s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

journalctl

Read and search the systemd journal: by service, time, priority, boot, user and any field.

المستوى
امتحان RHCSA
المجموعة
السجلات
يحتاج root
للتغييرات
الحزمة
systemd

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

journald stores messages of the kernel, the boot, services and programs with many fields (unit, PID, UID, priority …). journalctl shows them, oldest first, in a pager. Filters can be combined: journalctl -u sshd -p warning --since today.

Normal users see their own messages; members of wheel, adm and systemd-journal see all. The journal is persistent only if /var/log/journal exists (or Storage=persistent).

طريقة الكتابة

journalctl [OPTION]... [FIELD=VALUE]...

الخيارات 53

الأكثر استخدامًا

Filter

-u, --unit=UNIT
Messages of a unit (pattern allowed).
--user-unit=UNIT
Messages of a user unit.
-p, --priority=PRIO
Priority or range: emerg, alert, crit, err, warning, notice, info, debug (or 0-7, err..warning).
-S, --since=TIME
From this time: today, yesterday, -1h, "2026-10-25 08:00".
-U, --until=TIME
Until this time.
-b, --boot[=ID|±N|all]
This boot, or another (-1 = the boot before).
-k, --dmesg
Only kernel messages (implies -b).
-t, --identifier=ID
Messages with this syslog tag.
-g, --grep=PATTERN
Messages that match a regular expression.
--case-sensitive[=BOOL]
Case for --grep.
--facility=FACILITY
Syslog facility.
FIELD=VALUE
Field filter, like _PID=1010, _UID=1001, _COMM=sudo, _SYSTEMD_UNIT=sshd.service.
-c, --cursor=CURSOR, --after-cursor=CURSOR, --cursor-file=FILE
Start at a saved position.

Output

-f, --follow
Show new messages live.
-n, --lines=N
The last N lines (default 10).
-r, --reverse
Newest first.
-e, --pager-end
Jump to the end in the pager.
-o, --output=MODE
Format: short, short-iso, short-precise, verbose, json, json-pretty, cat, export …
--output-fields=LIST
Fields to show with json/verbose.
-x, --catalog
Add explanations from the message catalog.
-a, --all
Show all fields, also long or unprintable ones.
-l, --full, --no-full
Do not cut / cut long lines.
--no-hostname
Hide the host name.
--utc
Times in UTC.
--truncate-newline
Only the first line of multi-line messages.
--show-cursor
Print the cursor at the end.
-q, --quiet
No info messages.
--no-pager
Do not use a pager.
--no-tail
With -f: show all lines first.

Sources

--system, --user
System or user journal.
-m, --merge
Merge all journals (also remote ones).
-D, --directory=DIR
Read the journal in this folder.
--file=GLOB
Read these journal files.
--root=ROOT, --image=IMAGE, --image-policy=POLICY
Read from another root or image.
--namespace=NAME
A journal namespace.
-M, --machine=NAME
A container's journal.

Fields and boots

-F, --field=FIELD
List all values of a field (like _SYSTEMD_UNIT).
-N, --fields
List all field names.
--list-boots
List the stored boots.

Maintenance

--disk-usage
Space used by the journal.
--vacuum-size=SIZE
Delete old files until the journal is under this size.
--vacuum-time=TIME
Delete entries older than this.
--vacuum-files=N
Keep only N files.
--rotate
Start new journal files.
--flush
Move the memory journal to /var/log/journal.
--sync
Write all pending messages to disk.
--relinquish-var, --smart-relinquish-var
Stop writing to /var (before unmounting it).
--verify
Check the journal files for damage.
--setup-keys, --verify-key=KEY, --interval=TIME, --force
Forward Secure Sealing (tamper proof logs).
--header
Show the file headers.
--list-catalog, --dump-catalog, --update-catalog
Message catalog tools.
-h, --help
Show help.
--version
Show the version.

أمثلة 15

$ مستخدم عادي# بصلاحية root (أو مع sudo)

  1. 1Messages of one service

    journalctl -u sshd

    Everything sshd logged.

  2. 2Errors since the boot

    journalctl -p err -b

    The first look after a problem.

  3. 3Follow a service live

    journalctl -fu httpd

    Leave it open while you test.

  4. 4A time window

    journalctl --since "2026-10-25 08:00" --until "2026-10-25 09:00"

    Also: --since -2h, --since yesterday.

  5. 5The boot before

    journalctl --list-boots
journalctl -b -1 -p warning

    Why did the server crash or reboot?

  6. 6Kernel messages

    journalctl -k -p warning

    Disk, memory and driver problems.

  7. 7All sudo commands today (audit)

    journalctl _COMM=sudo --since today

    User, folder and command of each sudo call.

  8. 8Failed SSH logins (security)

    journalctl -u sshd --since today -g 'Failed password|Invalid user'

    Many lines from one IP = a brute-force attack.

  9. 9Messages of one user

    journalctl _UID=1001 --since today

    What lisa's processes logged.

  10. 10All fields of one entry

    journalctl -u sshd -n 1 -o verbose

    Shows the fields you can filter on.

  11. 11JSON for tools

    journalctl -u myapp -o json --since -10min | jq -r '.MESSAGE'

    Feed a SIEM or script.

  12. 12Explain a failure

    journalctl -xeu httpd

    -x adds help text, -e jumps to the end.

  13. 13Disk use and cleanup

    journalctl --disk-usage
journalctl --vacuum-time=30d

    Removes entries older than 30 days.

  14. 14Which units logged at all?

    journalctl -F _SYSTEMD_UNIT | sort | head

    Lists every unit name in the journal.

  15. 15Check the journal for damage

    journalctl --verify

    PASS/FAIL per file.

انتبه

  • Without a persistent journal, -b -1 shows nothing: older boots are gone.
  • Times in --since need quotes when they contain a space.

الملفات

/run/log/journal/
Journal in memory (lost at reboot).
/var/log/journal/
Journal on disk (persistent).
/etc/systemd/journald.conf, /etc/systemd/journald.conf.d/
journald settings.

رموز الخروج

0 :: Done. 1 :: Error (or no match with some options).

الدليل الكامل

هذه الصفحة تشرح الأمر بكلمات بسيطة. الدليل الأصلي فيه كل التفاصيل.

في الطرفية: man journalctl

افتح صفحة man (linux.die.net)www.freedesktop.org