JOURNALCTL(1) journalctl JOURNALCTL(1) journalctl - systemd journalctl [...] [...] journalctl systemd-journald.service(8) systemd-journal-remote.service(8). . . "FIELD=VALUE" "_SYSTEMD_UNIT=httpd.service" . systemd.journal-fields(7) . . . "+" . ( OR ). . . "_EXE=" . "_COMM=" . "_KERNEL_DEVICE=" . . . . . --boot --unit= (AND ). . --header . --user --system --directory= --file= . . (root) . "systemd-journal" "adm" "wheel" . . "wheel" . less . . --no-pager "Environment" . tty : ERROR WARNING NOTICE INFO DEBUG . . systemd systemd-journald.service(8). systemd-cat(1) . : --system --user ( --system). ( --user). . --user --unit=. --unit=. --user Storage= journald.conf(5). 205. -M --machine= . . 209. -m --merge . 190. -D --directory= . journalctl DIR . 187. -i GLOB --file=GLOB (glob) . journalctl GLOB . . 205. --root= . journalctl ( --update-catalog ROOT/var/lib/systemd/catalog/database ROOT/run/journal/ ROOT/var/log/journal/). 201. --image=IMAGE . journalctl . --root= . GPT UAPI.2 Discoverable Partitions Specification[1]. systemd-nspawn(1) . 247. --image-policy= systemd.image-policy(7). --image= . "*" . --namespace=_ . . . "*" . "+" . systemd-journald.service(8). 245. : -S --since= -U --until= . "2012-10-30 18:17:16". "00:00:00". "00:". . "yesterday" "today" "tomorrow" 00:00:00 . "now" . "-" "+" . systemd.time(7). --output=short-full . 195. -c --cursor= (cursor) . 193. --after-cursor= . --show-cursor. 206. --cursor-file=FILE FILE . . FILE. journalctl . 242. -b [[][+-]|all] --boot[=[][+-]|all] . "_BOOT_ID=". . offset offset . 1 2 -0 -1 . offset -0 ( --directory= ). ID 32 offset ID . . offset ID. all -b. 186. -u --unit=| systemd UNIT ( ) PATTERN. . ("_SYSTEMD_UNIT=UNIT") systemd (coredumps) . "_SYSTEMD_SLICE=UNIT" UNIT systemd.slice(5) (slice). --user --unit= --user-unit=. . 195. --user-unit= . ("_SYSTEMD_USER_UNIT=" "_UID=") systemd (coredumps) . "_SYSTEMD_USER_SLICE=UNIT" UNIT systemd.slice(5) . . 198. -I --invocation=ID[+-offset]|offset . "_SYSTEMD_INVOCATION_ID=" "OBJECT_SYSTEMD_INVOCATION_ID=" "INVOCATION_ID=" "USER_INVOCATION_ID=". offset systemd . 1 2 0 -1 . ID 32 +-offset ID . . +-offset ID. -I --invocation=0 . -u/--unit= --user-unit=. -b/--boot= . 257. -t --identifier=__ syslog SYSLOG_IDENTIFIER. . 217. -T --exclude-identifier=SYSLOG_IDENTIFIER syslog SYSLOG_IDENTIFIER. . 256. -p --priority= . ( 0/"emerg" 7/"debug") / FROM..TO. syslog syslog(3) : "emerg" (0) "alert" (1) "crit" (2) "err" (3) "warning" (4) "notice" (5) "info" (6) "debug" (7). ( ). . "PRIORITY=" . 188. --facility= syslog. . syslog syslog(3). --facility=help . 245. -g --grep= MESSAGE= . PERL pcre2pattern(3) . . . --case-sensitive . --lines= ( "+") --reverse . 237. --case-sensitive[=BOOLEAN] . 237. -k --dmesg . "_TRANSPORT=kernel". --boot=0 . 205. : -o --output= . : short syslog . 206. short-full --since= --until=. short . 232. short-iso RFC 3339[2] ISO 8601. 206. short-iso-precise short-iso . 234. short-precise syslog . 207. short-monotonic . 206. short-delta short-monotonic . "*". 252. short-unix 1 1970 (" "). . 230. verbose . 206. export ( ) ( [3] ). journald systemd-journal-remote(8). 206. json JSON ( JSON [4] ). JSON : 1. 4096 null. ( --all JSON .) 2. . JSON . JSON . 3. UTF8 . ( ). 206. json-pretty JSON . 206. json-sse JSON [5]. 206. json-seq JSON ASCII (0x1E) ASCII (0x0A) (JSON) [6] ("application/json-seq"). 240. cat . --output-fields= . 206. with-unit short-full syslog . . 239. --truncate-newline . 254. --output-fields= . (verbose export json json-pretty json-sse json-seq) cat. "__CURSOR" "__REALTIME_TIMESTAMP" "__MONOTONIC_TIMESTAMP" "_BOOT_ID". 236. -n --lines= . "all" . "+" . 10 . --follow . "+" --grep --reverse . -r --reverse . 198. --show-cursor : -- cursor: s=0639... . 209. --utc (UTC). 217. -x --catalog . . . . [7]. : journalctl -x. 196. -W --no-hostname . short ( ). : . 230. --no-full --full -l () . . -l/--full --no-full. 196. -a --all . " " (blob data). ( .) -f --follow Ctrl-C ( ). journalctl sd_notify(3) "READY=1" . --no-tail . --lines=. -q --quiet ( "-- Journal begins at ..." "-- Reboot --") . --synchronize-on-exit= . --follow ( journalctl --sync) SIGTERM/SIGINT . SIGTERM/SIGINT . (false). 258. : --no-pager (pager). -e --pager-end . --lines=1000 --boot=0 . less(1). 198. (FSS) --setup-keys : --interval= FSS --setup-keys. . 15 . --output=json-sse --output=json-seq --output=json. 189. --verify-key= FSS --verify. 189. --force --setup-keys (FSS) FSS. 206. . : -N --fields . 229. -F --field= . 195. --list-boots ( ) . -n/--lines=[+]N N ( "+") N ( ). -r/--reverse . 209. --list-invocations . -u/--unit= --user-unit=. ( ) . -b/-boot . -n/--lines=[+]N N ( "+") N ( ). -r/--reverse . 257. --disk-usage . . 190. --vacuum-size= --vacuum-time= --vacuum-files= --vacuum-size= . "K" "M" "G" "T" ( 1024). --vacuum-time= . "s" () "m" "h" "days" "weeks" "months" "years" systemd.time(7) . --vacuum-files= . --vacuum-size= --disk-usage . --vacuum-files= . --vacuum-size= --vacuum-time= --vacuum-files= . . --rotate . . ( ) . 218. --verify . FSS FSS --verify-key= . 189. --sync . . . 228. --relinquish-var --flush: /run/log/journal/ /var/log/journal/. --flush /var/log/journal/ . 243. --smart-relinquish-var --relinquish-var /var/log/journal/ . /var/log/journal/ . 243. --flush /run/log/journal/ /var/log/journal/ . . : /run/log/journal/ /var/log/journal/ ( --relinquish-var ) . /var/log/journal/ . 217. --rotate . . . () . --vacuum-size= --vacuum-time= --vacuum-file= . 227. --header . . 187. --list-catalog [128-bit-ID...] . 128-bit-IDs . 196. --dump-catalog [128-bit-ID...] ( .catalog). 128-bit-IDs . 199. --update-catalog . . 196. --setup-keys (FSS). . . . Seal= journald.conf(5) . 189. -h --help . --version . 0 . $SYSTEMD_LOG_LEVEL ( ). . ( ) emerg alert crit err warning notice info debug 0 7. syslog(3) . console syslog kmsg journal (: SYSTEMD_LOG_LEVEL=debug,console:info debug info). . $SYSTEMD_LOG_COLOR . tty . journalctl(1) . $SYSTEMD_LOG_TIME . . journalctl(1) . $SYSTEMD_LOG_LOCATION . . . . $SYSTEMD_LOG_TID . (TID). . . $SYSTEMD_LOG_TARGET . : console ( ) console-prefixed ( "" syslog(3) kmsg ( ) journal ( ) journal-or-kmsg ( kmsg ) auto ( ) null ( ). $SYSTEMD_LOG_RATELIMIT_KMSG kmsg . . "true". systemd kmsg. $SYSTEMD_PAGER $PAGER --no-pager. $SYSTEMD_PAGER $PAGER. $SYSTEMD_PAGER $PAGER less(1) more(1) . . "cat" --no-pager. : $SYSTEMD_PAGERSECURE $SYSTEMD_PAGER $PAGER ( "cat" "") . $SYSTEMD_LESS less ( "FRSXMK"). : K Ctrl+C. less Ctrl+C . $SYSTEMD_LESS "K" less Ctrl+C . X termcap . . . $LESS less systemd. less(1) . $SYSTEMD_LESSCHARSET less ( "utf-8" UTF-8). $LESSCHARSET less systemd. $SYSTEMD_PAGERSECURE (pager) less(1) "" . sudo(8) pkexec(1) . . " " ( ). " " --no-pager PAGER=cat . . (true) " " . " " LESSSECURE=1 . less(1) " ". false (pager). SYSTEMD_PAGERSECURE=0 . $SYSTEMD_PAGERSECURE systemd " " . " " (UID) geteuid(2) sd_pid_get_owner_uid(3) sudo(8) ( $SUDO_UID [8]). SYSTEMD_PAGERSECURE=1 " " . . $SYSTEMD_PAGERSECURE . $SYSTEMD_PAGER $PAGER $SYSTEMD_PAGERSECURE . $SYSTEMD_COLORS (boolean) . ( ) systemd . $COLORTERM "truecolor" "24bit" 24 256 $NO_COLOR $TERM . true $NO_COLOR. false . "16" "256" "24bit" ANSI 16 256 24 . "auto-16" "auto-256" "auto-24bit" $TERM . $SYSTEMD_URLIFY . . systemd $TERM . : journalctl : journalctl _SYSTEMD_UNIT=avahi-daemon.service journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope : journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 : journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service "+" OR . Avahi PID 28097 D-Bus ( ): journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service -u/--unit=. journalctl -u name _SYSTEMD_UNIT=name.service + UNIT=name.service _PID=1 + OBJECT_SYSTEMD_UNIT=name.service _UID=0 + COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1 ( systemd.journal-fields(7) ). D-Bus : journalctl /usr/bin/dbus-daemon : journalctl -k -b -1 apache.service: journalctl -f -u apache systemd(1) systemd-cat(1) systemd-journald.service(8) systemctl(1) coredumpctl(1) systemd.journal-fields(7) journald.conf(5) systemd.time(7) systemd-journal-remote.service(8) systemd-journal-upload.service(8) 1. UAPI.2 https://uapi-group.org/specifications/specs/discoverable_partitions_specification 2. RFC 3339 https://tools.ietf.org/html/rfc3339 3. https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-export-format 4. JSON https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-json-format 5. https://developer.mozilla.org/en-US/docs/Server-sent_events/Using_server-sent_events 6. (JSON) https://tools.ietf.org/html/rfc7464 7. https://systemd.io/CATALOG 8. $SUDO_UID . 3 . . : . systemd 260.1 JOURNALCTL(1)