5

When a process logs to systemd, its process name is recorded and displayed as identifier in the journalctl output.

$ systemd-cat echo "test"
$ journalctl -f
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
...
Jul 25 13:52:26 mycomputer echo[25098]: test

Filtering on that name, however, doesn't seem to work.

$ journalctl -f -t echo
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
$ journalctl -f -u echo
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --

When I manually specify an identifier, the identifier is shown instead of the process name and filtering works.

$ systemd-cat -t myapp echo "test"
$ journalctl -f
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
Jul 25 13:56:08 mycomputer myapp[25213]: test
$ journalctl -f -t myapp
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
Jul 25 13:56:08 mycomputer myapp[25213]: test

How can I filter journalctl output on process name?

5

Just figured this out. You can use any systemd journal field as filter by specifying <FIELD_NAME>=<VALUE>.

The following fields are useful for this question:

_COMM=, _EXE=, _CMDLINE=

The name, the executable path, and the command line of the process the journal entry originates from.

So in order to filter on the command name, use journalctl -f _COMM=<command-name>

$ journalctl -f _COMM=echo
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
Jul 25 13:52:26 mycomputer echo[25098]: test
Jul 25 13:56:08 mycomputer myapp[25213]: test

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.