> From: mzerqung@0pointer.de
>
> On Wed, 17.07.13 11:48, Bill Nottingham (notting@redhat.com) wrote:
>
> > John.Florian@dart.biz (John.Florian@dart.biz) said:
> > > >   You can provide binary path (_EXE=) by ”journalctl /usr/sbin/sshd”.
> > >
> > > Yes, but that's of little help with applications using interpreted
> > > languages (e.g., python).  I want to match on the name of the python
> > > program, not python itself.
> >
> > journalctl _COMM=<blah> works for me on F19.
>
> Also, to mention this explicitly: there is command line completion for
> this. I.e. type "journalctl _CO", press Tab, and it will autocomplete to
> "journalctl _COMM=", then press Tab Tab and it shows you a list of all
> values that so far have been recorded.
>
> This is realy, really useful actually.

Huh.  Given how it seems that I hit Tab nearly every other keystroke I'm surprised I hadn't stumbled onto that yet.  Probably because I haven't gotten much into the habit of filtering with these terms.  I'm still so pleased just having -u (and the wonderful extra info conveyed via color) that it's hard to grumble about much else.  :-)

I may have avoided these largely because I knew it would take time to learn the various names.  But now I know I can "journalctl _ <Tab><Tab>" and have an instant refresher.  Thanks for such a well-done tool.

--
John Florian