How to filter journalctl output by process name?

Question

When a process logs to systemd, its process name is recorded and displayed as identifier in the journalctl output.

$ systemd-cat echo "test"
$ journalctl -f
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
...
Jul 25 13:52:26 mycomputer echo[25098]: test

Filtering on that name, however, doesn't seem to work.

$ journalctl -f -t echo
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
$ journalctl -f -u echo
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --

When I manually specify an identifier, the identifier is shown instead of the process name and filtering works.

$ systemd-cat -t myapp echo "test"
$ journalctl -f
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
Jul 25 13:56:08 mycomputer myapp[25213]: test
$ journalctl -f -t myapp
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
Jul 25 13:56:08 mycomputer myapp[25213]: test

How can I filter journalctl output on process name?

score 7 · Accepted Answer · answered Jul 25 '18 at 12:12

Just figured this out. You can use any systemd journal field as filter by specifying <FIELD_NAME>=<VALUE>.

The following fields are useful for this question:

_COMM=, _EXE=, _CMDLINE=

The name, the executable path, and the command line of the process the journal entry originates from.

So in order to filter on the command name, use journalctl -f _COMM=<command-name>

$ journalctl -f _COMM=echo
-- Logs begin at Sat 2018-02-24 12:13:24 CET. --
Jul 25 13:52:26 mycomputer echo[25098]: test
Jul 25 13:56:08 mycomputer myapp[25213]: test

How to filter journalctl output by process name?

1 Answers1