Query the systemd journal
journalctl --system {system} --user {user} -M {machine} -m {merge} -D {directory} 📎 system 📎 user 📎 machine 📎 merge 📎 directory journalctl --system {system} --user {user} -M {machine} -m {merge} -D {directory}Sandbox: execFile · Timeout: 30s
system.service.journalctl | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
system | string | No | - | Show the system journal | --system |
user | string | No | - | Show the user journal for the current user | --user |
machine | string | No | - | Operate on local container | -M, --machine |
merge | string | No | - | Show entries from all available journals | -m, --merge |
directory | file | No | - | Show journal files from directory | -D, --directory |
file | file | No | - | Show journal file | -i, --file |
root | file | No | - | Operate on an alternate filesystem root | --root |
image | file | No | - | Operate on disk image as filesystem root | --image |
image-policy | string | No | - | Specify disk image dissection policy | --image-policy |
namespace | string | No | - | Show journal data from specified journal namespace | --namespace |
since | string | No | - | Show entries not older than the specified date | -S, --since |
until | string | No | - | Show entries not newer than the specified date | -U, --until |
cursor | string | No | - | Show entries starting at the specified cursor | -c, --cursor |
after-cursor | string | No | - | Show entries after the specified cursor | --after-cursor |
cursor-file | file | No | - | Show entries after cursor in FILE and update FILE | --cursor-file |
boot | string | No | - | Show current boot or the specified boot | -b, --boot |
unit | string | No | - | Show logs from the specified unit | -u, --unit |
user-unit | string | No | - | Show logs from the specified user unit | --user-unit |
invocation | string | No | - | Show logs from the matching invocation ID | --invocation |
identifier | string | No | - | Show entries with the specified syslog identifier | -t, --identifier |
exclude-identifier | string | No | - | Hide entries with the specified syslog identifier | -T, --exclude-identifier |
priority | integer | No | - | Show entries within the specified priority range | -p, --priority |
facility | string | No | - | Set the facility parameter | --facility |
grep | string | No | - | Show entries with MESSAGE matching PATTERN | -g, --grep |
case-sensitive | string | No | - | Set the case-sensitive parameter | --case-sensitive |
dmesg | string | No | - | Show kernel message log from the current boot | -k, --dmesg |
output | string | No | - | Change journal output mode (short, short-precise | -o, --output |
output-fields | array | No | - | Select fields to print in verbose/export/json modes | --output-fields |
lines | integer | No | - | Number of journal entries to show | -n, --lines |
reverse | string | No | - | Show the newest entries first | -r, --reverse |
all | string | No | - | Show all fields, including long and unprintable | -a, --all |
catalog | string | No | - | Add message explanations where available | -x, --catalog |
disk-usage | string | No | - | Show total disk usage of all journal files | --disk-usage |
dump_catalog | boolean | No | - | Show entries in the message catalog | --dump-catalog |
field | string | No | - | List all values that a specified field takes | -F, --field |
fields | string | No | - | List all field names currently used | -N, --fields |
follow | string | No | - | Follow the journal | -f, --follow |
force | string | No | - | Override of the FSS key pair with --setup-keys | --force |
help | string | No | - | Show this help text | -h, --help |
interval | number | No | - | Time interval for changing the FSS sealing key | --interval |
list-boots | string | No | - | Show terse information about recorded boots | --list-boots |
list-invocations | string | No | - | Show invocation IDs of specified unit | --list-invocations |
list-namespaces | array | No | - | Show list of journal namespaces | --list-namespaces |
list_catalog | boolean | No | - | Show all message IDs in the catalog | --list-catalog |
no-full | string | No | - | Ellipsize fields | --no-full |
no-hostname | string | No | - | Suppress output of hostname field | -W, --no-hostname |
no-pager | string | No | - | Do not pipe output into a pager | --no-pager |
no-tail | string | No | - | Show all lines, even in follow mode | --no-tail |
pager-end | string | No | - | Immediately jump to the end in the pager | -e, --pager-end |
quiet | string | No | - | Do not show info messages and privilege warning | -q, --quiet |
relinquish-var | string | No | - | Stop logging to disk, log to temporary file system | --relinquish-var |
setup_keys | boolean | No | - | Generate a new FSS key pair | --setup-keys |
show-cursor | string | No | - | Print the cursor after all the entries | --show-cursor |
smart-relinquish-var | string | No | - | --flush Flush all journal data from /run into /var --rotate Request immediate rotation of the journal files --header Show journal header information --list-catalog Show all message IDs in the catalog --dump-catalog Show entries in the message catalog --update-catalog Update the message catalog database --setup-keys Generate a new FSS key pair | --smart-relinquish-var |
sync | string | No | - | Synchronize unwritten journal messages to disk | --sync |
synchronize-on-exit | string | No | - | Wait for Journal synchronization before exiting | --synchronize-on-exit |
truncate-newline | string | No | - | Truncate entries by first newline character | --truncate-newline |
update_catalog | boolean | No | - | Update the message catalog database | --update-catalog |
utc | string | No | - | Express time in Coordinated Universal Time (UTC) | --utc |
vacuum-files | integer | No | - | Leave only the specified number of journal files | --vacuum-files |
vacuum-size | integer | No | - | Reduce disk usage below specified size | --vacuum-size |
vacuum-time | number | No | - | Remove journal files older than specified time | --vacuum-time |
verify | string | No | - | Verify journal file consistency | --verify |
verify-key | string | No | - | Specify FSS verification key | --verify-key |
version | string | No | - | Show package version | --version |
Basic usage with system
journalctl ${system}Display help message
journalctl --helpjournalctl is a command-line utility for query the systemd journal.
journalctl --system {system} --user {user} -M {machine} -m {merge} -D {directory}