tui-tools

tui-logs

The journal on one screen: narrow it, follow it, and shrink it safely

A terminal UI (TUI) for journalctl on Linux: the systemd journal.

v0.2.2betalogsMIT
The journal, with the journalctl command behind what is on screen along the bottom
The journal, with the journalctl command behind what is on screen along the bottom

A terminal UI for the systemd journal. Every filter it offers is a journalctl argument — unit, priority, boot, time window, --grep, kernel only, the user journal — and the command line they add up to is on the status bar, so what is on screen is always something you could have typed.

Press enter on a line and you get the record rather than the sentence: the pid, the uid, the executable and its command line, the source file and line for a program that logs through sd-journal, the MESSAGE_ID named where it is a well-known one, and every other field it carried. There is no clipboard, so the screen shows the journalctl --cursor invocation that prints that entry instead.

A second screen counts the window: errors, the noisiest units, a sparkline. A third says what the journal costs and what journald.conf resolves to — and changes it: one key sets SystemMaxUse, MaxRetentionSec and Storage in a drop-in of its own, shown as a diff first.

Housekeeping is four more commands, each previewed and confirmed: vacuum by size or age, rotate, verify.

Run tui-logs --demo to drive a sample journal: every key works, every command is built and previewed for real, nothing is touched.

Keys

KeyAction
tab / 1-3Move between the entries, the stats for the window and the journal on disk
enterOpen the selected entry with every field it carries
fFollow: re-read what is new every two seconds
u / p / b / tFilter by unit, priority, boot or time window
/Search the journal itself with --grep, not the rows on screen
K / UKernel messages only, or your own user journal instead of the system one
cClear every filter
xExport the window to a file under your home directory
SSet the journal's retention: how much disk, for how long, and where
v / VVacuum the journal by size or by age, previewed first
oRotate: close the active journal files, delete nothing
yVerify every journal file's internal consistency
RRe-read everything
?Help
qQuit

Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.

Compatibility

This tool is a face on the program below, so its version matters. Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as (untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.

journald

journalctl ≥ 239
Binary
journalctl
Minimum
239
Probed with
journalctl --version
Tested
255259261

Needs a version this new

  • list-boots-jsonsince 252

What changes on older versions

  • journald >=239

    the version comes from journalctl --version, whose first line is systemd 257 (257.13-1.fc42); the first number is the release and the package version after it is ignored

  • journald >=239

    only one thing here is version-gated. --grep (237), --after-cursor (206) and systemd-analyze cat-config (239) all exist at or below the minimum, so they are never checked for

  • journald <252

    journalctl --list-boots cannot print JSON, so the boot list is parsed from its table instead; the picker works either way and nothing else changes

Maintain journald? You are welcome to help shape this tool. About → maintainers

Install

Once per machine, then every tool in the family is one pacman away.

Add the repository
$ curl -fsSL https://pkgs.tui.tools/install.sh | sh
Or run the same thing yourself, one command at a time

A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.

The one-time setup, by hand
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
  sudo pacman-key --add /tmp/tui-tools.asc
  sudo pacman-key --lsign-key \
    "$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
  printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
    | sudo tee -a /etc/pacman.conf
  sudo pacman -Sy
Arch Linux · tui-logs
$ sudo pacman -S tui-logs

Upgrades then arrive with the rest of your system updates.

What it can do to your machine

  • Preview, then confirm

    Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.

  • Escalates for actions

    Reading the system journal needs membership of systemd-journal, adm or wheel — no escalation at all. Only a machine that refuses that read retries it through sudo -n, which never prompts. Housekeeping and the retention drop-in always escalate, and each is previewed first.

  • No daemon, no state of its own

    Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.

  • No network access

    The tool opens no network connection of its own. No telemetry, no update check, no phone home.

  • Static binary

    Released statically linked, with no runtime dependencies to install.

  • Signed release, with provenance

    checksums.txt carries a keyless cosign signature from this repository's release workflow, every archive has a CycloneDX SBOM, and every archive, package and the checksum file carry SLSA build provenance. The security page shows the three commands that check it.

Reporting

Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.

Downloads

v0.2.2 · 2026-09-25
FileSizeSHA-256
checksums.txt1006 B—
checksums.txt.sigstore.json10 KB—
provenance.intoto.jsonl12 KB—
tui-logs-0.2.2-1-aarch64.pkg.tar.zst1.7 MB41816413b4b8eeb349accb01c2b177025bd9bc34bfae148cd1b286adb1ca53aa
tui-logs-0.2.2-1-x86_64.pkg.tar.zst1.9 MB2dbb30f45cdfb27b6b09f45cf2c19608a5993b97512c155b3d6147eb7481e3fe
tui-logs-0.2.2-1.aarch64.rpm1.7 MBa56b8d771a968669e9d209a06c2a34a4e6e732ef75ec444af8d3b7e5912cb076
tui-logs-0.2.2-1.x86_64.rpm1.9 MBe5fade2dff202cf8b968a8f566b4eeb9262176fa88bc122b33481b249fed4668
tui-logs_0.2.2_amd64.deb1.9 MBa4060fd3d618eef94c333fb32852bec8752b6f3820c0f413809271623a25b51a
tui-logs_0.2.2_arm64.deb1.7 MBfe17a36ee9d87e158e00429e728dc20290b87c6f3d38b5a701b457d9724d79a4
tui-logs_0.2.2_linux_amd64.tar.gz1.9 MBb574f46655699c8eb2055c68832a1479070d215188554014ccc6e2e91194a01e
tui-logs_0.2.2_linux_amd64.tar.gz.cyclonedx.json23 KB1b38660b3f98cd4dfe95d0988f77bd5dd16bbcf10061478cc8ae0968cffabd1f
tui-logs_0.2.2_linux_arm64.tar.gz1.7 MBdf740a40d760cff3465b2b3430077b6f1740115d29f61be97cf2519e4b3d44ba
tui-logs_0.2.2_linux_arm64.tar.gz.cyclonedx.json23 KB67a1819c2b64332cbdb9ab749e014ebbca6d6a9434d45c1db7304dd9e8e5b40d

Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.

Releases

v0.2.2

2026-09-25
## tui-logs v0.2.2

tui-logs 0.2.2

Closes #17

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* e952ec8cb970da4ddd34ccf822ef633336ad16ef Bump anchore/sbom-action/download-syft (#3)
* b8353cf6091624ec5796253160aa02671de275d7 Bump anchore/sbom-action/download-syft in the github-actions group (#15)
* 11ca11218a68ac0fa693ab650a48e19e52ec35e8 Bump the github-actions group with 4 updates (#16)
* f6a76260a8e72836fc8417b1b4c2697df9c09cc5 README: link the tool's page on tui.tools (#14)
* 89876bdad48a67b6d4c54cbbd1a6469e548d57a6 README: point the install snippet at the current release (#13)
* 94697103da0b27cee11e10950ed2477535369d4b Take tui-kit v0.4.4: actions are bounded by MutationTimeout (#18)

v0.2.1

2026-09-02
## tui-logs v0.2.1

Build the unit picker from the journal, and let a name be typed.

Also: tui-kit v0.3.0 — dialogs wrap and scroll instead of clipping the
command preview, and the picker filters as you type.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* f7ab6457f2f8ec1ea44d54c5e96793fa1fdcfd39 Build the unit picker from the journal, and let a name be typed (#11)
* fd0b603b8141c70f38115858fc62c89fe4a52b7d Bump tui-kit to v0.3.0 (#12)

v0.2.0

2026-09-01
## tui-logs v0.2.0

Manage, not view (wave 3): create what does not exist, edit what does; lab-validated.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 60c9b4cfdb75c10d42fd3edbec7f8db29bb879c3 A code of conduct that fits on one screen (#8)
* 0f7f3ac16cc2d8f9d73714e7d541a60707810241 Add --report, and a bug form that asks for it (#9)
* 16fb981a3cac61c12ccd5c879a5008c4cb77c80f Carry the OpenSSF Best Practices badge (#6)
* 8581b9977e3647104d0dd9c0c5e422434e6ad7af Fetch the tag annotation before releasing (#4)
* a4a282892c300e595bce7820556ce9f237b23e28 Journal retention from the TUI (#10)
* 203bb2f723855ae1b2636589eefe65a4b9f89c66 Pin what CI runs, fuzz the parsers, and say the releases are signed (#2)
* be93ac536a9ca71cec28f82e623ea8372375dfbd Print the whole tag message, not only its body (#5)
* 45995f95a9845fce199d8fc08dc65bc9e619c991 Take tui-kit v0.2.8: hashed pip install, provenance bundle on the release (#7)

v0.1.2

2026-08-30
## Changelog
* f160784744993d66e426bf1e6fa9a92e37881cfc Drop cross-repo dispatch; the package repo and the site poll releases
* 5c1359287ab43a0ff4882d7e59eaa81da94c87b9 Gate the release on a security job, and sign what it publishes (#1)
* eaec340d98fa825cbe56fb7818ba2e32aef0b5d4 Stop telling readers the packages are unpublished

v0.1.1

2026-08-30
## Changelog
* 6851df6136dd63d865fe5d703bd9ea9ac1fc6fa1 Packages are available from pkgs.tui.tools
* 9e8703157d723becd9af69f926fafa2966d18841 Re-pin the kit at v0.2.3
* 73a7e4420c57318a1866d1e39d6af3616e1fb188 Say which journal is on screen, and prove the boot list against real systemd
* 141a0cfd432e0c2157d0c6dd5ff11586ddb5aa7a Ship the tool as a .deb, an .rpm and a pacman package

v0.1.0

2026-08-30
## Changelog
* 20d418ba402686356e078d73f98cf2df57f3412f Initial commit
* 23312716c2b92f78af373d2918130a0501b88dc7 Turn the template into tui-logs