On Wed, Jul 17, 2013 at 10:48:55AM -0400, John.Florian@dart.biz wrote:
From: John.Florian@dart.biz With journalctl's built-in filtering capabilities I'm glad I don't have to do that anymore; it's way more concise.
I do wish journalctl had a -C option (like ps) to be equivalent to _COMM= much like -u equates to _SYSTEMD_UNIT. I realize if all the fields were thusly accessible it would result in option bloat quickly, but I'd think filtering on _COMM is quite routine -- it is for me at least.
You can provide binary path (_EXE=) by ”journalctl /usr/sbin/sshd”.