-r
--reverse Reverse output so newest entries are displayed first.
| --no-full
--full
-l Ellipsize fields when they do not fit. The default is to show full fields, allowing them to wrap or be
truncated by the pager
| -a
--all Show all fields in full
| -n
--lines=n|all Output the most recent n events
all disables line limiting.
default : 10
| -f
--follow Do not exit, i.e. display new entries as they are appended .
Implies --lines=10
| --no-tail Output all stored output lines, even in follow mode.
Negates --lines.
| -e
--pager-end Start at the end inside the pager, implies -n 1000
so the pager will not buffer logs of unbounded size.
May be overridden with -n ,
-n all disables this cap. only for less
| -o
--output=
Controls the formatting of the entries that are shown. Takes one of the following options:
short | default generates output similar to classic syslog
| cat | very terse output, showing the actual message of with no metadata,
| short-full timestamps as --since= and --until= options accepted
include weekday, year and timezone (locale-independent).
| short-iso | shows (ISO 8601) T[hh][mm][ss] timestamps.
| short-precise | shows timestamps with microseconds.
| short-monotonic | shows monotonic timestamps
| short-unix | shows seconds since epoch.
| verbose | shows the full-structured entry items with all fields.
| export | serializes the journal into a binary (but mostly text-based) stream suitable for backups and network transfer (see Journal Export Format[1]
| json | formats entries as JSON data structures, one per line (see Journal JSON Format[2]
| json-pretty | formats entries as JSON more readable by humans.
| json-sse | formats entries as JSON data structures, wraps in a format suitable for Server-Sent Events[3].
| | | | | | | | | | | | |
| --no-hostname Supress hostname from the local host. only effects --output=short
| --utc | time UTC
| -x
--catalog Augment log lines with explanation texts
explain the context of an error or log event, possible
solutions, as well as pointers to support forums, developer documentation, and any other relevant manuals.
help is not available for all messages. Refer to the Message Catalog Developer Documentation[4].
| -q
--quiet
Suppresses info messages (i.e. "-- Logs begin at ...", "-- Reboot --"),
warnings regarding inaccessible system journals when run as a normal user.
| -m
--merge Output entries interleaved from all available journals, including remote ones.
| --list-boots Output a list of boot numbers (relative to the current boot), IDs, and timestamps of the first and last message pertaining to the boot.
journalctl --list-boots
0 7672…ca7c Tue 2019-07-23 15:50:01 EDT -† Sat 2019-07-27 21:30:01 EDT
|
| Message selection
|
|---|
-b
--boot=[ID][+-offset]
Output messages from a specific boot, adds a match for "_BOOT_ID=".
With no argument logs since the current boot will be shown.
If the boot ID is omitted, a positive offset refers to boots starting from the beginning of the journal.
ID ≤ 0 offset starts from the end of the journal.
1 refers to the first boot 2 the second; -0 is the last boot, -1 the boot before last, and so on.
An empty offset is equivalent to -0, except when the current boot is not the last boot (e.g. --directory
was specified to look at logs from a different machine).
If the 32-character ID is specified, it may be followed by offset which identifies the boot relative to the one
given by boot ID. Negative values mean earlier boots and positive values mean later boots.
If offset is not specified, a value of zero is assumed, and the logs for the boot given by ID are shown.
| -t
--identifier=syslog_identifier Output messages for the SYSLOG_IDENTIFIER.
May be specified multiple times.
| -u
--unit=unit|pattern
Output messages for the systemd unit UNIT (such as a service unit), or
for units matching pattern.
If a pattern is specified, a list of unit names is compared with the specified pattern and all that match are used.
For each unit name, a match is added for messages from the unit ("_SYSTEMD_UNIT=UNIT"), along with additional matches
for messages from systemd and messages about coredumps for the specified unit.
May be specified multiple times.
| --user-unit=user
Output messages for the user session unit. adds a match for messages from the unit ("_SYSTEMD_USER_UNIT=" and "_UID=") and additional matches for messages from session systemd and messages about coredumps for the specified unit.
May be specified multiple times.
| -p
--priority=n| emerg | alert | crit | err | warning | notice | debug
Filter output by priorities or ranges.
If a single level is specified, all messages with this level or a lower (more important) level are shown.
If a range is specified, messages with this level within the range, inclusive are shown.
Adds PRIORITY="
|
-c
--cursor=location show entries from the location
--show-cursor The cursor is shown after the last entry after two dashes: example:
--cursor: s=0639…
| --after-cursor= Show entries from the location after the location specified by the passed cursor.
| -S
--since=ccyy-mm-dd [hh:mm:ss]
-U
--until= …
Start examining entries "on or newer then" or "on or older then"
ccyy-mm-dd[ hh:mm:ss ]
hh:mm defaults to 00:00 and :ss :00 .
Date defaults to the current day.
yesterday, today, tomorrow are allowed, which refer to 00:00:00 of the day before the current day, the
current day, or the day after the current day.
now refers to the current time.
Relative times may be specified, prefixed with "-" or "+", referring to times before or after the current time.
For time and date specification, see systemd.time(7).
--output=short-full displays timestamps that follow this format.
| | Field selection
|
|---|
-F
--field=f output all possible data values the field can take in all entries .
| -N
--fields Display all field names used in all entries
|
PRIORITY
JOURNAL_NAME
JOURNAL_PATH
USER_ID
SYSLOG_FACILITY
CODE_FILE
MESSAGE
UNIT
USER_UNIT
CODE_LINE
RESULT
LEADER
USERSPACE_USEC
_SYSTEMD_SLICE
_SYSTEMD_CGROUP
_SYSTEMD_SESSION
_SYSTEMD_USER_UNIT
_SYSTEMD_INVOCATION_ID
_SYSTEMD_USER_SLICE
_SYSTEMD_UNIT
_SYSTEMD_OWNER_UID
MESSAGE_ID
CODE_FUNCTION
SESSION_ID
SYSLOG_PID
SYSLOG_IDENTIFIER
_EXE
_SOURCE_REALTIME_TIMESTAMP
_CAP_EFFECTIVE
_CMDLINE
_TRANSPORT
_COMM
_HOSTNAME
_GID
_PID
_MACHINE_ID
_UID
_BOOT_ID
_SOURCE_MONOTONIC_TIMESTAMP
LIMIT[_PRETTY]
MAX_USE[_PRETTY]
CURRENT_USE[_PRETTY]
AVAILABLE[_PRETTY]
DISK_AVAILABLE[_PRETTY]
DISK_KEEP_FREE[_PRETTY]
| | | | |
| --system | Show messages from system services and the kernel
| --user| Show messages from services of current user (default)
| -M
--machine=container Show messages from a running, local container.
| -D dir
--directory=dir
operate on a journal directory DIR instead of
the default runtime and system journal paths.
| --file=glob operate on the journal files matching GLOB …
May be specified multiple times, in which case files will be interleaved.
| --root=root
operate on journal directories and catalog file hierarchy below root
instead of the ROOT directory (e.g. --update-catalog will create
root/var/lib/systemd/catalog/database
, and journal files under root/run/journal or root/var/log/journal will be displayed).
| --new-id128 Generate a unique 128-bit ID for identifying messages.
journalctl --no-host --new-id128
Archived and active journals take up 8.0M in the file system.
As string: 3b4cd38908d6483caf876751b0301616
As UUID: 3b4cd389-08d6-483c-af87-6751b0301616
As systemd-id128(1) macro:
#define XYZ SD_ID128_MAKE(3b,4c,d3,89,08,d6,48,3c,af,87,67,51,b0,30,16,16)
As Python constant:
>>> import uuid
>>> XYZ = uuid.UUID('3b4cd38908d6483caf876751b0301616')
| --header show internal header information of the journal fields accessed. > journalctl --header
Archived and active journals take up 8.0M in the file system.
File path: /var/log/journal/a22a2e2f9ece4798893de768a7e8e756/system.journal
File ID: d2ceeb6f71a347bca47e104aac20a2d9
Machine ID: a22a2e2f9ece4798893de768a7e8e756
Boot ID: 66702ad552784e5cbac6e286386f3da6
Sequential number ID: 1e25018865c44ceea4045562951f9ef6
State: ONLINE
Compatible flags:
Incompatible flags: COMPRESSED-ZSTD KEYED-HASH COMPACT
Header size: 264
Arena size: 8388344
Data hash table size: 156529
Field hash table size: 333
Rotate suggested: no
Head sequential number: 33873 (8451)
Tail sequential number: 36892 (901c)
Head realtime timestamp: Wed 2026-09-02 11:02:49 EDT (65a8154224360)
Tail realtime timestamp: Wed 2026-09-02 16:24:17 EDT (65a85d1cdb657)
Tail monotonic timestamp: 6d 22h 30min 1.972s (8b8f244319)
Objects: 7260
Entry objects: 3020
Data objects: 3521
Data hash table fill: 2.2%
Field objects: 58
Field hash table fill: 17.4%
Tag objects: 0
Entry array objects: 659
Deepest field hash chain: 1
Deepest data hash chain: 1
Disk usage: 8.0M
| --disk-usage Shows disk usage of all journal files including archived and active journal files.
Archived and active journals take up 21.6M
| --list-catalog [ID …]
List the contents of the message catalog as a table of message IDs,
plus their short description strings.
If any 128-bit-IDs are specified, only those entries are shown.
> journalctl --list-catalog
Archived and active journals take up 247.1M in the file system.
x…x2e systemd: One or more messages could not be forwarded to syslog
x…x73 systemd: Unit skipped
x…x5d systemd: DNSSEC validation failed
x…x93 systemd: Failed to generate valid unit name from path '@MOUNT_POINT@'.
x…x33 systemd: systemd-udev-settle.service is deprecated.
x…xe7 systemd: Mount point is not empty
x…xf2 systemd: A virtual machine or container has been started
| --dump-catalog [ID…] the message catalog entries with IDs.
Default all entries.
Large example > journalctl --dump-catalog
Archived and active journals take up 247.1M in the file system.
-- x…x2e
Subject: One or more messages could not be forwarded to syslog
Defined-By: systemd
Support: https://www.debian.org/support
One or more messages could not be forwarded to the syslog service
running side-by-side with journald. This usually indicates that the
syslog implementation has not been able to keep up with the speed of
messages queued.
-- x…x73
Subject: Unit skipped
Defined-By: systemd
Support: https://www.debian.org/support
The unit @UNIT@ was skipped due to an ExecCondition= command failure, and has
entered the 'dead' state with result '@UNIT_RESULT@'.
-- x…x5d
Subject: DNSSEC validation failed
Defined-By: systemd
Support: https://www.debian.org/support
Documentation: man:systemd-resolved.service(8)
A DNS query or resource record set failed DNSSEC validation. This is usually
indication that the communication channel used was tampered with.
-k
--dmesg Show only kernel messages. implies --boot and adds match "_TRANSPORT=kernel".
Sample
| --verify Check for internal consistency.
If FSS enabled and the FSS verification key has been specified with --verify-key=, authenticity of the journal file is verified.
> journalctl --verify
> journalctl --verify
Archived and active journals take up 8.0M in the file system.
PASS: /var/log/journal/a22a2e2f9ece4798893de768a7e8e756/system.journal
+++
Archived and active journals take up 8.0M in the file system.
File corruption detected at /var/log/journal/a… /system.journal:2ab070 (of 8388608 bytes, 33%).
FAIL: /var/log/journal/a…/system.journal (Input/output error) out of space
|
--vacuum-size=size
--vacuum-time=timespan
--vacuum-files=number
Remove archived files until:
- the disk space used is below
size K, M, G and T
- no data older than the
timespan s, m, h, days, months, weeks and years
- no more than the
number of files remain.
has an indirect effect on the output shown by --disk-usage which includes active files.
--vacuum-size, --vacuum-time and --vacuum-files may be combined
Does not remove active files. > sudo journalctl --vacuum-size=160K |\
sed "s/[[:xdigit:]]\{30\}/x/; /s/[[:xdigit:]]\{16\}/x/;"
Vacuuming done, freed 0B of archived journals from /var/log/journal.
Vacuuming done, freed 0B of archived journals from /run/log/journal.
Deleted empty archived journal /run/log/journal/a22…756/system@x…xbd-x…x-x…x.journal (8.0M).
Deleted archived journal /run/log/journal/a22…756/system@x…xbd-x…x-x…x.journal (6.3M).
…
Deleted archived journal /run/log/journal/a22…756/system@x…xbd-x…x-x…x.journal (560.0K).
Vacuuming done, freed 79.1M of archived journals from /run/log/journal/a22…756.
Deleted archived journal /var/log/journal/a22…756/system@x…x5f-x…x-x…x.journal (7.9M).
Deleted archived journal /var/log/journal/a22…756/system@x…x5f-x…x-x…x.journal (7.9M).
Deleted archived journal /var/log/journal/a22…756/system@x…xf6-x…x-x…x.journal (7.9M).
Vacuuming done, freed 159.9M of archived journals from /var/log/journal/a22…756
| --sync write all data to files and synchronize all journals.
Does not return until complete.
| --update-catalog Update the message catalog index.
Needs to be executed each time new catalog files are installed, removed or updated to rebuild the binary catalog index.
| --setup-keys Generate a new key pair for Forward Secure Sealing (FSS).
This will generate a sealing key and a verification key.
The sealing key is stored in the journal data directory and remains on the host.
The verification key should be stored externally.
Refer to Seal in journald.conf
| --verify-key=kkk the FSS verification key to use for --verify.
| --interval=minutes the change interval for the sealing key when generating an FSS key pair with
--setup-keys.
Shorter intervals increase CPU consumption but shorten the time range of undetectable journal alterations.
Default 15min.
| --force When --setup-keys is passed and Forward Secure Sealing (FSS) has been configured, recreate FSS keys.
| --flush data in /run/log/journal is written to /var/log/journal
if persistent storage is enabled.
Does not return until complete.
the data is flushed once during system runtime this command exits cleanly without
executing any operation if this has already happened.
Does not return until the rotation is complete.
|
--no-pager | Do not pipe output to a pager.
| -h
--help output a short help text and exit.
| --version | output a short version string and exit.
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |