Copyright 2010 Lennart Poettering
systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
(at your option) any later version.
systemd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
+ Lesser General Public License for more details.
- You should have received a copy of the GNU General Public License
+ You should have received a copy of the GNU Lesser General Public License
along with systemd; If not, see <http://www.gnu.org/licenses/>.
-->
<para>Entries in the journal resemble an environment
block in their syntax, however with fields that can
include binary data. Primarily, fields are formatted
- ASCII strings, and binary formatting is used only
- where formatting as ASCII makes little sense. New
- fields may be freely defined by applications, but a
- few fields have special meaning. All fields with
- special meaning are optional.</para>
+ UTF-8 text strings, and binary formatting is used only
+ where formatting as UTF-8 text strings makes little
+ sense. New fields may freely be defined by
+ applications, but a few fields have special
+ meaning. All fields with special meanings are
+ optional.</para>
</refsect1>
<refsect1>
message string for this
entry. This is supposed to be
the primary text shown to the
- user. It is not translated,
- and is not supposed to be
- parsed for meta data.</para>
+ user. It is usually not
+ translated (but might be in
+ some cases), and is not
+ supposed to be parsed for meta
+ data.</para>
</listitem>
</varlistentry>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>ERRNO=</term>
+ <listitem>
+ <para>The low-level Unix error
+ number causing this entry, if
+ any. Contains the numeric
+ value of
+ <citerefentry><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+ formatted as decimal
+ string.</para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term>SYSLOG_FACILITY=</term>
<term>SYSLOG_IDENTIFIER=</term>
timestamp of the message, if
any is known that is different
from the reception time of the
- journal. The time in usec
- since the epoch formatted as
- decimal string.</para>
+ journal. This is the time in
+ usec since the epoch UTC
+ formatted as decimal
+ string.</para>
</listitem>
</varlistentry>
originating host.</para>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term>_TRANSPORT=</term>
+ <listitem>
+ <para>How the entry was
+ received by the journal
+ service. One of
+ <literal>driver</literal>,
+ <literal>syslog</literal>,
+ <literal>journal</literal>,
+ <literal>stdout</literal>,
+ <literal>kernel</literal> for
+ internally generated messages,
+ for those received via the
+ local syslog socket with the
+ syslog protocol, for those
+ received via the native
+ journal protocol, for the
+ those read from a services'
+ standard output or error
+ output, and for those read
+ from the kernel, resp.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </refsect1>
+
+ <refsect1>
+ <title>Kernel Journal Fields</title>
+
+ <para>Kernel fields are fields that are used by
+ messages originating in the kernel and stored in the
+ journal.</para>
+
+ <variablelist>
+ <varlistentry>
+ <term>_KERNEL_DEVICE=</term>
+ <listitem>
+ <para>The kernel device
+ name. If the entry is
+ associated to a block device,
+ the major and minor of the
+ device node, separated by ':'
+ and prefixed by 'b'. Similar
+ for character devices, but
+ prefixed by 'c'. For network
+ devices the interface index,
+ prefixed by 'n'. For all other
+ devices '+' followed by the
+ subsystem name, followed by
+ ':', followed by the kernel
+ device name.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>_KERNEL_SUBSYSTEM=</term>
+ <listitem>
+ <para>The kernel subsystem name.</para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
addresses of journal entries are serialized into
fields prefixed with double underscores. Note that
these aren't proper fields when stored in the journal,
- but addressing meta data of entries.</para>
+ but addressing meta data of entries. They cannot be
+ written as part of structured log entries via calls
+ such as
+ <citerefentry><refentrytitle>sd_journal_send</refentrytitle><manvolnum>3</manvolnum></citerefentry>. They
+ may also not be used as matches for
+ <citerefentry><refentrytitle>sd_journal_add_match</refentrytitle><manvolnum>3</manvolnum></citerefentry></para>
<variablelist>
<varlistentry>
<para>The wallclock time
(CLOCK_REALTIME) at the point
in time the entry was received
- by the journal. This has
+ by the journal, in usec since
+ the epoch UTC formatted as
+ decimal string. This has
different properties from
<literal>_SOURCE_REALTIME_TIMESTAMP=</literal>
as it is usually a bit later
<para>The monotonic time
(CLOCK_MONOTONIC) at the point
in time the entry was received
- by the journal. To be useful
- as an address for the entry
- this should be combined with
- with boot ID in
+ by the journal in usec
+ formatted as decimal
+ string. To be useful as an
+ address for the entry this
+ should be combined with with
+ boot ID in
<literal>_BOOT_ID=</literal>.</para>
</listitem>
</varlistentry>
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
<citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
- <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>
</para>
</refsect1>
~ianmdlvl / elogind.git / blobdiff