Component URL

/cockpit+app/@localhost/system/logs.html

Filter by priority

#?prio=notice

Filters the log to show entries below the specific priority, inclusive. These priorities are syslog level keywords. Specifying * as a priority will show all available entries. The default priority is err.

Filter by service

#?service=sshd.service

Filters the log to show entries related to the specific service. The format of the service is specific to the logging implementation. For journald these are systemd service unit names.

Filter by tag

#?tag=kernel

Filters the log to show entries related to the specific syslog identifier.

Filter by message

#?grep=

Filters the log to show entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used. If the pattern is all lowercase, matching is case insensitive. Otherwise, matching is case sensitive.

Filter by any field

#?FIELD=VALUE

A field is referring to the components of a structured journal entry. The match must be exact. Value can be comma separated list in which case they are automatically matched as alternatives.

Start at point

#?start=boot

Filters the log to show entries after the specific point in time. Valid values are boot (since last boot), last-24h (last 24 hours), last-week (last seven days) and previous-boot (previous boot).

Follow the journal

#?follow=true

Keep listening on new entries. Valid values are true (follow) and false (do not follow).

Show log entry

#/6e272d82993c4e0d...

To show a specific log entry, put the log entry cursor in a path after the hash above. Note that cursors are logging system specific, and journal cursors are subject to change.