X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd.journal-fields.xml;h=bb89ed58d333fb5014274f14396510bcf50fdd0c;hp=de01dc236b2c571ab1c8129dbd84428f9c168ccd;hb=23a7f0f721ff4e3b3fd4ed87f7d8e01ebad20093;hpb=909f413d3c572baadf9b13e36e1e90beba42af86 diff --git a/man/systemd.journal-fields.xml b/man/systemd.journal-fields.xml index de01dc236..bb89ed58d 100644 --- a/man/systemd.journal-fields.xml +++ b/man/systemd.journal-fields.xml @@ -51,14 +51,14 @@ Description Entries in the journal resemble an environment - block in their syntax, however with fields that can + block in their syntax but with fields that can include binary data. Primarily, fields are formatted UTF-8 text strings, and binary formatting is used only where formatting as UTF-8 text strings makes little sense. New fields may freely be defined by applications, but a few fields have special meaning. All fields with special meanings are - optional. In some cases fields may appear more than + optional. In some cases, fields may appear more than once per entry. @@ -72,7 +72,7 @@ MESSAGE= - The human readable + The human-readable message string for this entry. This is supposed to be the primary text shown to the @@ -87,22 +87,22 @@ MESSAGE_ID= - A 128bit message + A 128-bit message identifier ID for recognizing certain message types, if this is desirable. This should - contain a 128bit id formatted - as lower-case hexadecimal + contain a 128-bit ID formatted + as a lower-case hexadecimal string, without any separating dashes or suchlike. This is - recommended to be a UUID - compatible ID, but this is not + recommended to be a + UUID-compatible ID, but this is not enforced, and formatted differently. Developers can generate a new ID for this - purpose with - journalctl - --new-id. + purpose with journalctl + . + @@ -113,7 +113,7 @@ 0 (emerg) and 7 (debug) - formatted as decimal + formatted as a decimal string. This field is compatible with syslog's priority concept. @@ -128,7 +128,7 @@ The code location generating this message, if known. Contains the source - file name, the line number and + filename, the line number and the function name. @@ -141,7 +141,7 @@ any. Contains the numeric value of errno3 - formatted as decimal + formatted as a decimal string. @@ -176,10 +176,10 @@ _UID= _GID= - The process, user and + The process, user, and group ID of the process the journal entry originates from - formatted as decimal + formatted as a decimal string. @@ -190,7 +190,16 @@ _CMDLINE= The name, the executable - path and the command line of + path, and the command line of + the process the journal entry + originates from. + + + + + _CAP_EFFECTIVE= + + The effective capabilities7 of the process the journal entry originates from. @@ -214,17 +223,20 @@ _SYSTEMD_UNIT= _SYSTEMD_USER_UNIT= _SYSTEMD_OWNER_UID= + _SYSTEMD_SLICE= - The control group path in - the systemd hierarchy, the + The control group path + in the systemd hierarchy, the systemd session ID (if any), - the systemd unit name (if any), - the systemd user session unit name (if any) - and the owner UID of the - systemd session (if any) of - the process the journal entry - originates from. + the systemd unit name (if + any), the systemd user session + unit name (if any), the owner + UID of the systemd session (if + any) and the systemd slice + unit of the process the + journal entry originates + from. @@ -246,8 +258,8 @@ any is known that is different from the reception time of the journal. This is the time in - usec since the epoch UTC - formatted as decimal + microseconds since the epoch UTC, + formatted as a decimal string. @@ -258,7 +270,7 @@ The kernel boot ID for the boot the message was generated in, formatted as - 128bit hexadecimal + a 128-bit hexadecimal string. @@ -377,12 +389,12 @@ the major and minor of the device node, separated by : and prefixed by b. Similar - for character devices, but + for character devices but prefixed by c. For network - devices the interface index, + devices, this is the interface index prefixed by n. For all other - devices + followed by the - subsystem name, followed by + devices, this is the subsystem name + prefixed by +, followed by :, followed by the kernel device name. @@ -424,10 +436,15 @@ - Special Journal Fields + Fields to log on behalf of a different program + + Fields in this section are used by programs + to specify that they are logging on behalf of another + program or unit. + Fields used by the systemd-coredump - coredump kernel helper. + coredump kernel helper: @@ -444,6 +461,61 @@ + + Priviledged programs (currently UID 0) may + attach OBJECT_PID= to a + message. This will instruct + systemd-journald to attach + additional fields on behalf of the caller: + + + + OBJECT_PID=PID + + PID of the program that this + message pertains to. + + + + + + OBJECT_UID= + OBJECT_GID= + OBJECT_COMM= + OBJECT_EXE= + OBJECT_CMDLINE= + OBJECT_AUDIT_SESSION= + OBJECT_AUDIT_LOGINUID= + OBJECT_SYSTEMD_CGROUP= + OBJECT_SYSTEMD_SESSION= + OBJECT_SYSTEMD_OWNER_UID= + OBJECT_SYSTEMD_UNIT= + OBJECT_SYSTEMD_USER_UNIT= + + These are additional fields added automatically + by systemd-journald. + Their meaning is the same as + _UID=, + _GID=, + _COMM=, + _EXE=, + _CMDLINE=, + _AUDIT_SESSION=, + _AUDIT_LOGINUID=, + _SYSTEMD_CGROUP=, + _SYSTEMD_SESSION=, + _SYSTEMD_UNIT=, + _SYSTEMD_USER_UNIT=, and + _SYSTEMD_OWNER_UID= + as described above, except that the + process identified by PID + is described, instead of the process + which logged the message. + + + + + @@ -456,8 +528,8 @@ url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal JSON Format, the addresses of journal entries are serialized into fields prefixed with double - underscores. Note that these aren't proper fields when - stored in the journal, but addressing meta data of + underscores. Note that these are not proper fields when + stored in the journal but for addressing meta data of entries. They cannot be written as part of structured log entries via calls such as sd_journal_send3. They @@ -474,8 +546,8 @@ describes the position of an entry in the journal and is portable across machines, - platforms and journal - files. + platforms and journal files. + @@ -483,16 +555,17 @@ __REALTIME_TIMESTAMP= The wallclock time - (CLOCK_REALTIME) at the point - in time the entry was received - by the journal, in usec since - the epoch UTC formatted as - decimal string. This has - different properties from - _SOURCE_REALTIME_TIMESTAMP= + (CLOCK_REALTIME) + at the point in time the entry + was received by the journal, + in microseconds since the epoch + UTC, formatted as a decimal + string. This has different + properties from + _SOURCE_REALTIME_TIMESTAMP=, as it is usually a bit later - but more likely to be - monotonic. + but more likely to be monotonic. + @@ -500,15 +573,15 @@ __MONOTONIC_TIMESTAMP= The monotonic time - (CLOCK_MONOTONIC) at the point - in time the entry was received - by the journal in usec - formatted as decimal + (CLOCK_MONOTONIC) + at the point in time the entry + was received by the journal in + microseconds, formatted as a decimal string. To be useful as an - address for the entry this - should be combined with with - boot ID in - _BOOT_ID=. + address for the entry, this + should be combined with with the + boot ID in _BOOT_ID=. +