1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id="systemd.journal-fields">
27 <title>systemd.journal-fields</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.journal-fields</refentrytitle>
42 <manvolnum>7</manvolnum>
46 <refname>systemd.journal-fields</refname>
47 <refpurpose>Special journal fields</refpurpose>
51 <title>Description</title>
53 <para>Entries in the journal resemble an environment
54 block in their syntax, however with fields that can
55 include binary data. Primarily, fields are formatted
56 UTF-8 text strings, and binary formatting is used only
57 where formatting as UTF-8 text strings makes little
58 sense. New fields may freely be defined by
59 applications, but a few fields have special
60 meaning. All fields with special meanings are
65 <title>User Journal Fields</title>
67 <para>User fields are fields that are directly passed
68 from clients and stored in the journal.</para>
74 <para>The human readable
75 message string for this
76 entry. This is supposed to be
77 the primary text shown to the
78 user. It is usually not
79 translated (but might be in
80 some cases), and is not
81 supposed to be parsed for meta
87 <term>MESSAGE_ID=</term>
89 <para>A 128bit message
90 identifier ID for recognizing
91 certain message types, if this
92 is desirable. This should
93 contain a 128bit id formatted
94 as lower-case hexadecimal
95 string, without any separating
96 dashes or suchlike. This is
97 recommended to be a UUID
98 compatible ID, but this is not
99 enforced, and formatted
100 differently. Developers can
101 generate a new ID for this
104 --new-id</command>.</para>
109 <term>PRIORITY=</term>
111 <para>A priority value between
112 0 (<literal>emerg</literal>)
114 (<literal>debug</literal>)
116 string. This field is
117 compatible with syslog's
118 priority concept.</para>
123 <term>CODE_FILE=</term>
124 <term>CODE_LINE=</term>
125 <term>CODE_FUNC=</term>
127 <para>The code location
128 generating this message, if
129 known. Contains the source
130 file name, the line number and
131 the function name.</para>
138 <para>The low-level Unix error
139 number causing this entry, if
140 any. Contains the numeric
142 <citerefentry><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry>
149 <term>SYSLOG_FACILITY=</term>
150 <term>SYSLOG_IDENTIFIER=</term>
151 <term>SYSLOG_PID=</term>
153 <para>Syslog compatibility
154 fields containing the facility
155 (formatted as decimal string),
156 the identifier string
157 (i.e. "tag"), and the client
166 <title>Trusted Journal Fields</title>
168 <para>Fields prefixed with an underscore are trusted
169 fields, i.e. fields that are implicitly added by the
170 journal and cannot be altered by client code.</para>
178 <para>The process, user and
179 group ID of the process the
180 journal entry originates from
189 <term>_CMDLINE=</term>
191 <para>The name, the executable
192 path and the command line of
193 the process the journal entry
194 originates from.</para>
199 <term>_AUDIT_SESSION=</term>
200 <term>_AUDIT_LOGINUID=</term>
202 <para>The session and login
203 UID of the process the journal
204 entry originates from, as
205 maintained by the kernel audit
211 <term>_SYSTEMD_CGROUP=</term>
212 <term>_SYSTEMD_SESSION=</term>
213 <term>_SYSTEMD_UNIT=</term>
214 <term>_SYSTEMD_OWNER_UID=</term>
217 <para>The contol group path in
218 the systemd hierarchy, the
219 systemd session ID (if any),
220 the systemd unit name (if any)
221 and the owner UID of the
222 systemd session (if any) of
223 the process the journal entry
224 originates from.</para>
229 <term>_SELINUX_CONTEXT=</term>
231 <para>The SELinux security
232 context of the process the
233 journal entry originates
239 <term>_SOURCE_REALTIME_TIMESTAMP=</term>
241 <para>The earliest trusted
242 timestamp of the message, if
243 any is known that is different
244 from the reception time of the
245 journal. This is the time in
246 usec since the epoch UTC
253 <term>_BOOT_ID=</term>
255 <para>The kernel boot ID for
256 the boot the message was
257 generated in, formatted as
264 <term>_MACHINE_ID=</term>
266 <para>The machine ID of the
267 originating host, as available
269 <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
274 <term>_HOSTNAME=</term>
276 <para>The name of the
277 originating host.</para>
282 <term>_TRANSPORT=</term>
284 <para>How the entry was
285 received by the journal
287 <literal>driver</literal>,
288 <literal>syslog</literal>,
289 <literal>journal</literal>,
290 <literal>stdout</literal>,
291 <literal>kernel</literal> for
292 internally generated messages,
293 for those received via the
294 local syslog socket with the
295 syslog protocol, for those
296 received via the native
297 journal protocol, for the
298 those read from a services'
299 standard output or error
300 output, and for those read
301 from the kernel, resp.
309 <title>Address Fields</title>
311 <para>During serialization into external formats the
312 addresses of journal entries are serialized into
313 fields prefixed with double underscores. Note that
314 these aren't proper fields when stored in the journal,
315 but addressing meta data of entries. They cannot be
316 written as part of structured log entries via calls
318 <citerefentry><refentrytitle>sd_journal_send</refentrytitle><manvolnum>3</manvolnum></citerefentry>. They
319 may also not be used as matches for
320 <citerefentry><refentrytitle>sd_journal_add_match</refentrytitle><manvolnum>3</manvolnum></citerefentry></para>
324 <term>__CURSOR=</term>
326 <para>The cursor for the
327 entry. A cursor is an opaque
328 text string that uniquely
329 describes the position of an
330 entry in the journal and is
331 portable across machines,
332 platforms and journal
338 <term>__REALTIME_TIMESTAMP=</term>
340 <para>The wallclock time
341 (CLOCK_REALTIME) at the point
342 in time the entry was received
343 by the journal, in usec since
344 the epoch UTC formatted as
345 decimal string. This has
346 different properties from
347 <literal>_SOURCE_REALTIME_TIMESTAMP=</literal>
348 as it is usually a bit later
349 but more likely to be
355 <term>__MONOTONIC_TIMESTAMP=</term>
357 <para>The monotonic time
358 (CLOCK_MONOTONIC) at the point
359 in time the entry was received
360 by the journal in usec
362 string. To be useful as an
363 address for the entry this
364 should be combined with with
366 <literal>_BOOT_ID=</literal>.</para>
373 <title>See Also</title>
375 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
376 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
377 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
378 <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>