X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd.journal-fields.xml;h=a0f1bfda13f3b7cd100d59fa0021d55e910fcd7a;hp=c523ab090817db92eda913159db7de77a386b0f3;hb=53057ef93bafbf78318a5e08f6395504a0719f3d;hpb=57da3da15abe16446e7121a1a5b5b3f7a5b58e72 diff --git a/man/systemd.journal-fields.xml b/man/systemd.journal-fields.xml index c523ab090..a0f1bfda1 100644 --- a/man/systemd.journal-fields.xml +++ b/man/systemd.journal-fields.xml @@ -53,11 +53,13 @@ Entries in the journal resemble an environment block in their syntax, however with fields that can include binary data. Primarily, fields are formatted - ASCII strings, and binary formatting is used only - where formatting as ASCII makes little sense. New - fields may be freely defined by applications, but a - few fields have special meaning. All fields with - special meaning are optional. + UTF-8 text strings, and binary formatting is used only + where formatting as UTF-8 text strings makes little + sense. New fields may freely be defined by + applications, but a few fields have special + meaning. All fields with special meanings are + optional. In some cases fields may appear more than + once per entry. @@ -66,22 +68,24 @@ User fields are fields that are directly passed from clients and stored in the journal. - + - MESSAGE= + MESSAGE= The human readable message string for this entry. This is supposed to be the primary text shown to the - user. It is not translated, - and is not supposed to be - parsed for meta data. + user. It is usually not + translated (but might be in + some cases), and is not + supposed to be parsed for meta + data. - MESSAGE_ID= + MESSAGE_ID= A 128bit message identifier ID for recognizing @@ -103,7 +107,7 @@ - PRIORITY= + PRIORITY= A priority value between 0 (emerg) @@ -117,9 +121,9 @@ - CODE_FILE= - CODE_LINE= - CODE_FUNC= + CODE_FILE= + CODE_LINE= + CODE_FUNC= The code location generating this message, if @@ -130,9 +134,22 @@ - SYSLOG_FACILITY= - SYSLOG_IDENTIFIER= - SYSLOG_PID= + ERRNO= + + The low-level Unix error + number causing this entry, if + any. Contains the numeric + value of + errno3 + formatted as decimal + string. + + + + + SYSLOG_FACILITY= + SYSLOG_IDENTIFIER= + SYSLOG_PID= Syslog compatibility fields containing the facility @@ -153,11 +170,11 @@ fields, i.e. fields that are implicitly added by the journal and cannot be altered by client code. - + - _PID= - _UID= - _GID= + _PID= + _UID= + _GID= The process, user and group ID of the process the @@ -168,9 +185,9 @@ - _COMM= - _EXE= - _CMDLINE= + _COMM= + _EXE= + _CMDLINE= The name, the executable path and the command line of @@ -180,8 +197,8 @@ - _AUDIT_SESSION= - _AUDIT_LOGINUID= + _AUDIT_SESSION= + _AUDIT_LOGINUID= The session and login UID of the process the journal @@ -192,16 +209,18 @@ - _SYSTEMD_CGROUP= - _SYSTEMD_SESSION= - _SYSTEMD_UNIT= - _SYSTEMD_OWNER_UID= + _SYSTEMD_CGROUP= + _SYSTEMD_SESSION= + _SYSTEMD_UNIT= + _SYSTEMD_USER_UNIT= + _SYSTEMD_OWNER_UID= - The contol group path in + The control group path in the systemd hierarchy, the systemd session ID (if any), - the systemd unit name (if any) + the systemd unit name (if any), + the systemd user session unit name (if any) and the owner UID of the systemd session (if any) of the process the journal entry @@ -210,7 +229,7 @@ - _SELINUX_CONTEXT= + _SELINUX_CONTEXT= The SELinux security context of the process the @@ -220,7 +239,7 @@ - _SOURCE_REALTIME_TIMESTAMP= + _SOURCE_REALTIME_TIMESTAMP= The earliest trusted timestamp of the message, if @@ -234,7 +253,7 @@ - _BOOT_ID= + _BOOT_ID= The kernel boot ID for the boot the message was @@ -245,7 +264,7 @@ - _MACHINE_ID= + _MACHINE_ID= The machine ID of the originating host, as available @@ -255,7 +274,7 @@ - _HOSTNAME= + _HOSTNAME= The name of the originating host. @@ -263,7 +282,7 @@ - _TRANSPORT= + _TRANSPORT= How the entry was received by the journal @@ -281,8 +300,8 @@ journal protocol, for the those read from a services' standard output or error - output, and for those read - from the kernel, resp. + output, or for those read + from the kernel, respectively. @@ -290,17 +309,112 @@ - Address Fields + Kernel Journal Fields + + Kernel fields are fields that are used by + messages originating in the kernel and stored in the + journal. - During serialization into external formats the - addresses of journal entries are serialized into - fields prefixed with double underscores. Note that - these aren't proper fields when stored in the journal, - but addressing meta data of entries. + + + _KERNEL_DEVICE= + + The kernel device + name. If the entry is + associated to a block device, + the major and minor of the + device node, separated by ':' + and prefixed by 'b'. Similar + for character devices, but + prefixed by 'c'. For network + devices the interface index, + prefixed by 'n'. For all other + devices '+' followed by the + subsystem name, followed by + ':', followed by the kernel + device name. + + + + _KERNEL_SUBSYSTEM= + + The kernel subsystem name. + + + + _UDEV_SYSNAME= + + The kernel device name + as it shows up in the device + tree below + /sys. + + + + _UDEV_DEVNODE= + + The device node path of + this device in + /dev. + + + + _UDEV_DEVLINK= + + Additional symlink names + pointing to the device node in + /dev. This + field is frequently set more + than once per entry. + + + + + + + Special Journal Fields + + Fields used by the systemd-coredump + coredump kernel helper. + + + + + COREDUMP_UNIT= + COREDUMP_USER_UNIT= + + Used to annotate + messages containing coredumps from + system and session units. + See + systemd-coredumpctl1. + + + + + + + + Address Fields - + During serialization into external formats, such + as the Journal + Export Format or the Journal + JSON Format, the addresses of journal entries + are serialized into fields prefixed with double + underscores. Note that these aren't proper fields when + stored in the journal, but addressing meta data of + entries. They cannot be written as part of structured + log entries via calls such as + sd_journal_send3. They + may also not be used as matches for + sd_journal_add_match3 + + - __CURSOR= + __CURSOR= The cursor for the entry. A cursor is an opaque @@ -314,7 +428,7 @@ - __REALTIME_TIMESTAMP= + __REALTIME_TIMESTAMP= The wallclock time (CLOCK_REALTIME) at the point @@ -331,7 +445,7 @@ - __MONOTONIC_TIMESTAMP= + __MONOTONIC_TIMESTAMP= The monotonic time (CLOCK_MONOTONIC) at the point @@ -353,7 +467,10 @@ systemd1, journalctl1, - journald.conf5 + journald.conf5, + sd-journal3, + systemd-coredumpctl1, + systemd.directives7