10

Can I somehow make journalctl print log levels next to actual messages?

I have found the -p option but that is not what I'm looking for, I want to see both errors and warnings but I want to be able to tell them apart.

The only thing I have found is this from man journalctl:

When outputting to a tty, lines are colored according to priority: lines of level ERROR and higher are colored red; lines of level NOTICE and higher are highlighted; other lines are displayed normally.

This is a nice start, but I would still like to tell apart all 8 levels, not aggregate them in just three.

Improve this question

1 Answer 1

Reset to default
7

The one option is to use output formatting options. For example journalctl -o verbose will show you all data connected to a particular entry. Example:

Wed 2017-02-08 21:06:27.524361 EET [s=f689734c6c674cfd98a49e66c3349fdd;i=42c;b=01111969442644239da701153bd49c37;m=23e9195;t=548098fc53333;x=c943c53e7411726]
    PRIORITY=6
    SYSLOG_FACILITY=3
    CODE_FILE=src/core/job.c
    CODE_LINE=804
    CODE_FUNCTION=job_log_status_message
    SYSLOG_IDENTIFIER=systemd
    MESSAGE_ID=39f53479d3a045ac8e11786248231fbf
    USER_UNIT=timers.target
    MESSAGE=Reached target Timers.
    RESULT=done
    _TRANSPORT=journal
    _PID=874
    _UID=1000
    _GID=1000
    _COMM=systemd
    _EXE=/usr/lib/systemd/systemd
    _CMDLINE=/usr/lib/systemd/systemd --user
    _CAP_EFFECTIVE=0
    _SYSTEMD_CGROUP=/user.slice/user-1000.slice/user@1000.service/init.scope
    _SYSTEMD_OWNER_UID=1000
    _SYSTEMD_UNIT=user@1000.service
    _SYSTEMD_USER_UNIT=init.scope
    _SYSTEMD_SLICE=user-1000.slice
    _SYSTEMD_USER_SLICE=-.slice
    _SYSTEMD_INVOCATION_ID=2f397502a38947d5b18eca7eb5f5b1ba
    _SOURCE_REALTIME_TIMESTAMP=1486580787524361
    _BOOT_ID=01111969442644239da701153bd49c37
    _MACHINE_ID=4de8a7d0aad84611b2e1dfb0ff8f43e7
    _HOSTNAME=dracula

Here field PRIORITY actually points to a message level (in this particular case it's INFO level). Levels map in this way:

0: emerg
1: alert
2: crit
3: err
4: warning
5: notice
6: info
7: debug

I don't think you can avoid other metadata and only leave message level (correct me if I'm wrong) without some kind of post-processing (custom shell script etc).

Improve this answer
5
  • 1
    See an answer to this question as well: serverfault.com/questions/740081/…
    – ddnomad
    Dec 2, 2017 at 19:11
  • I feared I would have to write scripts for it if I really wanted it, but this actually simplifies things a lot. It just seems weird that there is no particular order of the fields and some messages have it differently
    – Ordoshsen
    Dec 2, 2017 at 19:50
  • @Ordoshsen I guess some fields are optional and so on. Yes, after your question I also wonder why it's not a simple flag or something.
    – ddnomad
    Dec 2, 2017 at 19:53
  • @Ordoshsen - not on a systemd machine right now but anyway... I'd use something like journalctl -b -o json | jq ... i.e. use json output and pipe that to jq to extract only the stuff you need (like PRIORITY, TIMESTAMP, MESSAGE). I guess you could also try to do it via python-systemd
    – don_crissti
    Dec 2, 2017 at 19:58
  • 1
    Building on @don_crissti's comment, the following prints the priority level, command, time, and the message: journalctl --boot -o json | jq -r '"Priority: " + .PRIORITY + " on " + .SYSLOG_TIMESTAMP + "command: " + ._CMDLINE + ": " + .MESSAGE'
    – Matthias Braun
    Sep 9, 2021 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.