json-pretty, json-sse and
json-seq), as well as on cat. For the former, the "__CURSOR", "__REALTIME_TIMESTAMP", "__MONOTONIC_TIMESTAMP", and "_BOOT_ID" fields are always printed.
-n, --lines=
Show the most recent journal events and limit the number of events shown. If --follow is used, this option is implied. The argument is a positive integer or "all" to disable line limiting. The default value is 10
if no argument is given.
When used with --grep=, --reverse is implied.
-r, --reverse
Reverse output so that the newest entries are displayed first.
--show-cursor
The cursor is shown after the last entry after two dashes:
-- cursor: s=0639...
The format of the cursor is private and subject to change.
--utc
Express time in Coordinated Universal Time (UTC).
-x, --catalog
Augment log lines with explanation texts from the message catalog. This will add explanatory help texts to log messages in the output where this is available. These short help texts will explain the context of an
error or log event, possible solutions, as well as pointers to support forums, developer documentation, and any other relevant manuals. Note that help texts are not available for all messages, but only for
selected ones. For more information on the message catalog, please refer to the Message Catalog Developer Documentation[6].
Note: when attaching journalctl output to bug reports, please do not use -x.
--no-hostname
Don't show the hostname field of log messages originating from the local host. This switch has an effect only on the short family of output modes (see above).
Note: this option does not remove occurrences of the hostname from log entries themselves, so it does not prevent the hostname from being visible in the logs.
--no-full, --full, -l
Ellipsize fields when they do not fit in available columns. The default is to show full fields, allowing them to wrap or be truncated by the pager, if one is used.
The old options -l/--full are not useful anymore, except to undo --no-full.
-a, --all
Show all fields in full, even if they include unprintable characters or are very long. By default, fields with unprintable characters are abbreviated as "blob data". (Note that the pager may escape unprintable
characters again.)
-f, --follow
Show only the most recent journal entries, and continuously print new entries as they are appended to the journal.
--no-tail
Show all stored output lines, even in follow mode. Undoes the effect of --lines=.
-q, --quiet
Suppresses all informational messages (i.e. "-- Journal begins at ...", "-- Reboot --"), any warning messages regarding inaccessible system journals when run as a normal user.
PAGER CONTROL OPTIONS
The following options control page support:
--no-pager
Do not pipe output into a pager.
-e, --pager-end
Immediately jump to the end of the journal inside the implied pager tool. This implies -n1000 to guarantee that the pager will not buffer logs of unbounded size. This may be overridden with an explicit -n with
some other numeric value, while -nall will disable this cap. Note that this option is only supported for the less(1) pager.
FORWARD SECURE SEALING (FSS) OPTIONS
The following options may be used together with the --setup-keys command described below:
--interval=
Specifies the change interval for the sealing key when generating an FSS key pair with --setup-keys. Shorter intervals increase CPU consumption but shorten the time range of undetectable journal alterations.
Defaults to 15min.
--verify-key=
Specifies the FSS verification key to use for the --verify operation.