systemd-journalctl(1) [debian man page]

SYSTEMD-JOURNALCTL(1)						systemd-journalctl					     SYSTEMD-JOURNALCTL(1)

NAME

       systemd-journalctl - Query the systemd journal

SYNOPSIS

       systemd-journalctl [OPTIONS...] [MATCH]

DESCRIPTION

       systemd-journalctl may be used to query the contents of the systemd(1) journal.

       If called without parameter will show the full contents of the journal, starting with the oldest entry collected.

       If a match argument is passed the output is filtered accordingly. A match is in the format FIELD=VALUE, e.g.  _SYSTEMD_UNIT=httpd.service.

       Output is interleaved from all accessible journal files, whether they are rotated or currently being written, and regardless whether they
       belong to the system itself or are accessible user journals.

       All users are granted access to their private per-user journals. However, by default only root and users who are members of the adm group
       get access to the system journal and the journals of other users.

OPTIONS

       The following options are understood:

       --help, -h
	   Prints a short help text and exits.

       --version
	   Prints a short version string and exits.

       --no-pager
	   Do not pipe output into a pager.

       --all, -a
	   Show all fields in full, even if they include unprintable characters or are very long.

       --follow, -f
	   Show only most recent journal entries, and continously print new entries as they are appended to the journal.

       --lines=, -n
	   Controls the number of journal lines to show, counting from the most recent ones. Takes a positive integer argument. In follow mode
	   defaults to 10, otherwise is unset thus not limiting how many lines are shown.

       --no-tail
	   Show all stored output lines, even in follow mode. Undoes the effect of --lines=.

       --output=, -o
	   Controls the formatting of the journal entries that are shown. Takes one of short, short-monotonic, verbose, export, json, cat.  short
	   is the default and generates an output that is mostly identical to the formatting of classic syslog log files, showing one line per
	   journal entry.  short-monotonic is very similar but shows monotonic timestamps instead of wallclock timestamps.  verbose shows the full
	   structered entry items with all fiels.  export serializes the journal into a binary (but mostly text-based) stream suitable for backups
	   and network transfer.  json formats entries as JSON data structures.  cat generates a very terse output only showing the actual message
	   of each journal entry with no meta data, not even a timestamp.

       --quiet, -q
	   Suppresses any warning message regarding inaccessable system journals when run as normal user.

       --new-id128
	   Instead of showing journal contents generate a new 128 bit ID suitable for identifying messages. This is intended for usage by
	   developers who need a new identifier for a new message they introduce and want to make recognizable. Will print the new ID in three
	   different formats which can be copied into source code or similar.

EXIT STATUS

       On success 0 is returned, a non-zero failure code otherwise.

ENVIRONMENT

       $SYSTEMD_PAGER
	   Pager to use when --no-pager is not given; overrides $PAGER. Setting this to an empty string or the value cat is equivalent to passing
	   --no-pager.

SEE ALSO

       systemd(1), systemctl(1), systemd-journald.conf(5)

AUTHOR

       Lennart Poettering <lennart@poettering.net>
	   Developer

systemd 							    10/07/2013						     SYSTEMD-JOURNALCTL(1)

SYSTEMD-JOURNALD.SERVICE(8)				     systemd-journald.service				       SYSTEMD-JOURNALD.SERVICE(8)

NAME

       systemd-journald.service, systemd-journald.socket, systemd-journald - Journal service

SYNOPSIS

       systemd-journald.service

       systemd-journald.socket

       /usr/lib/systemd/systemd-journald

DESCRIPTION

       systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on
       logging information that is received from the kernel, from user processes via the libc syslog(3) call, from STDOUT/STDERR of system
       services or via its native API. It will implicitly collect numerous meta data fields for each log messages in a secure and unfakeable way.
       See systemd.journal-fields(7) for more information about the collected meta data.

       Log data collected by the journal is primarily text-based but can also include binary data where necessary. All objects stored in the
       journal can be up to 2^64-1 bytes in size.

       By default, the journal stores log data in /run/log/journal/. Since /run/ is volatile, log data is lost at reboot. To make the data
       persistent, it is sufficient to create /var/log/journal/ where systemd-journald will then store the data.

       systemd-journald will forward all received log messages to the AF_UNIXSOCK_DGRAM socket /run/systemd/journal/syslog, if it exists, which
       may be used by Unix syslog daemons to process the data further.

       See journald.conf(5) for information about the configuration of this service.

SIGNALS

       SIGUSR1
	   Request that journal data from /run/ is flushed to /var/ in order to make it persistent (if this is enabled). This must be used after
	   /var/ is mounted, as otherwise log data from /run is never flushed to /var regardless of the configuration.

       SIGUSR2
	   Request immediate rotation of the journal files.

KERNEL COMMAND LINE

       A few configuration parameters from journald.conf may be overridden on the kernel command line:

       systemd.journald.forward_to_syslog=, systemd.journald.forward_to_kmsg=, systemd.journald.forward_to_console=
	   Enables/disables forwarding of collected log messages to syslog, the kernel log buffer or the system console.

	   See journald.conf(5) for information about these settings.

ACCESS CONTROL

       Journal files are, by default, owned and readable by the "systemd-journal" system group but are not writable. Adding a user to this group
       thus enables her/him to read the journal files.

       By default, each logged in user will get her/his own set of journal files in /var/log/journal/. These files will not be owned by the user,
       however, in order to avoid that the user can write to them directly. Instead, file system ACLs are used to ensure the user gets read access
       only.

       Additional users and groups may be granted access to journal files via file system access control lists (ACL). Distributions and
       administrators may choose to grant read access to all members of the "wheel" and "adm" system groups with a command such as the following:

	   # setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/

       Note that this command will update the ACLs both for existing journal files and for future journal files created in the /var/log/journal/
       directory.

FILES

       /etc/systemd/journald.conf
	   Configure systemd-journald behaviour. See journald.conf(5).

       /run/log/journal/machine-id/*.journal, /run/log/journal/machine-id/*.journal~, /var/log/journal/machine-id/*.journal,
       /var/log/journal/machine-id/*.journal~
	   systemd-journald writes entries to files in /run/log/journal/machine-id/ or /var/log/journal/machine-id/ with the ".journal" suffix. If
	   the daemon is stopped uncleanly, or if the files are found to be corrupted, they are renamed using the ".journal~" suffix, and
	   systemd-journald starts writing to a new file.  /run is used when /var/log/journal is not available, or when Storage=volatile is set in
	   the journald.conf(5) configuration file.

SEE ALSO

       systemd(1), journalctl(1), journald.conf(5), systemd.journal-fields(7), sd-journal(3), setfacl(1), pydoc systemd.journal.

systemd 208													       SYSTEMD-JOURNALD.SERVICE(8)