X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd.journal-fields.xml;h=154b95ac7e2e3f8ca3752bab54411491e18281ed;hb=795bc7e79107e01d088047e3b3a6f32da992a959;hp=bced51d6359c334a4d25fbf02c165e996ffa57d3;hpb=e9dd9f9547350c7dc0473583b5c2228dc8f0ab76;p=elogind.git
diff --git a/man/systemd.journal-fields.xml b/man/systemd.journal-fields.xml
index bced51d63..154b95ac7 100644
--- a/man/systemd.journal-fields.xml
+++ b/man/systemd.journal-fields.xml
@@ -51,14 +51,14 @@
Description
Entries in the journal resemble an environment
- block in their syntax, however with fields that can
+ block in their syntax but with fields that can
include binary data. Primarily, fields are formatted
UTF-8 text strings, and binary formatting is used only
where formatting as UTF-8 text strings makes little
sense. New fields may freely be defined by
applications, but a few fields have special
meaning. All fields with special meanings are
- optional. In some cases fields may appear more than
+ optional. In some cases, fields may appear more than
once per entry.
@@ -140,7 +140,7 @@
number causing this entry, if
any. Contains the numeric
value of
- errno3
+ errno3
formatted as a decimal
string.
@@ -156,7 +156,10 @@
(formatted as decimal string),
the identifier string
(i.e. "tag"), and the client
- PID.
+ PID. (Note that the tag is
+ usually derived from glibc's
+ program_invocation_short_name
+ variable, see program_invocation_short_name3.)
@@ -176,7 +179,7 @@
_UID=
_GID=
- The process, user and
+ The process, user, and
group ID of the process the
journal entry originates from
formatted as a decimal
@@ -190,7 +193,16 @@
_CMDLINE=
The name, the executable
- path and the command line of
+ path, and the command line of
+ the process the journal entry
+ originates from.
+
+
+
+
+ _CAP_EFFECTIVE=
+
+ The effective capabilities7 of
the process the journal entry
originates from.
@@ -214,17 +226,20 @@
_SYSTEMD_UNIT=
_SYSTEMD_USER_UNIT=
_SYSTEMD_OWNER_UID=
+ _SYSTEMD_SLICE=
- The control group path in
- the systemd hierarchy, the
+ The control group path
+ in the systemd hierarchy, the
systemd session ID (if any),
- the systemd unit name (if any),
- the systemd user session unit name (if any)
- and the owner UID of the
- systemd session (if any) of
- the process the journal entry
- originates from.
+ the systemd unit name (if
+ any), the systemd user session
+ unit name (if any), the owner
+ UID of the systemd session (if
+ any) and the systemd slice
+ unit of the process the
+ journal entry originates
+ from.
@@ -232,8 +247,8 @@
_SELINUX_CONTEXT=
The SELinux security
- context of the process the
- journal entry originates
+ context (label) of the process
+ the journal entry originates
from.
@@ -377,12 +392,12 @@
the major and minor of the
device node, separated by :
and prefixed by b. Similar
- for character devices, but
+ for character devices but
prefixed by c. For network
- devices the interface index,
+ devices, this is the interface index
prefixed by n. For all other
- devices + followed by the
- subsystem name, followed by
+ devices, this is the subsystem name
+ prefixed by +, followed by
:, followed by the kernel
device name.
@@ -424,10 +439,15 @@
- Special Journal Fields
+ Fields to log on behalf of a different program
+
+ Fields in this section are used by programs
+ to specify that they are logging on behalf of another
+ program or unit.
+
Fields used by the systemd-coredump
- coredump kernel helper.
+ coredump kernel helper:
@@ -439,11 +459,66 @@
messages containing coredumps from
system and session units.
See
- systemd-coredumpctl1.
+ coredumpctl1.
+
+
+
+
+
+ Priviledged programs (currently UID 0) may
+ attach OBJECT_PID= to a
+ message. This will instruct
+ systemd-journald to attach
+ additional fields on behalf of the caller:
+
+
+
+ OBJECT_PID=PID
+
+ PID of the program that this
+ message pertains to.
+
+
+ OBJECT_UID=
+ OBJECT_GID=
+ OBJECT_COMM=
+ OBJECT_EXE=
+ OBJECT_CMDLINE=
+ OBJECT_AUDIT_SESSION=
+ OBJECT_AUDIT_LOGINUID=
+ OBJECT_SYSTEMD_CGROUP=
+ OBJECT_SYSTEMD_SESSION=
+ OBJECT_SYSTEMD_OWNER_UID=
+ OBJECT_SYSTEMD_UNIT=
+ OBJECT_SYSTEMD_USER_UNIT=
+
+ These are additional fields added automatically
+ by systemd-journald.
+ Their meaning is the same as
+ _UID=,
+ _GID=,
+ _COMM=,
+ _EXE=,
+ _CMDLINE=,
+ _AUDIT_SESSION=,
+ _AUDIT_LOGINUID=,
+ _SYSTEMD_CGROUP=,
+ _SYSTEMD_SESSION=,
+ _SYSTEMD_UNIT=,
+ _SYSTEMD_USER_UNIT=, and
+ _SYSTEMD_OWNER_UID=
+ as described above, except that the
+ process identified by PID
+ is described, instead of the process
+ which logged the message.
+
+
+
+
@@ -456,8 +531,8 @@
url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
JSON Format, the addresses of journal entries
are serialized into fields prefixed with double
- underscores. Note that these aren't proper fields when
- stored in the journal but for addressing meta data of
+ underscores. Note that these are not proper fields when
+ stored in the journal but for addressing metadata of
entries. They cannot be written as part of structured
log entries via calls such as
sd_journal_send3. They
@@ -507,7 +582,7 @@
microseconds, formatted as a decimal
string. To be useful as an
address for the entry, this
- should be combined with with the
+ should be combined with the
boot ID in _BOOT_ID=.
@@ -522,7 +597,7 @@
journalctl1,
journald.conf5,
sd-journal3,
- systemd-coredumpctl1,
+ coredumpctl1,
systemd.directives7