SDJOURNAL(1)

💅 SDJOURNAL(1) — the extcap bestie that slurps up systemd journal entries

okay so real talk: this is the manual page for sdjournal, and yes it's a (1) — a user command, bestie, not some deep kernel lore. Buckle up 🎀

---

✨ NAME ✨

sdjournal — like, it literally provides an interface to capture systemd journal entries. that's the whole vibe. 🦋

---

🌸 SYNOPSIS 🌸

sdjournal [ --help ] [ --version ] [ --extcap-interfaces ]
[ --extcap-dlts ] [ --extcap-interface=<interface> ] [ --extcap-config ]
[ --capture ] [ --fifo=<path to file or pipe> ]
[ --start-from=<entry count> ]

that's it, that's the whole summoning ritual 💅

---

💖 DESCRIPTION 💖

so sdjournal is an extcap tool that lets you capture systemd journal entries. why would you want that? because you can use it to correlate system events with network traffic — which is honestly kind of iconic when you're debugging and the timeline finally makes sense 😭🔥

Supported interfaces — there is exactly one, and she is the main character:

1. sdjournal

---

👑 OPTIONS 👑

• --help — print program arguments. you know, the "wait what were the flags again" button 🫶
• --version — print program version. flex the build number ✨
• --extcap-interfaces — list available interfaces.
• --extcap-interface=<interface> — use the specified interface(s).
• --extcap-dlts — list the DLTs of the specified interface.
• --extcap-config — list the configuration options of the specified interface.
• --capture — start capturing from the specified interface and write the raw packet data to wherever --fifo points. this is the "go" button, no cap 🏃‍♀️
• --fifo=<path to file or pipe> — save the captured packet to a file, or send it through a pipe. your choice, bestie.
• --start-from=<entry count> — start from the last <entry count> entries, exactly like the -n or --lines argument for the tail(1) command. ngl this one has ✨lore✨:
  • values prefixed with a + sign start from the beginning of the journal 🌅
  • otherwise the count starts from the end 🌙
  • the default value is 10
  • to include all entries use +0 (yes, all of them, every last one 💀)

---

🎀 EXAMPLES 🎀

wanna see the program arguments? say less:

sdjournal --help

wanna see the program version?

sdjournal --version

wanna see the interfaces?

sdjournal --extcap-interfaces

only one interface (sdjournal) is supported, she's solo and she's thriving 💅

Example output

interface {value=sdjournal}{display=systemd journal capture}

wanna see the interface DLTs?

sdjournal --extcap-interface=sdjournal --extcap-dlts

Example output

dlt {number=147}{name=sdjournal}{display=USER0}

wanna see the interface configuration options?

sdjournal --extcap-interface=sdjournal --extcap-config

Example output

arg {number=0}{call=--start-from}{display=Starting position}{type=string}
    {tooltip=The journal starting position. Values with a leading "+" start from the beginning, similar to the "tail" command}

wanna actually capture? here's the moment:

sdjournal --extcap-interface=sdjournal --fifo=/tmp/sdjournal.pcap --capture

and to capture all entries since the system was booted (the full origin story 🌈):

sdjournal --extcap-interface=sdjournal --fifo=/tmp/sdjournal.pcap --capture --start-from +0

Note — to stop capturing, CTRL+C / kill / terminate the application. she does not stop on her own, bestie, she's committed 😤

---

🦋 SEE ALSO 🦋

wireshark(1), tshark(1), dumpcap(1), extcap(4), tcpdump(1)

the whole friend group 🫶

---

🍓 NOTES 🍓

sdjournal is part of the Wireshark distribution. the latest version of Wireshark can be found at https://www.wireshark.org — go get her 👑

HTML versions of the Wireshark project man pages are available at https://www.wireshark.org/docs/man-pages — reading man pages in a browser, we love a glow-up ✨

---

🧚 AUTHORS 🧚

Original Author

Gerald Combs <gerald[AT]wireshark.org>

---

okay that's the whole page, you ate that 💜 this was the SDJOURNAL(1) page, dated 2026-10-08 — go forth and capture, periodt 🌟💅