1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id="systemd.journal-fields">
27 <title>systemd.journal-fields</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.journal-fields</refentrytitle>
42 <manvolnum>7</manvolnum>
46 <refname>systemd.journal-fields</refname>
47 <refpurpose>Special journal fields</refpurpose>
51 <title>Description</title>
53 <para>Entries in the journal resemble an environment
54 block in their syntax, however with fields that can
55 include binary data. Primarily, fields are formatted
56 ASCII strings, and binary formatting is used only
57 where formatting as ASCII makes little sense. New
58 fields may be freely defined by applications, but a
59 few fields have special meaning. All fields with
60 special meaning are optional.</para>
64 <title>User Journal Fields</title>
66 <para>User fields are fields that are directly passed
67 from clients and stored in the journal.</para>
73 <para>The human readable
74 message string for this
75 entry. This is supposed to be
76 the primary text shown to the
77 user. It is not translated,
78 and is not supposed to be
79 parsed for meta data.</para>
84 <term>MESSAGE_ID=</term>
86 <para>A 128bit message
87 identifier ID for recognizing
88 certain message types, if this
89 is desirable. This should
90 contain a 128bit id formatted
91 as lower-case hexadecimal
92 string, without any separating
93 dashes or suchlike. This is
94 recommended to be a UUID
95 compatible ID, but this is not
96 enforced, and formatted
97 differently. Developers can
98 generate a new ID for this
101 --new-id</command>.</para>
106 <term>PRIORITY=</term>
108 <para>A priority value between
109 0 (<literal>emerg</literal>)
111 (<literal>debug</literal>)
113 string. This field is
114 compatible with syslog's
115 priority concept.</para>
120 <term>CODE_FILE=</term>
121 <term>CODE_LINE=</term>
122 <term>CODE_FUNC=</term>
124 <para>The code location
125 generating this message, if
126 known. Contains the source
127 file name, the line number and
128 the function name.</para>
133 <term>SYSLOG_FACILITY=</term>
134 <term>SYSLOG_IDENTIFIER=</term>
135 <term>SYSLOG_PID=</term>
137 <para>Syslog compatibility
138 fields containing the facility
139 (formatted as decimal string),
140 the identifier string
141 (i.e. "tag"), and the client
150 <title>Trusted Journal Fields</title>
152 <para>Fields prefixed with an underscore are trusted
153 fields, i.e. fields that are implicitly added by the
154 journal and cannot be altered by client code.</para>
162 <para>The process, user and
163 group ID of the process the
164 journal entry originates from
173 <term>_CMDLINE=</term>
175 <para>The name, the executable
176 path and the command line of
177 the process the journal entry
178 originates from.</para>
183 <term>_AUDIT_SESSION=</term>
184 <term>_AUDIT_LOGINUID=</term>
186 <para>The session and login
187 UID of the process the journal
188 entry originates from, as
189 maintained by the kernel audit
195 <term>_SYSTEMD_CGROUP=</term>
196 <term>_SYSTEMD_SESSION=</term>
197 <term>_SYSTEMD_UNIT=</term>
198 <term>_SYSTEMD_OWNER_UID=</term>
201 <para>The contol group path in
202 the systemd hierarchy, the
203 systemd session ID (if any),
204 the systemd unit name (if any)
205 and the owner UID of the
206 systemd session (if any) of
207 the process the journal entry
208 originates from.</para>
213 <term>_SELINUX_CONTEXT=</term>
215 <para>The SELinux security
216 context of the process the
217 journal entry originates
223 <term>_SOURCE_REALTIME_TIMESTAMP=</term>
225 <para>The earliest trusted
226 timestamp of the message, if
227 any is known that is different
228 from the reception time of the
229 journal. This is the time in
230 usec since the epoch UTC
237 <term>_BOOT_ID=</term>
239 <para>The kernel boot ID for
240 the boot the message was
241 generated in, formatted as
248 <term>_MACHINE_ID=</term>
250 <para>The machine ID of the
251 originating host, as available
253 <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
258 <term>_HOSTNAME=</term>
260 <para>The name of the
261 originating host.</para>
266 <term>_TRANSPORT=</term>
268 <para>How the entry was
269 received by the journal
271 <literal>driver</literal>,
272 <literal>syslog</literal>,
273 <literal>journal</literal>,
274 <literal>stdout</literal>,
275 <literal>kernel</literal> for
276 internally generated messages,
277 for those received via the
278 local syslog socket with the
279 syslog protocol, for those
280 received via the native
281 journal protocol, for the
282 those read from a services'
283 standard output or error
284 output, resp. for those read
293 <title>Address Fields</title>
295 <para>During serialization into external formats the
296 addresses of journal entries are serialized into
297 fields prefixed with double underscores. Note that
298 these aren't proper fields when stored in the journal,
299 but addressing meta data of entries.</para>
303 <term>__CURSOR=</term>
305 <para>The cursor for the
306 entry. A cursor is an opaque
307 text string that uniquely
308 describes the position of an
309 entry in the journal and is
310 portable across machines,
311 platforms and journal
317 <term>__REALTIME_TIMESTAMP=</term>
319 <para>The wallclock time
320 (CLOCK_REALTIME) at the point
321 in time the entry was received
322 by the journal, in usec since
323 the epoch UTC formatted as
324 decimal string. This has
325 different properties from
326 <literal>_SOURCE_REALTIME_TIMESTAMP=</literal>
327 as it is usually a bit later
328 but more likely to be
334 <term>__MONOTONIC_TIMESTAMP=</term>
336 <para>The monotonic time
337 (CLOCK_MONOTONIC) at the point
338 in time the entry was received
339 by the journal in usec
341 string. To be useful as an
342 address for the entry this
343 should be combined with with
345 <literal>_BOOT_ID=</literal>.</para>
352 <title>See Also</title>
354 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
355 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
356 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>