Home Explore Blog CI



man-pages

5th chunk of `journalctl.man`
45e5a0cc8b970a2cbed31302c294dd91c13968989953222f0000000100000fa6
 specified multiple times.

       -p, --priority=
           Filter output by message priorities or priority ranges. Takes either a single numeric or textual log level (i.e. between 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in the form FROM..TO. The
           log levels are the usual syslog log levels as documented in syslog(3), i.e.  "emerg" (0), "alert" (1), "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6), "debug" (7). If a single log level is
           specified, all messages with this log level or a lower (hence more important) log level are shown. If a range is specified, all messages within the range are shown, including both the start and the end value of
           the range. This will add "PRIORITY=" matches for the specified priorities.

       --facility=
           Filter output by syslog facility. Takes a comma-separated list of numbers or facility names. The names are the usual syslog facilities as documented in syslog(3).  --facility=help may be used to display a list of
           known facility names and exit.

       -g, --grep=
           Filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description of the syntax.

           If the pattern is all lowercase, matching is case insensitive. Otherwise, matching is case sensitive. This can be overridden with the --case-sensitive option, see below.

           When used with --lines=, --reverse is implied.

       --case-sensitive[=BOOLEAN]
           Make pattern matching case sensitive or case insensitive.

       -k, --dmesg
           Show only kernel messages. This implies -b and adds the match "_TRANSPORT=kernel".

OUTPUT OPTIONS
       The following options control how journal records are printed:

       -o, --output=
           Controls the formatting of the journal entries that are shown. Takes one of the following options:

           short
               is the default and generates an output that is mostly identical to the formatting of classic syslog files, showing one line per journal entry.

           short-full
               is very similar, but shows timestamps in the format the --since= and --until= options accept. Unlike the timestamp information shown in short output mode this mode includes weekday, year and timezone
               information in the output, and is locale-independent.

           short-iso
               is very similar, but shows ISO 8601 wallclock timestamps.

           short-iso-precise
               as for short-iso but includes full microsecond precision.

           short-precise
               is very similar, but shows classic syslog timestamps with full microsecond precision.

           short-monotonic
               is very similar, but shows monotonic timestamps instead of wallclock timestamps.

           short-delta
               as for short-monotonic but includes the time difference to the previous entry. Maybe unreliable time differences are marked by a "*".

           short-unix
               is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock timestamps ("UNIX time"). The time is shown with microsecond accuracy.

           verbose
               shows the full-structured entry items with all fields.

           export
               serializes the journal into a binary (but mostly text-based) stream suitable for backups and network transfer (see Journal Export Format[2] for more information). To import the binary stream back into native
               journald format use systemd‐journal‐remote(8).

           json
               formats entries as JSON objects, separated by newline characters (see Journal JSON Format[3] for more information). Field values are generally encoded as JSON strings, with three exceptions:

                1. Fields larger than 4096 bytes are encoded as null values. (This may be

Title: journalctl: Filtering and Output Options (Grep, Case Sensitivity, Kernel Messages, Output Formats)
Summary
journalctl filtering options include: `--facility` to filter by syslog facility, `-g/--grep` to filter by regular expression on the MESSAGE= field, and `--case-sensitive` to control case sensitivity of grep. `-k/--dmesg` shows only kernel messages. Output options, controlled by `-o/--output`, include `short` (default syslog format), `short-full` (timestamps for --since/--until), `short-iso` (ISO 8601 timestamps), `short-iso-precise` (ISO 8601 with microseconds), `short-precise` (syslog with microseconds), `short-monotonic` (monotonic timestamps), `short-delta` (monotonic with time difference), `short-unix` (seconds since 1970 UTC), `verbose` (full entry items), `export` (binary stream for backups), and `json` (JSON objects).