Skip to content

Commit 485543c

Browse files
harneshalakaharneshalaka
committed
Fixed feedback.
1 parent c0bc7b5 commit 485543c

File tree

4 files changed

+65
-129
lines changed

4 files changed

+65
-129
lines changed

‎articles/journalctl.asm.xml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ xmlns="http://docbook.org/ns/docbook">
2020
<!-- tasks-->
2121
<resource href="../tasks/journald-configure.xml" xml:id="_journald-configure"/>
2222
<resource href="../tasks/systemd-journald-troubleshooting.xml" xml:id="_systemd-journald-troubleshooting"/>
23+
<resource href="../tasks/journald-filter-journals.xml" xml:id="_journald-filter-journals"/>
2324
<!-- references-->
2425
<resource href="../references/journalctl-usage.xml" xml:id="_journalctl-usage"/>
2526
</resources>
@@ -137,8 +138,9 @@ You must have &sudo; privileges.
137138
</abstract>
138139
</merge>
139140
<module renderas="section" resourceref="_journal-about-journald"/>
140-
<module renderas="section" resourceref="_journald-configure"/>
141+
<module renderas="section" resourceref="_journald-filter-journals"/>
141142
<module renderas="section" resourceref="_journalctl-usage"/>
143+
<module renderas="section" resourceref="_journald-configure"/>
142144
<module renderas="section" resourceref="_systemd-journald-troubleshooting"/>
143145
<module resourceref="_legal"/>
144146
<module resourceref="_gfdl">

‎concepts/journal-about-journald.xml‎

Lines changed: 1 addition & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,7 @@
2525
<para><command>journalctl</command> is the command-line tool to view and analyze the logs from the <command>systemd-journald</command> service.</para></abstract>
2626

2727
</info>
28-
<section xml:id="sec-journalctl-managing">
29-
<title><command>journalctl</command>: configuration and structure</title>
30-
28+
<section><title>Understanding <command>journalctl</command> configuration and structure</title>
3129
<para>
3230
This section describes the <command>journalctl</command> location, configuring the location for persistent logs, and the <command>journalctl</command> entry structure.
3331
</para>
@@ -69,117 +67,4 @@
6967
</listitem>
7068
</itemizedlist>
7169
</section>
72-
<section xml:id="sec-journalctl-filter">
73-
<title>Filtering the journal output</title>
74-
75-
<para>
76-
This section describes how to refine the search in logs according to boot numbers, for specific time interval or to view specific data fields.
77-
content of the journal, the oldest entries listed first. The output can be
78-
filtered by specific switches and fields.
79-
</para>
80-
<section xml:id="sec-journalctl-filter-boot">
81-
<title>Filtering based on a boot number</title>
82-
<para>
83-
<command>journalctl</command> can filter messages based on a specific
84-
system boot. To list all available boots, run
85-
</para>
86-
<screen>&prompt.sudo;journalctl --list-boots</screen>
87-
<para>
88-
The first column lists the boot offset: <literal>0</literal> for the
89-
current boot, <literal>-1</literal> for the previous one,
90-
<literal>-2</literal> for the one before that, etc. The second column
91-
contains the boot ID followed by the limiting time stamps of the specific
92-
boot.
93-
</para>
94-
<para>
95-
Show all messages from the current boot:
96-
</para>
97-
<screen>&prompt.sudo;journalctl -b</screen>
98-
<para>
99-
If you need to see journal messages from the previous boot, add an offset
100-
parameter. The following example outputs the previous boot messages:
101-
</para>
102-
<screen>&prompt.sudo;journalctl -b -1</screen>
103-
<para>
104-
Another way is to list boot messages based on the boot ID. For this
105-
purpose, use the _BOOT_ID field:
106-
</para>
107-
<screen>&prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b</screen>
108-
</section>
109-
110-
<section xml:id="sec-journalctl-filter-time">
111-
<title>Filtering based on time interval</title>
112-
<para>
113-
You can filter the output of <command>journalctl</command> by specifying the
114-
starting and/or ending date. The date specification should be of the format
115-
<literal>2025-06-30 9:17:16</literal>. If the time part is omitted, midnight
116-
is assumed. If seconds are omitted, <literal>:00</literal> is assumed. If
117-
the date part is omitted, the current day is assumed. Instead of numeric
118-
expression, you can specify the keywords <literal>yesterday</literal>,
119-
<literal>today</literal> or <literal>tomorrow</literal>. They refer to
120-
midnight of the day before the current day, of the current day, or of the
121-
day after the current day. If you specify <literal>now</literal>, it refers
122-
to the current time. You can also specify relative times prefixed with
123-
<literal>-</literal> or <literal>+</literal>, referring to times before or
124-
after the current time.
125-
</para>
126-
<para>
127-
Show only new messages since now, and update the output continuously:
128-
</para>
129-
<screen>&prompt.sudo;journalctl --since "now" -f</screen>
130-
<para>
131-
Show all messages since last midnight till 3:20am:
132-
</para>
133-
<screen>&prompt.sudo;journalctl --since "today" --until "3:20"</screen>
134-
</section>
135-
<section xml:id="sec-journalctl-filter-fields">
136-
<title>Filtering based on fields</title>
137-
<para>
138-
You can filter the output of the journal by specific fields. The syntax of
139-
a field to be matched is <literal>FIELD_NAME=MATCHED_VALUE</literal>, such
140-
as <literal>_SYSTEMD_UNIT=httpd.service</literal>. You can specify multiple
141-
matches in a single query to filter the output messages even more. See
142-
<command>man 7 systemd.journal-fields</command> for a list of default
143-
fields.
144-
</para>
145-
<para>
146-
Show messages produced by a specific process ID:
147-
</para>
148-
<screen>&prompt.sudo;journalctl _PID=1039</screen>
149-
<para>
150-
Show messages belonging to a specific user ID:
151-
</para>
152-
<screen># journalctl _UID=1000</screen>
153-
<para>
154-
Show messages from the kernel ring buffer (the same as
155-
<command>dmesg</command> displays):
156-
</para>
157-
<screen>&prompt.sudo;journalctl _TRANSPORT=kernel</screen>
158-
<para>
159-
Show messages from the service's standard or error output:
160-
</para>
161-
<screen>&prompt.sudo;journalctl _TRANSPORT=stdout</screen>
162-
<para>
163-
Show messages produced by a specified service only:
164-
</para>
165-
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service</screen>
166-
<para>
167-
If two different fields are specified, only entries that match both
168-
expressions at the same time are shown:
169-
</para>
170-
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1488</screen>
171-
<para>
172-
If two matches refer to the same field, all entries matching either
173-
expression are shown:
174-
</para>
175-
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</screen>
176-
<para>
177-
You can use the <literal>+</literal> separator to combine two expressions in
178-
a logical <literal>OR</literal>. The following example shows all messages
179-
from the Avahi service process with the process ID 1480 together with all
180-
messages from the D-Bus service:
181-
</para>
182-
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service</screen>
183-
</section>
184-
</section>
18570
</topic>

‎references/journalctl-usage.xml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
xmlns:trans="http://docbook.org/ns/transclusion">
1919

2020
<info>
21-
<title><command>journalctl</command> usage</title>
21+
<title>Using <command>journalctl</command></title>
2222
<abstract>
2323
<para>
2424
Running the <command>journalctl</command> without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation.
@@ -31,7 +31,7 @@
3131
You can run the <command>journalctl</command>:
3232
</para>
3333
<section xml:id="sec-journalctl-usage">
34-
<title>Using <command>journalctl</command>sage</title>
34+
<title>Use <command>journalctl</command></title>
3535
<para>
3636
Running the <command>journalctl</command> without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation.
3737
</para>
@@ -77,8 +77,7 @@
7777
<listitem>
7878
<para>
7979
Shows only kernel messages. This is equivalent to the field match
80-
<literal>_TRANSPORT=kernel</literal> (see
81-
<xref linkend="sec-journalctl-filter-fields"/>).
80+
<literal>_TRANSPORT=kernel</literal>.
8281
</para>
8382
</listitem>
8483
</varlistentry>
@@ -88,8 +87,7 @@
8887
<para>
8988
Shows only messages for the specified &systemd; unit. This is equivalent
9089
to the field match
91-
<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal> (see
92-
<xref linkend="sec-journalctl-filter-fields"/>).
90+
<literal>_SYSTEMD_UNIT=<replaceable>UNIT</replaceable></literal>.
9391
</para>
9492
<screen>&prompt.sudo;journalctl -u apache2</screen>
9593
</listitem>

‎tasks/journald-filter-journals.xml‎

Lines changed: 57 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@
88
<!-- point back to this document with a similar comment added to your legacy doc piece -->
99
<!-- refer to README.md for file and id naming conventions -->
1010
<!-- metadata is dealt with on the assembly level -->
11-
<topic xml:id="journal-configure-journald"
11+
<topic xml:id="journal-filter-journals"
1212
role="task" xml:lang="en"
1313
xmlns="http://docbook.org/ns/docbook" version="5.2"
1414
xmlns:its="http://www.w3.org/2005/11/its"
1515
xmlns:xi="http://www.w3.org/2001/XInclude"
1616
xmlns:xlink="http://www.w3.org/1999/xlink"
1717
xmlns:trans="http://docbook.org/ns/transclusion">
1818
<info>
19-
<title>Filter the journal output</title><!-- can be changed via merge
19+
<title>Filtering the journal output</title><!-- can be changed via merge
2020
in the assembly -->
2121
<!-- add author's e-mail -->
2222
<meta name="maintainer" content="[email protected]" its:translate="no"/>
@@ -30,8 +30,59 @@ in the assembly -->
3030
<para>
3131
You can filter journals based on boot number, time interval, and fields.
3232
</para>
33-
<procedure>
34-
<title>Filtering journals</title>
35-
36-
</procedure>
33+
<procedure>
34+
<title>Filtering journals</title>
35+
<step><para>Filter logs based on specific system boot:</para>
36+
<itemizedlist>
37+
<listitem>
38+
<para>List all the available boots:</para>
39+
<screen>&prompt.sudo;journalctl --list-boots</screen>
40+
<para>The first column lists the boot offset: <literal>0</literal> for the current boot, <literal>-1</literal> for the previous one,
41+
<literal>-2</literal> for the one before that, etc. The second column contains the boot ID followed by the limiting time stamps of the specific
42+
boot.</para>
43+
</listitem>
44+
<listitem><para>Show all messages from the current boot:</para>
45+
<screen>&prompt.sudo;journalctl -b</screen></listitem>
46+
<listitem><para>To view journal messages from the previous boot, add an offset
47+
parameter. The following example command shows the previous boot messages:</para>
48+
<screen>&prompt.sudo;journalctl -b -1</screen></listitem>
49+
<listitem><para>To view boot messages based on the boot ID, <literal>156019a44a774a0bb0148a92df4af81b</literal>:</para>
50+
<screen>&prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b</screen></listitem>
51+
</itemizedlist></step>
52+
<step><para>Filter logs based on time interval</para>
53+
<para>You can filter the output of <command>journalctl</command> by specifying the starting and/or ending date. The date specification should be of the format<literal>YYYY-MM-DD H:MM:SS</literal>. If the time part is omitted, midnight is assumed. If seconds are omitted, <literal>:00</literal> is assumed. If the date part is omitted, the current day is assumed. Instead of numeric expression, you can specify the keywords <literal>yesterday</literal>,
54+
<literal>today</literal> or <literal>tomorrow</literal>. They refer to midnight of the day before the current day, of the current day, or of the day after the current day. If you specify <literal>now</literal>, it refers to the current time. You can also specify relative times prefixed with <literal>-</literal> or <literal>+</literal>, referring to times before or after the current time.</para>
55+
<itemizedlist>
56+
<listitem>
57+
<para>To view only new messages since now, and update the output continuously:</para>
58+
<screen>&prompt.sudo;journalctl --since "now" -f</screen></listitem>
59+
<listitem><para>To view all messages since last midnight till <literal>3:20am</literal>:</para>
60+
<screen>&prompt.sudo;journalctl --since "today" --until "3:20"</screen></listitem>
61+
</itemizedlist>
62+
</step>
63+
<step><para>Filter logs based on fields</para>
64+
<para>You can filter the output of the journal by specific fields. The syntax of a field to be matched is <literal>FIELD_NAME=MATCHED_VALUE</literal>, such
65+
as <literal>_SYSTEMD_UNIT=httpd.service</literal>. You can specify multiple matches in a single query to filter the output messages even more. See
66+
<command>man 7 systemd.journal-fields</command> for a list of default fields.</para>
67+
<itemizedlist>
68+
<listitem>
69+
<para>To view messages produced by a specific process ID, for example <literal>PID_1039</literal>:</para>
70+
<screen>&prompt.sudo;journalctl _PID=1039</screen></listitem>
71+
<listitem><para>To view messages belonging to a specific user ID, for example <literal>UID_1000</literal>:</para>
72+
<screen># journalctl _UID=1000</screen></listitem>
73+
<listitem><para>To view messages from the kernel ring buffer (the same as <command>dmesg</command> displays):</para>
74+
<screen>&prompt.sudo;journalctl _TRANSPORT=kernel</screen></listitem>
75+
<listitem><para>To view messages from the service's standard or error output:</para>
76+
<screen>&prompt.sudo;journalctl _TRANSPORT=stdout</screen></listitem>
77+
<listitem><para>To view messages produced by a specified service only:</para>
78+
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service</screen>
79+
<para>If two different fields are specified, only entries that match both expressions at the same time are shown:</para>
80+
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1488</screen>
81+
<para>If two matches refer to the same field, all entries matching either expression are shown:</para>
82+
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service</screen>
83+
<para>You can use the <literal>+</literal> separator to combine two expressions in a logical <literal>OR</literal>. The following example shows all messages from the Avahi service process with the process ID 1480 together with all messages from the D-Bus service:</para>
84+
<screen>&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service</screen></listitem>
85+
</itemizedlist>
86+
</step>
87+
</procedure>
3788
</topic>

0 commit comments

Comments
 (0)