalctl(1) and other tools that display logs will color messages based on the log level on their own.

$SYSTEMD_LOG_TIME

This setting is only useful when messages are written directly to the terminal or a file, because journalctl(1) and other tools that display logs will attach timestamps based on the entry metadata on their own.

$SYSTEMD_LOG_LOCATION

Note that the log location is often attached as metadata to journal entries anyway. Including it directly in the message text can nevertheless be convenient when debugging programs.

$SYSTEMD_LOG_TID

Note that the this information is attached as metadata to journal entries anyway. Including it directly in the message text can nevertheless be convenient when debugging programs.

$SYSTEMD_LOG_TARGET

$SYSTEMD_LOG_RATELIMIT_KMSG

$SYSTEMD_PAGER, $PAGER

Note: if $SYSTEMD_PAGERSECURE is not set, $SYSTEMD_PAGER and $PAGER can only be used to disable the pager (with "cat" or ""), and are otherwise ignored.

$SYSTEMD_LESS

Users might want to change two options in particular:

K

If the value of $SYSTEMD_LESS does not include "K", and the pager that is invoked is less, Ctrl+C will be ignored by the executable, and needs to be handled by the pager.

X

Note that setting the regular $LESS environment variable has no effect for less invocations by systemd tools.

See less(1) for more discussion.

$SYSTEMD_LESSCHARSET

Note that setting the regular $LESSCHARSET environment variable has no effect for less invocations by systemd tools.

$SYSTEMD_PAGERSECURE

This option takes a boolean argument. When set to true, the "secure mode" of the pager is enabled. In "secure mode", LESSSECURE=1 will be set when invoking the pager, which instructs the pager to disable commands that open or create new files or start new subprocesses. Currently only less(1) is known to understand this variable and implement "secure mode".

When set to false, no limitation is placed on the pager. Setting SYSTEMD_PAGERSECURE=0 or not removing it from the inherited environment may allow the user to invoke arbitrary commands.

When $SYSTEMD_PAGERSECURE is not set, systemd tools attempt to automatically figure out if "secure mode" should be enabled and whether the pager supports it. "Secure mode" is enabled if the effective UID is not the same as the owner of the login session, see geteuid(2) and sd_pid_get_owner_uid(3), or when running under sudo(8) or similar tools ($SUDO_UID is set [8]). In those cases, SYSTEMD_PAGERSECURE=1 will be set and pagers which are not known to implement "secure mode" will not be used at all. Note that this autodetection only covers the most common mechanisms to elevate privileges and is intended as convenience. It is recommended to explicitly set $SYSTEMD_PAGERSECURE or disable the pager.

Note that if the $SYSTEMD_PAGER or $PAGER variables are to be honoured, other than to disable the pager, $SYSTEMD_PAGERSECURE must be set too.

$SYSTEMD_COLORS

$SYSTEMD_URLIFY

EXAMPLES#

Without arguments, all collected logs are shown unfiltered:

journalctl

With one match specified, all entries with a field matching the expression are shown:

journalctl _SYSTEMD_UNIT=avahi-daemon.service
journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope

If two different fields are matched, only entries matching both expressions at the same time are shown:

journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097

If two matches refer to the same field, all entries matching either expression are shown:

journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service

If the separator "+" is used, two expressions may be combined in a logical OR. The following will show all messages from the Avahi service process with the PID 28097 plus all messages from the D-Bus service (from any of its processes):

journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service

To show all fields emitted by a unit and about the unit, option -u/--unit= should be used. journalctl -uname expands to a complex filter similar to

_SYSTEMD_UNIT=\nname\n.service
\n
  + UNIT=\nname\n.service _PID=1
\n
  + OBJECT_SYSTEMD_UNIT=\nname\n.service _UID=0
\n
  + COREDUMP_UNIT=\nname\n.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1

(see systemd.journal-fields(7) for an explanation of those patterns).

Show all logs generated by the D-Bus executable:

journalctl /usr/bin/dbus-daemon

Show all kernel logs from previous boot:

journalctl -k -b -1

Show a live log display from a system service apache.service:

journalctl -f -u apache

SEE ALSO#

systemd(1), systemd-cat(1), systemd-journald.service(8), systemctl(1), coredumpctl(1), systemd.journal-fields(7), journald.conf(5), systemd.time(7), systemd-journal-remote.service(8), systemd-journal-upload.service(8)

NOTES#

1.

Discoverable Partitions Specification

2.

RFC 3339

3.

Journal Export Format

4.

Journal JSON Format

5.

Server-Sent Events

6.

JavaScript Object Notation (JSON) Text Sequences

7.

Journal Message Catalogs

8.

It is recommended for other tools to set and check $SUDO_UID as appropriate, treating it is a common interface.