23

I am trying to use journalctl's pattern matching on SYSLOG_IDENTIFIERS. As an example, I have a ton of message tagged sshd:

$ journalctl -t sshd | wc -l
987

but if I try to use pattern matching to find them:

$ journalctl -t 'ssh*'
-- No Entries --
$ journalctl -t 'ssh.*'
-- No Entries --

The journalctl man page says patterns should work, but I can't find anything else about how patterns are used/defined in systemd.

$ man journalctl
....
-t, --identifier=SYSLOG_IDENTIFIER|PATTERN
       Show messages for the specified syslog identifier SYSLOG_IDENTIFIER,
       or for any of the messages with a "SYSLOG_IDENTIFIER" matched by PATTERN.

I'm running ArchLinux:

$ journalctl --version
systemd 225
+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP
+GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID -ELFUTILS +KMOD +IDN
  • 5
    Based on discussions on IRC, it seems this is a bug (or an issues with the documentation). A bug has been filed. – Mark Grimes Sep 14 '15 at 1:18
  • 1
    try this for realtime: journalctl -f | grep sshd – nexoma Dec 1 '15 at 12:15
  • You can actually add multiple -t <identifier> if that suits you. – sivann Jan 25 '19 at 12:38
17

This was a doc bug that was closed when the typo in the man page was updated.

The bug report led to the following comments in the code:

We don't actually accept patterns, hence don't claim so.

As a workaround, you may be able to use grep as suggested in the comments to your question. Something like this:

journalctl | grep sshd
1

The original question titles "How do you use systemd's journalctl patterns". This points to a very specific feature of the journalctl called "MATCHES" rather than a generic regular expression filtering.

The "MATCHES" feature is fully detailed along with all other features at its friendly man page which states at its very beginning:

If one or more match arguments are passed, the output is filtered accordingly.

The "matches" feature is meant to filter the log entries out based upon a number of possible filters.

For cases like the one in the original question, this is how I do (I do run ArchLinux too).

First, you need to know the service name you are interested in. I usually do this:

systemctl | grep sshd

I get this:

sshd.service       loaded active running   OpenSSH Daemon

Then you can ask journalctl to filter by the "systemd unit name" like this:

journalctl _SYSTEMD_UNIT=sshd.service

It's called "the matches filtering". That'd be it.

In case the original question was written instead to mean "how to apply grep to journalctl output", then you can either apply grep to the logs stored "so far" with

journalctl | grep ssh

or look at the currently incoming log entries with

journalctl -f | grep ssh

and hit CTRL-C to stop the flow. Of course, you can use more complex pipes with either finer grained regular patterns or multiple grep commands.

  • Thanks for the response, but _SYTEMD_UNIT doesn't accept patterns. As mentioned in my comment and @Tim's answer, this was a bug in the docs. – Mark Grimes Oct 30 '18 at 20:32
  • @MarkGrimes, At least for me (systemd 239) it works. I always test what I say before writing it down. It works as documented. – EnzoR Oct 31 '18 at 5:16
  • The question is about using patterns, for example ssh*. The journalctl docs stated that this was possible at one time. The docs were incorrect and have been updated. – Mark Grimes Oct 31 '18 at 12:52
  • @MarkGrimes The question is about systemd's journalctl patterns not any character pattern. Please see my updated answer. And it works under ArchLinux exactly as documented. – EnzoR Nov 2 '18 at 8:47
-2

You can define the unit file when you run journalctl.

journalctl -f -u sshd.service

I will only show the journal of sshd

  • This answer doesn't address the question. The user is asking for using patterns in a filter. – Merlijn Sebrechts Jul 25 '18 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.