Without arguments, all collected logs are shown unfiltered:
journalctl
With one match specified, all entries with a field matching the
expression are shown:
journalctl _SYSTEMD_UNIT=avahi-daemon.service
journalctl _SYSTEMD_CGROUP=/user.slice/user-42.slice/session-c1.scope
If two different fields are matched, only entries matching both
expressions at the same time are shown:
journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097
If two matches refer to the same field, all entries matching
either expression are shown:
journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service
If the separator "+" is used, two expressions may be combined in
a logical OR. The following will show all messages from the Avahi
service process with the PID 28097 plus all messages from the
D-Bus service (from any of its processes):
journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
To show all fields emitted by a unit and about the unit, option
-u/--unit= should be used. journalctl -u name expands to a
complex filter similar to
_SYSTEMD_UNIT=name.service
+ UNIT=name.service _PID=1
+ OBJECT_SYSTEMD_UNIT=name.service _UID=0
+ COREDUMP_UNIT=name.service _UID=0 MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1
(see systemd.journal-fields(7) for an explanation of those
patterns).
Show all logs generated by the D-Bus executable:
journalctl /usr/bin/dbus-daemon
Show all kernel logs from previous boot:
journalctl -k -b -1
Show a live log display from a system service apache.service:
journalctl -f -u apache
