From: mzerqung@0pointer.de
On Wed, 17.07.13 11:48, Bill Nottingham (notting@redhat.com) wrote:
John.Florian@dart.biz (John.Florian@dart.biz) said:
You can provide binary path (_EXE=) by ”journalctl
/usr/sbin/sshd”.
Yes, but that's of little help with applications using interpreted languages (e.g., python). I want to match on the name of the python
program, not python itself.
journalctl _COMM=<blah> works for me on F19.
Also, to mention this explicitly: there is command line completion for this. I.e. type "journalctl _CO", press Tab, and it will autocomplete to "journalctl _COMM=", then press Tab Tab and it shows you a list of all values that so far have been recorded.
This is realy, really useful actually.
Huh. Given how it seems that I hit Tab nearly every other keystroke I'm surprised I hadn't stumbled onto that yet. Probably because I haven't gotten much into the habit of filtering with these terms. I'm still so pleased just having -u (and the wonderful extra info conveyed via color) that it's hard to grumble about much else. :-)
I may have avoided these largely because I knew it would take time to learn the various names. But now I know I can "journalctl _ <Tab><Tab>" and have an instant refresher. Thanks for such a well-done tool.
-- John Florian