1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id="systemd.journal-fields">
27 <title>systemd.journal-fields</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.journal-fields</refentrytitle>
42 <manvolnum>7</manvolnum>
46 <refname>systemd.journal-fields</refname>
47 <refpurpose>Special journal fields</refpurpose>
51 <title>Description</title>
53 <para>Entries in the journal resemble an environment
54 block in their syntax, however with fields that can
55 include binary data. Primarily, fields are formatted
56 ASCII strings, and binary formatting is used only
57 where formatting as ASCII makes little sense. New
58 fields may be freely defined by applications, but a
59 few fields have special meaning. All fields with
60 special meaning are optional.</para>
64 <title>User Journal Fields</title>
66 <para>User fields are fields that are directly passed
67 from clients and stored in the journal.</para>
73 <para>The human readable
74 message string for this
75 entry. This is supposed to be
76 the primary text shown to the
77 user. It is usually not
78 translated (but might be in
79 some cases), and is not
80 supposed to be parsed for meta
86 <term>MESSAGE_ID=</term>
88 <para>A 128bit message
89 identifier ID for recognizing
90 certain message types, if this
91 is desirable. This should
92 contain a 128bit id formatted
93 as lower-case hexadecimal
94 string, without any separating
95 dashes or suchlike. This is
96 recommended to be a UUID
97 compatible ID, but this is not
98 enforced, and formatted
99 differently. Developers can
100 generate a new ID for this
103 --new-id</command>.</para>
108 <term>PRIORITY=</term>
110 <para>A priority value between
111 0 (<literal>emerg</literal>)
113 (<literal>debug</literal>)
115 string. This field is
116 compatible with syslog's
117 priority concept.</para>
122 <term>CODE_FILE=</term>
123 <term>CODE_LINE=</term>
124 <term>CODE_FUNC=</term>
126 <para>The code location
127 generating this message, if
128 known. Contains the source
129 file name, the line number and
130 the function name.</para>
135 <term>SYSLOG_FACILITY=</term>
136 <term>SYSLOG_IDENTIFIER=</term>
137 <term>SYSLOG_PID=</term>
139 <para>Syslog compatibility
140 fields containing the facility
141 (formatted as decimal string),
142 the identifier string
143 (i.e. "tag"), and the client
152 <title>Trusted Journal Fields</title>
154 <para>Fields prefixed with an underscore are trusted
155 fields, i.e. fields that are implicitly added by the
156 journal and cannot be altered by client code.</para>
164 <para>The process, user and
165 group ID of the process the
166 journal entry originates from
175 <term>_CMDLINE=</term>
177 <para>The name, the executable
178 path and the command line of
179 the process the journal entry
180 originates from.</para>
185 <term>_AUDIT_SESSION=</term>
186 <term>_AUDIT_LOGINUID=</term>
188 <para>The session and login
189 UID of the process the journal
190 entry originates from, as
191 maintained by the kernel audit
197 <term>_SYSTEMD_CGROUP=</term>
198 <term>_SYSTEMD_SESSION=</term>
199 <term>_SYSTEMD_UNIT=</term>
200 <term>_SYSTEMD_OWNER_UID=</term>
203 <para>The contol group path in
204 the systemd hierarchy, the
205 systemd session ID (if any),
206 the systemd unit name (if any)
207 and the owner UID of the
208 systemd session (if any) of
209 the process the journal entry
210 originates from.</para>
215 <term>_SELINUX_CONTEXT=</term>
217 <para>The SELinux security
218 context of the process the
219 journal entry originates
225 <term>_SOURCE_REALTIME_TIMESTAMP=</term>
227 <para>The earliest trusted
228 timestamp of the message, if
229 any is known that is different
230 from the reception time of the
231 journal. This is the time in
232 usec since the epoch UTC
239 <term>_BOOT_ID=</term>
241 <para>The kernel boot ID for
242 the boot the message was
243 generated in, formatted as
250 <term>_MACHINE_ID=</term>
252 <para>The machine ID of the
253 originating host, as available
255 <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
260 <term>_HOSTNAME=</term>
262 <para>The name of the
263 originating host.</para>
268 <term>_TRANSPORT=</term>
270 <para>How the entry was
271 received by the journal
273 <literal>driver</literal>,
274 <literal>syslog</literal>,
275 <literal>journal</literal>,
276 <literal>stdout</literal>,
277 <literal>kernel</literal> for
278 internally generated messages,
279 for those received via the
280 local syslog socket with the
281 syslog protocol, for those
282 received via the native
283 journal protocol, for the
284 those read from a services'
285 standard output or error
286 output, and for those read
287 from the kernel, resp.
295 <title>Address Fields</title>
297 <para>During serialization into external formats the
298 addresses of journal entries are serialized into
299 fields prefixed with double underscores. Note that
300 these aren't proper fields when stored in the journal,
301 but addressing meta data of entries.</para>
305 <term>__CURSOR=</term>
307 <para>The cursor for the
308 entry. A cursor is an opaque
309 text string that uniquely
310 describes the position of an
311 entry in the journal and is
312 portable across machines,
313 platforms and journal
319 <term>__REALTIME_TIMESTAMP=</term>
321 <para>The wallclock time
322 (CLOCK_REALTIME) at the point
323 in time the entry was received
324 by the journal, in usec since
325 the epoch UTC formatted as
326 decimal string. This has
327 different properties from
328 <literal>_SOURCE_REALTIME_TIMESTAMP=</literal>
329 as it is usually a bit later
330 but more likely to be
336 <term>__MONOTONIC_TIMESTAMP=</term>
338 <para>The monotonic time
339 (CLOCK_MONOTONIC) at the point
340 in time the entry was received
341 by the journal in usec
343 string. To be useful as an
344 address for the entry this
345 should be combined with with
347 <literal>_BOOT_ID=</literal>.</para>
354 <title>See Also</title>
356 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
357 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
358 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>