journalctl

Overview ¶

Package journalctl implements a bounded systemd journal query builtin.

Usage: journalctl (-u UNIT...|-k) [OPTION]...

This is a deliberately restricted journalctl subset. Every log query must select one or more exact system units, or the current boot's kernel log. Arbitrary field matches, unrestricted journal reads, follow mode, alternate files/directories, cursors, and machine/namespace selection are not exposed.

Accepted flags:

-u, --unit=UNIT       select an exact system unit; may be repeated
-k, --dmesg           select kernel messages from the current target boot
-b, --boot            restrict a unit query to the current target boot
-n, --lines=COUNT     show at most COUNT entries (default 100, maximum 1000)
-S, --since=TIME      show entries since an RFC3339 timestamp, local
                      YYYY-MM-DD HH:MM:SS timestamp, or lookback duration
-o, --output=FORMAT   output format: escaped short (default) or raw cat
--disk-usage          show allocated journal storage and exit
--rotate              archive active journal files before returning
--vacuum-size=SIZE    remove oldest eligible archives until total allocated
                      journal storage (active plus archived, as reported by
                      --disk-usage) is at or below SIZE; active journals are
                      never deleted, so the target may be unreachable;
                      requires --vacuum-time
--vacuum-time=AGE     alone, remove archives older than AGE; with
                      --vacuum-size, set the minimum deletion age
--dry-run             report cleanup without deleting archives
-h, --help            print usage and exit