From: tomek@pipebreaker.pl
On Wed, Jul 17, 2013 at 10:48:55AM -0400, John.Florian@dart.biz wrote:
From: John.Florian@dart.biz With journalctl's built-in filtering capabilities I'm glad I don't have to do that anymore; it's way more concise.
I do wish journalctl had a -C option (like ps) to be equivalent to
_COMM=
much like -u equates to _SYSTEMD_UNIT. I realize if all the fields
were
thusly accessible it would result in option bloat quickly, but I'd
think
filtering on _COMM is quite routine -- it is for me at least.
You can provide binary path (_EXE=) by ”journalctl /usr/sbin/sshd”.
Yes, but that's of little help with applications using interpreted languages (e.g., python). I want to match on the name of the python program, not python itself.
-- John Florian