further limit what entries will be shown (logical AND).
Output is interleaved from all accessible journal files, whether they are rotated or currently being written, and regardless of whether they belong to the system itself or are accessible user journals. The --header
option can be used to identify which files are being shown.
The set of journal files which will be used can be modified using the --user, --system, --directory, and --file options, see below.
All users are granted access to their private per-user journals. However, by default, only root and users who are members of a few special groups are granted access to the system journal and the journals of other
users. Members of the groups "systemd-journal", "adm", and "wheel" can read all journal files. Note that the two latter groups traditionally have additional privileges specified by the distribution. Members of the
"wheel" group can often perform administrative tasks.
The output is paged through less by default, and long lines are "truncated" to screen width. The hidden part can be viewed by using the left-arrow and right-arrow keys. Paging can be disabled; see the --no-pager
option and the "Environment" section below.
When outputting to a tty, lines are colored according to priority: lines of level ERROR and higher are colored red; lines of level NOTICE and higher are highlighted; lines of level DEBUG are colored lighter grey;
other lines are displayed normally.
To write entries to the journal, a few methods may be used. In general, output from systemd units is automatically connected to the journal, see systemd‐journald.service(8). In addition, systemd‐cat(1) may be used to
send messages to the journal directly.
SOURCE OPTIONS
The following options control where to read journal records from:
--system, --user
Show messages from system services and the kernel (with --system). Show messages from service of current user (with --user). If neither is specified, show all messages that the user can see.
The --user option affects how --unit arguments are treated. See --unit.
-M, --machine=
Show messages from a running, local container. Specify a container name to connect to.
-m, --merge
Show entries interleaved from all available journals, including remote ones.
-D DIR, --directory=DIR
Takes a directory path as argument. If specified, journalctl will operate on the specified journal directory DIR instead of the default runtime and system journal paths.
--file=GLOB
Takes a file glob as an argument. If specified, journalctl will operate on the specified journal files matching GLOB instead of the default runtime and system journal paths. May be specified multiple times, in
which case files will be suitably interleaved.
--root=ROOT
Takes a directory path as an argument. If specified, journalctl will operate on journal directories and catalog file hierarchy underneath the specified directory instead of the root directory (e.g.
--update-catalog will create ROOT/var/lib/systemd/catalog/database, and journal files under ROOT/run/journal/ or ROOT/var/log/journal/ will be displayed).
--image=IMAGE
Takes a path to a disk image file or block device node. If specified, journalctl will operate on the file system in the indicated disk image. This option is similar to --root=, but operates on file systems stored
in disk images or block devices, thus providing an easy way to extract log data from disk images. The disk image should either contain just a file system or a set of file systems within a GPT partition table,
following the Discoverable Partitions Specification[1]. For further information on supported disk images, see systemd‐nspawn(1)'s switch of the same name.
--namespace=NAMESPACE