X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd.journal-fields.xml;h=beb2fd658438920230ea1d8067ee61779ecb1481;hp=6a9fd9d85cdaf80efefd08fbf732fc0c14db6dec;hb=3ae83f9896bff49679c8a60e6ff9520557df8b16;hpb=cb07866b1b7c11e687a322d70dd9f9d73bbbe488 diff --git a/man/systemd.journal-fields.xml b/man/systemd.journal-fields.xml index 6a9fd9d85..beb2fd658 100644 --- a/man/systemd.journal-fields.xml +++ b/man/systemd.journal-fields.xml @@ -58,7 +58,8 @@ sense. New fields may freely be defined by applications, but a few fields have special meaning. All fields with special meanings are - optional. + optional. In some cases fields may appear more than + once per entry. @@ -67,9 +68,9 @@ User fields are fields that are directly passed from clients and stored in the journal. - + - MESSAGE= + MESSAGE= The human readable message string for this @@ -84,7 +85,7 @@ - MESSAGE_ID= + MESSAGE_ID= A 128bit message identifier ID for recognizing @@ -106,7 +107,7 @@ - PRIORITY= + PRIORITY= A priority value between 0 (emerg) @@ -120,9 +121,9 @@ - CODE_FILE= - CODE_LINE= - CODE_FUNC= + CODE_FILE= + CODE_LINE= + CODE_FUNC= The code location generating this message, if @@ -133,9 +134,22 @@ - SYSLOG_FACILITY= - SYSLOG_IDENTIFIER= - SYSLOG_PID= + ERRNO= + + The low-level Unix error + number causing this entry, if + any. Contains the numeric + value of + errno3 + formatted as decimal + string. + + + + + SYSLOG_FACILITY= + SYSLOG_IDENTIFIER= + SYSLOG_PID= Syslog compatibility fields containing the facility @@ -156,11 +170,11 @@ fields, i.e. fields that are implicitly added by the journal and cannot be altered by client code. - + - _PID= - _UID= - _GID= + _PID= + _UID= + _GID= The process, user and group ID of the process the @@ -171,9 +185,9 @@ - _COMM= - _EXE= - _CMDLINE= + _COMM= + _EXE= + _CMDLINE= The name, the executable path and the command line of @@ -183,8 +197,8 @@ - _AUDIT_SESSION= - _AUDIT_LOGINUID= + _AUDIT_SESSION= + _AUDIT_LOGINUID= The session and login UID of the process the journal @@ -195,16 +209,18 @@ - _SYSTEMD_CGROUP= - _SYSTEMD_SESSION= - _SYSTEMD_UNIT= - _SYSTEMD_OWNER_UID= + _SYSTEMD_CGROUP= + _SYSTEMD_SESSION= + _SYSTEMD_UNIT= + _SYSTEMD_USER_UNIT= + _SYSTEMD_OWNER_UID= - The contol group path in + The control group path in the systemd hierarchy, the systemd session ID (if any), - the systemd unit name (if any) + the systemd unit name (if any), + the systemd user session unit name (if any) and the owner UID of the systemd session (if any) of the process the journal entry @@ -213,7 +229,7 @@ - _SELINUX_CONTEXT= + _SELINUX_CONTEXT= The SELinux security context of the process the @@ -223,7 +239,7 @@ - _SOURCE_REALTIME_TIMESTAMP= + _SOURCE_REALTIME_TIMESTAMP= The earliest trusted timestamp of the message, if @@ -237,7 +253,7 @@ - _BOOT_ID= + _BOOT_ID= The kernel boot ID for the boot the message was @@ -248,7 +264,7 @@ - _MACHINE_ID= + _MACHINE_ID= The machine ID of the originating host, as available @@ -258,7 +274,7 @@ - _HOSTNAME= + _HOSTNAME= The name of the originating host. @@ -266,26 +282,164 @@ - _TRANSPORT= + _TRANSPORT= How the entry was received by the journal - service. One of - driver, - syslog, - journal, - stdout, - kernel for - internally generated messages, - for those received via the - local syslog socket with the - syslog protocol, for those - received via the native - journal protocol, for the - those read from a services' - standard output or error - output, and for those read - from the kernel, resp. + service. Valid transports are: + + + + + + + + for + internally + generated + messages + + + + + + + + + + for those + received via the + local syslog + socket with the + syslog protocol + + + + + + + + + + for those + received via the + native journal + protocol + + + + + + + + + + for those + read from a + service's + standard output + or error output + + + + + + + + + + for those + read from the + kernel + + + + + + + + + + + Kernel Journal Fields + + Kernel fields are fields that are used by + messages originating in the kernel and stored in the + journal. + + + + _KERNEL_DEVICE= + + The kernel device + name. If the entry is + associated to a block device, + the major and minor of the + device node, separated by ':' + and prefixed by 'b'. Similar + for character devices, but + prefixed by 'c'. For network + devices the interface index, + prefixed by 'n'. For all other + devices '+' followed by the + subsystem name, followed by + ':', followed by the kernel + device name. + + + + _KERNEL_SUBSYSTEM= + + The kernel subsystem name. + + + + _UDEV_SYSNAME= + + The kernel device name + as it shows up in the device + tree below + /sys. + + + + _UDEV_DEVNODE= + + The device node path of + this device in + /dev. + + + + _UDEV_DEVLINK= + + Additional symlink names + pointing to the device node in + /dev. This + field is frequently set more + than once per entry. + + + + + + + Special Journal Fields + + Fields used by the systemd-coredump + coredump kernel helper. + + + + + COREDUMP_UNIT= + COREDUMP_USER_UNIT= + + Used to annotate + messages containing coredumps from + system and session units. + See + systemd-coredumpctl1. @@ -295,20 +449,24 @@ Address Fields - During serialization into external formats the - addresses of journal entries are serialized into - fields prefixed with double underscores. Note that - these aren't proper fields when stored in the journal, - but addressing meta data of entries. They cannot be - written as part of structured log entries via calls - such as + During serialization into external formats, such + as the Journal + Export Format or the Journal + JSON Format, the addresses of journal entries + are serialized into fields prefixed with double + underscores. Note that these aren't proper fields when + stored in the journal, but addressing meta data of + entries. They cannot be written as part of structured + log entries via calls such as sd_journal_send3. They may also not be used as matches for sd_journal_add_match3 - + - __CURSOR= + __CURSOR= The cursor for the entry. A cursor is an opaque @@ -322,7 +480,7 @@ - __REALTIME_TIMESTAMP= + __REALTIME_TIMESTAMP= The wallclock time (CLOCK_REALTIME) at the point @@ -339,7 +497,7 @@ - __MONOTONIC_TIMESTAMP= + __MONOTONIC_TIMESTAMP= The monotonic time (CLOCK_MONOTONIC) at the point @@ -362,7 +520,9 @@ systemd1, journalctl1, journald.conf5, - sd-journal3 + sd-journal3, + systemd-coredumpctl1, + systemd.directives7