How to use systemd’s journalctl patterns

arch-linuxjournaldsystemd

I am trying to use journalctl's pattern matching on SYSLOG_IDENTIFIERS. As an example, I have a ton of message tagged sshd:

$ journalctl -t sshd | wc -l
987

but if I try to use pattern matching to find them:

$ journalctl -t 'ssh*'
-- No Entries --
$ journalctl -t 'ssh.*'
-- No Entries --

The journalctl man page says patterns should work, but I can't find anything else about how patterns are used/defined in systemd.

$ man journalctl
....
-t, --identifier=SYSLOG_IDENTIFIER|PATTERN
       Show messages for the specified syslog identifier SYSLOG_IDENTIFIER,
       or for any of the messages with a "SYSLOG_IDENTIFIER" matched by PATTERN.

I'm running ArchLinux:

$ journalctl --version
systemd 225
+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP
+GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID -ELFUTILS +KMOD +IDN

Best Answer

This was a doc bug that was closed when the typo in the man page was updated.

The bug report led to the following comments in the code:

We don't actually accept patterns, hence don't claim so.

As a workaround, you may be able to use grep as suggested in the comments to your question. Something like this:

journalctl | grep sshd
Related Topic