585 lines
29 KiB
XML
585 lines
29 KiB
XML
<?xml version='1.0'?> <!--*-nxml-*-->
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
|
|
|
<!--
|
|
This file is part of systemd.
|
|
|
|
Copyright 2012 Lennart Poettering
|
|
|
|
systemd is free software; you can redistribute it and/or modify it
|
|
under the terms of the GNU Lesser General Public License as published by
|
|
the Free Software Foundation; either version 2.1 of the License, or
|
|
(at your option) any later version.
|
|
|
|
systemd is distributed in the hope that it will be useful, but
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public License
|
|
along with systemd; If not, see <http://www.gnu.org/licenses/>.
|
|
-->
|
|
|
|
<refentry id="journalctl">
|
|
|
|
<refentryinfo>
|
|
<title>journalctl</title>
|
|
<productname>systemd</productname>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<contrib>Developer</contrib>
|
|
<firstname>Lennart</firstname>
|
|
<surname>Poettering</surname>
|
|
<email>lennart@poettering.net</email>
|
|
</author>
|
|
</authorgroup>
|
|
</refentryinfo>
|
|
|
|
<refmeta>
|
|
<refentrytitle>journalctl</refentrytitle>
|
|
<manvolnum>1</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>journalctl</refname>
|
|
<refpurpose>Query the systemd journal</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>journalctl <arg choice="opt" rep="repeat">OPTIONS</arg> <arg choice="opt" rep="repeat">MATCHES</arg></command>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para><command>journalctl</command> may be used to
|
|
query the contents of the
|
|
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
|
|
journal as written by
|
|
<citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
|
|
|
|
<para>If called without parameter it will show the full
|
|
contents of the journal, starting with the oldest
|
|
entry collected.</para>
|
|
|
|
<para>If one or more match arguments are passed the
|
|
output is filtered accordingly. A match is in the
|
|
format <literal>FIELD=VALUE</literal>,
|
|
e.g. <literal>_SYSTEMD_UNIT=httpd.service</literal>,
|
|
referring to the components of a structured journal
|
|
entry. See
|
|
<citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
|
|
for a list of well-known fields. If multiple matches
|
|
are specified matching different fields the log
|
|
entries are filtered by both, i.e. the resulting output
|
|
will show only entries matching all the specified
|
|
matches of this kind. If two matches apply to the same
|
|
field, then they are automatically matched as
|
|
alternatives, i.e. the resulting output will show
|
|
entries matching any of the specified matches for the
|
|
same field. Finally, if the character
|
|
"<literal>+</literal>" appears as separate word on the
|
|
command line all matches before and after are combined
|
|
in a disjunction (i.e. logical OR).</para>
|
|
|
|
<para>As shortcuts for a few types of field/value
|
|
matches file paths may be specified. If a file path
|
|
refers to an executable file, this is equivalent to an
|
|
<literal>_EXE=</literal> match for the canonicalized
|
|
binary path. Similar, if a path refers to a device
|
|
node, this is equivalent to a
|
|
<literal>_KERNEL_DEVICE=</literal> match for the
|
|
device.</para>
|
|
|
|
<para>Output is interleaved from all accessible
|
|
journal files, whether they are rotated or currently
|
|
being written, and regardless whether they belong to the
|
|
system itself or are accessible user journals.</para>
|
|
|
|
<para>All users are granted access to their private
|
|
per-user journals. However, by default only root and
|
|
users who are members of the <literal>adm</literal>
|
|
group get access to the system journal and the
|
|
journals of other users.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Options</title>
|
|
|
|
<para>The following options are understood:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><option>--help</option></term>
|
|
<term><option>-h</option></term>
|
|
|
|
<listitem><para>Prints a short help
|
|
text and exits.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--version</option></term>
|
|
|
|
<listitem><para>Prints a short version
|
|
string and exits.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--no-pager</option></term>
|
|
|
|
<listitem><para>Do not pipe output into a
|
|
pager.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--full</option></term>
|
|
|
|
<listitem><para>Show all (printable) fields in
|
|
full.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--all</option></term>
|
|
<term><option>-a</option></term>
|
|
|
|
<listitem><para>Show all fields in
|
|
full, even if they include unprintable
|
|
characters or are very
|
|
long.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--follow</option></term>
|
|
<term><option>-f</option></term>
|
|
|
|
<listitem><para>Show only the most recent
|
|
journal entries, and continuously print
|
|
new entries as they are appended to
|
|
the journal.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--lines=</option></term>
|
|
<term><option>-n</option></term>
|
|
|
|
<listitem><para>Show the most recent
|
|
journal events and limit the number of
|
|
events shown. If
|
|
<option>--follow</option> is used,
|
|
this option is implied. The argument,
|
|
a positive integer, is optional, and
|
|
defaults to 10. </para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--no-tail</option></term>
|
|
|
|
<listitem><para>Show all stored output
|
|
lines, even in follow mode. Undoes the
|
|
effect of
|
|
<option>--lines=</option>.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--output=</option></term>
|
|
<term><option>-o</option></term>
|
|
|
|
<listitem><para>Controls the
|
|
formatting of the journal entries that
|
|
are shown. Takes one of
|
|
<literal>short</literal>,
|
|
<literal>short-monotonic</literal>,
|
|
<literal>verbose</literal>,
|
|
<literal>export</literal>,
|
|
<literal>json</literal>,
|
|
<literal>json-pretty</literal>,
|
|
<literal>json-sse</literal>,
|
|
<literal>cat</literal>. <literal>short</literal>
|
|
is the default and generates an output
|
|
that is mostly identical to the
|
|
formatting of classic syslog log
|
|
files, showing one line per journal
|
|
entry. <literal>short-monotonic</literal>
|
|
is very similar but shows monotonic
|
|
timestamps instead of wallclock
|
|
timestamps. <literal>verbose</literal>
|
|
shows the full structured entry items
|
|
with all
|
|
fields. <literal>export</literal>
|
|
serializes the journal into a binary
|
|
(but mostly text-based) stream
|
|
suitable for backups and network
|
|
transfer (see <ulink
|
|
url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
|
|
Export Format</ulink> for more
|
|
information). <literal>json</literal>
|
|
formats entries as JSON data
|
|
structures, one per
|
|
line (see <ulink
|
|
url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
|
|
JSON Format</ulink> for more
|
|
information). <literal>json-pretty</literal>
|
|
also formats entries as JSON data
|
|
structures, but formats them in
|
|
multiple lines in order to make them
|
|
more readable for
|
|
humans. <literal>json-sse</literal>
|
|
also formats entries as JSON data
|
|
structures, but wraps them in a format
|
|
suitable for <ulink
|
|
url="https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events">Server-Sent
|
|
Events</ulink>. <literal>cat</literal>
|
|
generates a very terse output only
|
|
showing the actual message of each
|
|
journal entry with no meta data, not
|
|
even a timestamp.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--catalog</option></term>
|
|
<term><option>-x</option></term>
|
|
|
|
<listitem><para>Augment log lines with
|
|
explanation texts from the message
|
|
catalog. This will add explanatory
|
|
help texts to log messages in the
|
|
output where this is available. These
|
|
short help texts will explain the
|
|
context of an error or log event,
|
|
possible solutions, as well as
|
|
pointers to support forums, developer
|
|
documentation and any other relevant
|
|
manuals. Note that help texts are not
|
|
available for all messages, but only
|
|
for selected ones. For more
|
|
information on the message catalog
|
|
please refer to the <ulink
|
|
url="http://www.freedesktop.org/wiki/Software/systemd/catalog">Message
|
|
Catalog Developer
|
|
Documentation</ulink>.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--quiet</option></term>
|
|
<term><option>-q</option></term>
|
|
|
|
<listitem><para>Suppresses any warning
|
|
message regarding inaccessible system
|
|
journals when run as normal
|
|
user.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--merge</option></term>
|
|
<term><option>-m</option></term>
|
|
|
|
<listitem><para>Show entries
|
|
interleaved from all available
|
|
journals, including remote
|
|
ones.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--this-boot</option></term>
|
|
<term><option>-b</option></term>
|
|
|
|
<listitem><para>Show data only from
|
|
current boot. This will add a match
|
|
for <literal>_BOOT_ID=</literal> for
|
|
the current boot ID of the
|
|
kernel.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--unit=</option></term>
|
|
<term><option>-u</option></term>
|
|
|
|
<listitem><para>Show data only of the
|
|
specified unit. This will add a match
|
|
for <literal>_SYSTEMD_UNIT=</literal>
|
|
for the specified
|
|
unit.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-p</option></term>
|
|
<term><option>--priority=</option></term>
|
|
|
|
<listitem><para>Filter output by
|
|
message priorities or priority
|
|
ranges. Takes either a single numeric
|
|
or textual log level (i.e. between
|
|
0/<literal>emerg</literal> and
|
|
7/<literal>debug</literal>), or a
|
|
range of numeric/text log levels in
|
|
the form FROM..TO. The log levels are
|
|
the usual syslog log levels as
|
|
documented in
|
|
<citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
|
|
i.e. <literal>emerg</literal> (0),
|
|
<literal>alert</literal> (1),
|
|
<literal>crit</literal> (2),
|
|
<literal>err</literal> (3),
|
|
<literal>warning</literal> (4),
|
|
<literal>notice</literal> (5),
|
|
<literal>info</literal> (6),
|
|
<literal>debug</literal> (7). If a
|
|
single log level is specified all
|
|
messages with this log level or a
|
|
lower (hence more important) log level
|
|
are shown. If a range is specified all
|
|
messages within the range are shown,
|
|
including both the start and the end
|
|
value of the range. This will add
|
|
<literal>PRIORITY=</literal> matches
|
|
for the specified
|
|
priorities.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--cursor=</option></term>
|
|
<term><option>-c</option></term>
|
|
|
|
<listitem><para>Start showing entries
|
|
from the location in the journal
|
|
specified by the passed
|
|
cursor.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--since=</option></term>
|
|
<term><option>--until=</option></term>
|
|
|
|
<listitem><para>Start showing entries
|
|
on or newer than the specified date,
|
|
or on or older than the specified
|
|
date, respectively. Date specifications should be of
|
|
the format "2012-10-30 18:17:16". If
|
|
the time part is omitted, 00:00:00 is
|
|
assumed. If only the seconds component
|
|
is omitted, :00 is assumed. If the
|
|
date component is omitted, the
|
|
current day is assumed. Alternatively
|
|
the strings
|
|
<literal>yesterday</literal>,
|
|
<literal>today</literal>,
|
|
<literal>tomorrow</literal> are
|
|
understood, which refer to 00:00:00 of
|
|
the day before the current day, the
|
|
current day, or the day after the
|
|
current day, respectively. <literal>now</literal>
|
|
refers to the current time. Finally,
|
|
relative times may be specified,
|
|
prefixed with <literal>-</literal> or
|
|
<literal>+</literal>, referring to
|
|
times before or after the current
|
|
time, respectively.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--field=</option></term>
|
|
<term><option>-F</option></term>
|
|
|
|
<listitem><para>Print all possible
|
|
data values the specified field can
|
|
take in all entries of the
|
|
journal.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--directory=</option></term>
|
|
<term><option>-D</option></term>
|
|
|
|
<listitem><para>Takes an absolute
|
|
directory path as argument. If
|
|
specified journalctl will operate on the
|
|
specified journal directory instead of
|
|
the default runtime and system journal
|
|
paths.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--new-id128</option></term>
|
|
|
|
<listitem><para>Instead of showing
|
|
journal contents generate a new 128
|
|
bit ID suitable for identifying
|
|
messages. This is intended for usage
|
|
by developers who need a new
|
|
identifier for a new message they
|
|
introduce and want to make
|
|
recognizable. Will print the new ID in
|
|
three different formats which can be
|
|
copied into source code or
|
|
similar.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--header</option></term>
|
|
|
|
<listitem><para>Instead of showing
|
|
journal contents show internal header
|
|
information of the journal fields
|
|
accessed.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--disk-usage</option></term>
|
|
|
|
<listitem><para>Shows the current disk
|
|
usage of all
|
|
journal files.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--list-catalog</option></term>
|
|
|
|
<listitem><para>List the contents of
|
|
the message catalog, as table of
|
|
message IDs plus their short
|
|
description strings.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--update-catalog</option></term>
|
|
|
|
<listitem><para>Update the message
|
|
catalog index. This command needs to
|
|
be executed each time new catalog
|
|
files are installed, removed or
|
|
updated to rebuild the binary catalog
|
|
index.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--setup-keys</option></term>
|
|
|
|
<listitem><para>Instead of showing
|
|
journal contents generate a new key
|
|
pair for Forward Secure Sealing
|
|
(FSS). This will generate a sealing
|
|
key and a verification key. The
|
|
sealing key is stored in the journal
|
|
data directory and shall remain on the
|
|
host. The verification key should be
|
|
stored externally.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--interval=</option></term>
|
|
|
|
<listitem><para>Specifies the change
|
|
interval for the sealing key, when
|
|
generating an FSS key pair with
|
|
<option>--setup-keys</option>. Shorter
|
|
intervals increase CPU consumption but
|
|
shorten the time range of
|
|
undetectable journal
|
|
alterations. Defaults to
|
|
15min.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--verify</option></term>
|
|
|
|
<listitem><para>Check the journal file
|
|
for internal consistency. If the
|
|
file has been generated with FSS
|
|
enabled, and the FSS verification key
|
|
has been specified with
|
|
<option>--verify-key=</option>
|
|
authenticity of the journal file is
|
|
verified.</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--verify-key=</option></term>
|
|
|
|
<listitem><para>Specifies the FSS
|
|
verification key to use for the
|
|
<option>--verify</option>
|
|
operation.</para></listitem>
|
|
</varlistentry>
|
|
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Exit status</title>
|
|
|
|
<para>On success 0 is returned, a non-zero failure
|
|
code otherwise.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Environment</title>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><varname>$SYSTEMD_PAGER</varname></term>
|
|
<listitem><para>Pager to use when
|
|
<option>--no-pager</option> is not given;
|
|
overrides <varname>$PAGER</varname>. Setting
|
|
this to an empty string or the value
|
|
<literal>cat</literal> is equivalent to passing
|
|
<option>--no-pager</option>.</para></listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Examples</title>
|
|
|
|
<para>Without arguments all collected logs are shown
|
|
unfiltered:</para>
|
|
|
|
<programlisting>journalctl</programlisting>
|
|
|
|
<para>With one match specified all entries with a field matching the expression are shown:</para>
|
|
|
|
<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service</programlisting>
|
|
|
|
<para>If two different fields are matched only entries matching both expressions at the same time are shown:</para>
|
|
|
|
<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097</programlisting>
|
|
|
|
<para>If two matches refer to the same field all entries matching either expression are shown:</para>
|
|
|
|
<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</programlisting>
|
|
|
|
<para>If the separator "<literal>+</literal>" is used
|
|
two expressions may be combined in a logical OR. The
|
|
following will show all messages from the Avahi
|
|
service process with the PID 28097 plus all messages
|
|
from the D-Bus service (from any of its
|
|
processes):</para>
|
|
|
|
<programlisting>journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service</programlisting>
|
|
|
|
<para>Show all logs generated by the D-Bus executable:</para>
|
|
|
|
<programlisting>journalctl /usr/bin/dbus-daemon</programlisting>
|
|
|
|
<para>Show all logs of the kernel device node <filename>/dev/sda</filename>:</para>
|
|
|
|
<programlisting>journalctl /dev/sda</programlisting>
|
|
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See Also</title>
|
|
<para>
|
|
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
|
|
<citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
|
<citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
|
|
<citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
|
|
<citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
|
</para>
|
|
</refsect1>
|
|
|
|
</refentry>
|