chiark / gitweb /
~ianmdlvl / elogind.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
run: add a new "-t" mode for invoking a binary on an allocated TTY
[elogind.git] / man / systemd.journal-fields.xml
diff --git a/man/systemd.journal-fields.xml b/man/systemd.journal-fields.xml
index 5f2a32cb00e29a2b44d6a10964be2bf9cfc6b2dd..154b95ac7e2e3f8ca3752bab54411491e18281ed 100644 (file)
--- a/man/systemd.journal-fields.xml
+++ b/man/systemd.journal-fields.xml
@@ -8,16 +8,16 @@
   Copyright 2010 Lennart Poettering
 
   systemd is free software; you can redistribute it and/or modify it
   Copyright 2010 Lennart Poettering
 
   systemd is free software; you can redistribute it and/or modify it
-  under the terms of the GNU General Public License as published by
-  the Free Software Foundation; either version 2 of the License, or
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
   (at your option) any later version.
 
   systemd is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
   (at your option) any later version.
 
   systemd is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  General Public License for more details.
+  Lesser General Public License for more details.
 
 
-  You should have received a copy of the GNU General Public License
+  You should have received a copy of the GNU Lesser General Public License
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 -->
 
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 -->
 
@@ -51,13 +51,15 @@
                 <title>Description</title>
 
                 <para>Entries in the journal resemble an environment
                 <title>Description</title>
 
                 <para>Entries in the journal resemble an environment
-                block in their syntax, however with fields that can
+                block in their syntax but with fields that can
                 include binary data. Primarily, fields are formatted
                 include binary data. Primarily, fields are formatted
-                ASCII strings, and binary formatting is used only
-                where formatting as ASCII makes little sense. New
-                fields may be freely defined by applications, but a
-                few fields have special meaning. All fields with
-                special meaning are optional.</para>
+                UTF-8 text strings, and binary formatting is used only
+                where formatting as UTF-8 text strings makes little
+                sense. New fields may freely be defined by
+                applications, but a few fields have special
+                meaning. All fields with special meanings are
+                optional. In some cases, fields may appear more than
+                once per entry.</para>
         </refsect1>
 
         <refsect1>
         </refsect1>
 
         <refsect1>
@@ -66,50 +68,52 @@
                 <para>User fields are fields that are directly passed
                 from clients and stored in the journal.</para>
 
                 <para>User fields are fields that are directly passed
                 from clients and stored in the journal.</para>
 
-                <variablelist>
+                <variablelist class='journal-directives'>
                         <varlistentry>
                         <varlistentry>
-                                <term>MESSAGE=</term>
+                                <term><varname>MESSAGE=</varname></term>
                                 <listitem>
                                 <listitem>
-                                        <para>The human readable
+                                        <para>The human-readable
                                         message string for this
                                         entry. This is supposed to be
                                         the primary text shown to the
                                         message string for this
                                         entry. This is supposed to be
                                         the primary text shown to the
-                                        user. It is not translated,
-                                        and is not supposed to be
-                                        parsed for meta data.</para>
+                                        user. It is usually not
+                                        translated (but might be in
+                                        some cases), and is not
+                                        supposed to be parsed for meta
+                                        data.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>MESSAGE_ID=</term>
+                                <term><varname>MESSAGE_ID=</varname></term>
                                 <listitem>
                                 <listitem>
-                                        <para>A 128bit message
+                                        <para>A 128-bit message
                                         identifier ID for recognizing
                                         certain message types, if this
                                         is desirable. This should
                                         identifier ID for recognizing
                                         certain message types, if this
                                         is desirable. This should
-                                        contain a 128bit id formatted
-                                        as lower-case hexadecimal
+                                        contain a 128-bit ID formatted
+                                        as a lower-case hexadecimal
                                         string, without any separating
                                         dashes or suchlike. This is
                                         string, without any separating
                                         dashes or suchlike. This is
-                                        recommended to be a UUID
-                                        compatible ID, but this is not
+                                        recommended to be a
+                                        UUID-compatible ID, but this is not
                                         enforced, and formatted
                                         differently. Developers can
                                         generate a new ID for this
                                         enforced, and formatted
                                         differently. Developers can
                                         generate a new ID for this
-                                        purpose with
-                                        <command>journalctl
-                                        --new-id</command>.</para>
+                                        purpose with <command>journalctl
+                                        <option>--new-id</option></command>.
+                                        </para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>PRIORITY=</term>
+                                <term><varname>PRIORITY=</varname></term>
                                 <listitem>
                                         <para>A priority value between
                                         0 (<literal>emerg</literal>)
                                         and 7
                                         (<literal>debug</literal>)
                                 <listitem>
                                         <para>A priority value between
                                         0 (<literal>emerg</literal>)
                                         and 7
                                         (<literal>debug</literal>)
-                                        formatted as decimal
+                                        formatted as a decimal
                                         string. This field is
                                         compatible with syslog's
                                         priority concept.</para>
                                         string. This field is
                                         compatible with syslog's
                                         priority concept.</para>
@@ -117,29 +121,45 @@
                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>CODE_FILE=</term>
-                                <term>CODE_LINE=</term>
-                                <term>CODE_FUNC=</term>
+                                <term><varname>CODE_FILE=</varname></term>
+                                <term><varname>CODE_LINE=</varname></term>
+                                <term><varname>CODE_FUNC=</varname></term>
                                 <listitem>
                                         <para>The code location
                                         generating this message, if
                                         known. Contains the source
                                 <listitem>
                                         <para>The code location
                                         generating this message, if
                                         known. Contains the source
-                                        file name, the line number and
+                                        filename, the line number and
                                         the function name.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                         the function name.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>SYSLOG_FACILITY=</term>
-                                <term>SYSLOG_IDENTIFIER=</term>
-                                <term>SYSLOG_PID=</term>
+                                <term><varname>ERRNO=</varname></term>
+                                <listitem>
+                                        <para>The low-level Unix error
+                                        number causing this entry, if
+                                        any. Contains the numeric
+                                        value of
+                                        <citerefentry project='man-pages'><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+                                        formatted as a decimal
+                                        string.</para>
+                                </listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><varname>SYSLOG_FACILITY=</varname></term>
+                                <term><varname>SYSLOG_IDENTIFIER=</varname></term>
+                                <term><varname>SYSLOG_PID=</varname></term>
                                 <listitem>
                                         <para>Syslog compatibility
                                         fields containing the facility
                                         (formatted as decimal string),
                                         the identifier string
                                         (i.e. "tag"), and the client
                                 <listitem>
                                         <para>Syslog compatibility
                                         fields containing the facility
                                         (formatted as decimal string),
                                         the identifier string
                                         (i.e. "tag"), and the client
-                                        PID.</para>
+                                        PID. (Note that the tag is
+                                        usually derived from glibc's
+                                        <varname>program_invocation_short_name</varname>
+                                        variable, see <citerefentry><refentrytitle>program_invocation_short_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.)</para>
                                 </listitem>
 
                         </varlistentry>
                                 </listitem>
 
                         </varlistentry>
@@ -153,35 +173,44 @@
                 fields, i.e. fields that are implicitly added by the
                 journal and cannot be altered by client code.</para>
 
                 fields, i.e. fields that are implicitly added by the
                 journal and cannot be altered by client code.</para>
 
-                <variablelist>
+                <variablelist class='journal-directives'>
                         <varlistentry>
                         <varlistentry>
-                                <term>_PID=</term>
-                                <term>_UID=</term>
-                                <term>_GID=</term>
+                                <term><varname>_PID=</varname></term>
+                                <term><varname>_UID=</varname></term>
+                                <term><varname>_GID=</varname></term>
                                 <listitem>
                                 <listitem>
-                                        <para>The process, user and
+                                        <para>The process, user, and
                                         group ID of the process the
                                         journal entry originates from
                                         group ID of the process the
                                         journal entry originates from
-                                        formatted as decimal
+                                        formatted as a decimal
                                         string.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                         string.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_COMM=</term>
-                                <term>_EXE=</term>
-                                <term>_CMDLINE=</term>
+                                <term><varname>_COMM=</varname></term>
+                                <term><varname>_EXE=</varname></term>
+                                <term><varname>_CMDLINE=</varname></term>
                                 <listitem>
                                         <para>The name, the executable
                                 <listitem>
                                         <para>The name, the executable
-                                        path and the command line of
+                                        path, and the command line of
                                         the process the journal entry
                                         originates from.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                         the process the journal entry
                                         originates from.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_AUDIT_SESSION=</term>
-                                <term>_AUDIT_LOGINUID=</term>
+                                <term><varname>_CAP_EFFECTIVE=</varname></term>
+                                <listitem>
+                                        <para>The effective <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> of
+                                        the process the journal entry
+                                        originates from.</para>
+                                </listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><varname>_AUDIT_SESSION=</varname></term>
+                                <term><varname>_AUDIT_LOGINUID=</varname></term>
                                 <listitem>
                                         <para>The session and login
                                         UID of the process the journal
                                 <listitem>
                                         <para>The session and login
                                         UID of the process the journal
@@ -192,59 +221,65 @@
                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_SYSTEMD_CGROUP=</term>
-                                <term>_SYSTEMD_SESSION=</term>
-                                <term>_SYSTEMD_UNIT=</term>
-                                <term>_SYSTEMD_OWNER_UID=</term>
+                                <term><varname>_SYSTEMD_CGROUP=</varname></term>
+                                <term><varname>_SYSTEMD_SESSION=</varname></term>
+                                <term><varname>_SYSTEMD_UNIT=</varname></term>
+                                <term><varname>_SYSTEMD_USER_UNIT=</varname></term>
+                                <term><varname>_SYSTEMD_OWNER_UID=</varname></term>
+                                <term><varname>_SYSTEMD_SLICE=</varname></term>
 
                                 <listitem>
 
                                 <listitem>
-                                        <para>The contol group path in
-                                        the systemd hierarchy, the
+                                        <para>The control group path
+                                        in the systemd hierarchy, the
                                         systemd session ID (if any),
                                         systemd session ID (if any),
-                                        the systemd unit name (if any)
-                                        and the owner UID of the
-                                        systemd session (if any) of
-                                        the process the journal entry
-                                        originates from.</para>
+                                        the systemd unit name (if
+                                        any), the systemd user session
+                                        unit name (if any), the owner
+                                        UID of the systemd session (if
+                                        any) and the systemd slice
+                                        unit of the process the
+                                        journal entry originates
+                                        from.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_SELINUX_CONTEXT=</term>
+                                <term><varname>_SELINUX_CONTEXT=</varname></term>
                                 <listitem>
                                         <para>The SELinux security
                                 <listitem>
                                         <para>The SELinux security
-                                        context of the process the
-                                        journal entry originates
+                                        context (label) of the process
+                                        the journal entry originates
                                         from.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                         from.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_SOURCE_REALTIME_TIMESTAMP=</term>
+                                <term><varname>_SOURCE_REALTIME_TIMESTAMP=</varname></term>
                                 <listitem>
                                         <para>The earliest trusted
                                         timestamp of the message, if
                                         any is known that is different
                                         from the reception time of the
                                 <listitem>
                                         <para>The earliest trusted
                                         timestamp of the message, if
                                         any is known that is different
                                         from the reception time of the
-                                        journal. The time in usec
-                                        since the epoch formatted as
-                                        decimal string.</para>
+                                        journal. This is the time in
+                                        microseconds since the epoch UTC,
+                                        formatted as a decimal
+                                        string.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_BOOT_ID=</term>
+                                <term><varname>_BOOT_ID=</varname></term>
                                 <listitem>
                                         <para>The kernel boot ID for
                                         the boot the message was
                                         generated in, formatted as
                                 <listitem>
                                         <para>The kernel boot ID for
                                         the boot the message was
                                         generated in, formatted as
-                                        128bit hexadecimal
+                                        a 128-bit hexadecimal
                                         string.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                         string.</para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_MACHINE_ID=</term>
+                                <term><varname>_MACHINE_ID=</varname></term>
                                 <listitem>
                                         <para>The machine ID of the
                                         originating host, as available
                                 <listitem>
                                         <para>The machine ID of the
                                         originating host, as available
@@ -254,27 +289,259 @@
                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>_HOSTNAME=</term>
+                                <term><varname>_HOSTNAME=</varname></term>
                                 <listitem>
                                         <para>The name of the
                                         originating host.</para>
                                 </listitem>
                         </varlistentry>
                                 <listitem>
                                         <para>The name of the
                                         originating host.</para>
                                 </listitem>
                         </varlistentry>
+
+                        <varlistentry>
+                                <term><varname>_TRANSPORT=</varname></term>
+                                <listitem>
+                                        <para>How the entry was
+                                        received by the journal
+                                        service. Valid transports are:
+                                        </para>
+                                        <variablelist>
+                                                <varlistentry>
+                                                        <term>
+                                                                <option>driver</option>
+                                                        </term>
+                                                        <listitem>
+                                                                <para>for
+                                                                internally
+                                                                generated
+                                                                messages
+                                                                </para>
+                                                        </listitem>
+                                                </varlistentry>
+
+                                                <varlistentry>
+                                                        <term>
+                                                                <option>syslog</option>
+                                                        </term>
+                                                        <listitem>
+                                                                <para>for those
+                                                                received via the
+                                                                local syslog
+                                                                socket with the
+                                                                syslog protocol
+                                                                </para>
+                                                        </listitem>
+                                                </varlistentry>
+
+                                                <varlistentry>
+                                                        <term>
+                                                                <option>journal</option>
+                                                        </term>
+                                                        <listitem>
+                                                                <para>for those
+                                                                received via the
+                                                                native journal
+                                                                protocol
+                                                                </para>
+                                                        </listitem>
+                                                </varlistentry>
+
+                                                <varlistentry>
+                                                        <term>
+                                                                <option>stdout</option>
+                                                        </term>
+                                                        <listitem>
+                                                                <para>for those
+                                                                read from a
+                                                                service's
+                                                                standard output
+                                                                or error output
+                                                                </para>
+                                                        </listitem>
+                                                </varlistentry>
+
+                                                <varlistentry>
+                                                        <term>
+                                                                <option>kernel</option>
+                                                        </term>
+                                                        <listitem>
+                                                                <para>for those
+                                                                read from the
+                                                                kernel
+                                                                </para>
+                                                        </listitem>
+                                                </varlistentry>
+                                        </variablelist>
+                                </listitem>
+                        </varlistentry>
                 </variablelist>
         </refsect1>
 
         <refsect1>
                 </variablelist>
         </refsect1>
 
         <refsect1>
-                <title>Address Fields</title>
+                <title>Kernel Journal Fields</title>
+
+                <para>Kernel fields are fields that are used by
+                messages originating in the kernel and stored in the
+                journal.</para>
+
+                <variablelist class='journal-directives'>
+                        <varlistentry>
+                                <term><varname>_KERNEL_DEVICE=</varname></term>
+                                <listitem>
+                                        <para>The kernel device
+                                        name. If the entry is
+                                        associated to a block device,
+                                        the major and minor of the
+                                        device node, separated by <literal>:</literal>
+                                        and prefixed by <literal>b</literal>. Similar
+                                        for character devices but
+                                        prefixed by <literal>c</literal>. For network
+                                        devices, this is the interface index
+                                        prefixed by <literal>n</literal>. For all other
+                                        devices, this is the subsystem name
+                                        prefixed by <literal>+</literal>, followed by
+                                        <literal>:</literal>, followed by the kernel
+                                        device name.</para>
+                                </listitem>
+                        </varlistentry>
+                        <varlistentry>
+                                <term><varname>_KERNEL_SUBSYSTEM=</varname></term>
+                                <listitem>
+                                        <para>The kernel subsystem name.</para>
+                                </listitem>
+                        </varlistentry>
+                        <varlistentry>
+                                <term><varname>_UDEV_SYSNAME=</varname></term>
+                                <listitem>
+                                        <para>The kernel device name
+                                        as it shows up in the device
+                                        tree below
+                                        <filename>/sys</filename>.</para>
+                                </listitem>
+                        </varlistentry>
+                        <varlistentry>
+                                <term><varname>_UDEV_DEVNODE=</varname></term>
+                                <listitem>
+                                        <para>The device node path of
+                                        this device in
+                                        <filename>/dev</filename>.</para>
+                                </listitem>
+                        </varlistentry>
+                        <varlistentry>
+                                <term><varname>_UDEV_DEVLINK=</varname></term>
+                                <listitem>
+                                        <para>Additional symlink names
+                                        pointing to the device node in
+                                        <filename>/dev</filename>. This
+                                        field is frequently set more
+                                        than once per entry.</para>
+                                </listitem>
+                        </varlistentry>
+                </variablelist>
+        </refsect1>
+
+        <refsect1>
+                <title>Fields to log on behalf of a different program</title>
+
+                <para>Fields in this section are used by programs
+                to specify that they are logging on behalf of another
+                program or unit.
+                </para>
+
+                <para>Fields used by the <command>systemd-coredump</command>
+                coredump kernel helper:
+                </para>
+
+                <variablelist class='journal-directives'>
+                        <varlistentry>
+                                <term><varname>COREDUMP_UNIT=</varname></term>
+                                <term><varname>COREDUMP_USER_UNIT=</varname></term>
+                                <listitem>
+                                        <para>Used to annotate
+                                        messages containing coredumps from
+                                        system and session units.
+                                        See
+                                        <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
+                                        </para>
+                                </listitem>
+                        </varlistentry>
+                </variablelist>
+
+                <para>Priviledged programs (currently UID 0) may
+                attach <varname>OBJECT_PID=</varname> to a
+                message. This will instruct
+                <command>systemd-journald</command> to attach
+                additional fields on behalf of the caller:</para>
+
+                <variablelist class='journal-directives'>
+                        <varlistentry>
+                                <term><varname>OBJECT_PID=<replaceable>PID</replaceable></varname></term>
+                                <listitem>
+                                        <para>PID of the program that this
+                                        message pertains to.
+                                        </para>
+                                </listitem>
+                        </varlistentry>
 
 
-                <para>During serialization into external formats the
-                addresses of journal entries are serialized into
-                fields prefixed with double underscores. Note that
-                these aren't proper fields when stored in the journal,
-                but addressing meta data of entries.</para>
+                        <varlistentry>
+                                <term><varname>OBJECT_UID=</varname></term>
+                                <term><varname>OBJECT_GID=</varname></term>
+                                <term><varname>OBJECT_COMM=</varname></term>
+                                <term><varname>OBJECT_EXE=</varname></term>
+                                <term><varname>OBJECT_CMDLINE=</varname></term>
+                                <term><varname>OBJECT_AUDIT_SESSION=</varname></term>
+                                <term><varname>OBJECT_AUDIT_LOGINUID=</varname></term>
+                                <term><varname>OBJECT_SYSTEMD_CGROUP=</varname></term>
+                                <term><varname>OBJECT_SYSTEMD_SESSION=</varname></term>
+                                <term><varname>OBJECT_SYSTEMD_OWNER_UID=</varname></term>
+                                <term><varname>OBJECT_SYSTEMD_UNIT=</varname></term>
+                                <term><varname>OBJECT_SYSTEMD_USER_UNIT=</varname></term>
+                                <listitem>
+                                        <para>These are additional fields added automatically
+                                        by <command>systemd-journald</command>.
+                                        Their meaning is the same as
+                                        <varname>_UID=</varname>,
+                                        <varname>_GID=</varname>,
+                                        <varname>_COMM=</varname>,
+                                        <varname>_EXE=</varname>,
+                                        <varname>_CMDLINE=</varname>,
+                                        <varname>_AUDIT_SESSION=</varname>,
+                                        <varname>_AUDIT_LOGINUID=</varname>,
+                                        <varname>_SYSTEMD_CGROUP=</varname>,
+                                        <varname>_SYSTEMD_SESSION=</varname>,
+                                        <varname>_SYSTEMD_UNIT=</varname>,
+                                        <varname>_SYSTEMD_USER_UNIT=</varname>, and
+                                        <varname>_SYSTEMD_OWNER_UID=</varname>
+                                        as described above, except that the
+                                        process identified by <replaceable>PID</replaceable>
+                                        is described, instead of the process
+                                        which logged the message.</para>
+                                </listitem>
+                        </varlistentry>
+                </variablelist>
+
+
+        </refsect1>
+
+        <refsect1>
+                <title>Address Fields</title>
 
 
-                <variablelist>
+                <para>During serialization into external formats, such
+                as the <ulink
+                url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
+                Export Format</ulink> or the <ulink
+                url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
+                JSON Format</ulink>, the addresses of journal entries
+                are serialized into fields prefixed with double
+                underscores. Note that these are not proper fields when
+                stored in the journal but for addressing metadata of
+                entries. They cannot be written as part of structured
+                log entries via calls such as
+                <citerefentry><refentrytitle>sd_journal_send</refentrytitle><manvolnum>3</manvolnum></citerefentry>. They
+                may also not be used as matches for
+                <citerefentry><refentrytitle>sd_journal_add_match</refentrytitle><manvolnum>3</manvolnum></citerefentry></para>
+
+                <variablelist class='journal-directives'>
                         <varlistentry>
                         <varlistentry>
-                                <term>__CURSOR=</term>
+                                <term><varname>__CURSOR=</varname></term>
                                 <listitem>
                                         <para>The cursor for the
                                         entry. A cursor is an opaque
                                 <listitem>
                                         <para>The cursor for the
                                         entry. A cursor is an opaque
@@ -282,37 +549,42 @@
                                         describes the position of an
                                         entry in the journal and is
                                         portable across machines,
                                         describes the position of an
                                         entry in the journal and is
                                         portable across machines,
-                                        platforms and journal
-                                        files.</para>
+                                        platforms and journal files.
+                                        </para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>__REALTIME_TIMESTAMP=</term>
+                                <term><varname>__REALTIME_TIMESTAMP=</varname></term>
                                 <listitem>
                                         <para>The wallclock time
                                 <listitem>
                                         <para>The wallclock time
-                                        (CLOCK_REALTIME) at the point
-                                        in time the entry was received
-                                        by the journal. This has
-                                        different properties from
-                                        <literal>_SOURCE_REALTIME_TIMESTAMP=</literal>
+                                        (<constant>CLOCK_REALTIME</constant>)
+                                        at the point in time the entry
+                                        was received by the journal,
+                                        in microseconds since the epoch
+                                        UTC, formatted as a decimal
+                                        string. This has different
+                                        properties from
+                                        <literal>_SOURCE_REALTIME_TIMESTAMP=</literal>,
                                         as it is usually a bit later
                                         as it is usually a bit later
-                                        but more likely to be
-                                        monotonic.</para>
+                                        but more likely to be monotonic.
+                                        </para>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
                                 </listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term>__MONOTONIC_TIMESTAMP=</term>
+                                <term><varname>__MONOTONIC_TIMESTAMP=</varname></term>
                                 <listitem>
                                         <para>The monotonic time
                                 <listitem>
                                         <para>The monotonic time
-                                        (CLOCK_MONOTONIC) at the point
-                                        in time the entry was received
-                                        by the journal. To be useful
-                                        as an address for the entry
-                                        this should be combined with
-                                        with boot ID in
-                                        <literal>_BOOT_ID=</literal>.</para>
+                                        (<constant>CLOCK_MONOTONIC</constant>)
+                                        at the point in time the entry
+                                        was received by the journal in
+                                        microseconds, formatted as a decimal
+                                        string. To be useful as an
+                                        address for the entry, this
+                                        should be combined with the
+                                        boot ID in <literal>_BOOT_ID=</literal>.
+                                        </para>
                                 </listitem>
                         </varlistentry>
                 </variablelist>
                                 </listitem>
                         </varlistentry>
                 </variablelist>
@@ -323,7 +595,10 @@
                   <para>
                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                           <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                   <para>
                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                           <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-                          <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+                          <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+                          <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+                          <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+                          <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
                   </para>
         </refsect1>
 
                   </para>
         </refsect1>
 
Unnamed repository; edit this file 'description' to name the repository.