systemd.journal-fields.xml revision 6bc3bf5b05f4e79f9d6e42b7fb877b60070e048b
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff This file is part of systemd.
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff Copyright 2010 Lennart Poettering
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff systemd is free software; you can redistribute it and/or modify it
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff under the terms of the GNU General Public License as published by
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff the Free Software Foundation; either version 2 of the License, or
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff (at your option) any later version.
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff systemd is distributed in the hope that it will be useful, but
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff WITHOUT ANY WARRANTY; without even the implied warranty of
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff General Public License for more details.
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff You should have received a copy of the GNU General Public License
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff along with systemd; If not, see <http://www.gnu.org/licenses/>.
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff <refentryinfo>
64828244e04e86dfa40f0a4f0c05f27923da499dMichael Graff <authorgroup>
213973a334f92d4aef4ef62b4538fc2e4d0e8082Michael Graff </authorgroup>
3024dbecbac365171bc6de0f3fa04951d6558be3Michael Graff </refentryinfo>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <refentrytitle>systemd.journal-fields</refentrytitle>
e51511aa3281f8dc384eb1283115c7f8d5c402aeMichael Graff <refpurpose>Special journal fields</refpurpose>
e51511aa3281f8dc384eb1283115c7f8d5c402aeMichael Graff </refnamediv>
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff <para>Entries in the journal resemble an environment
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff block in their syntax, however with fields that can
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff include binary data. Primarily, fields are formatted
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff ASCII strings, and binary formatting is used only
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff where formatting as ASCII makes little sense. New
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff fields may be freely defined by applications, but a
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff few fields have special meaning. All fields with
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff special meaning are optional.</para>
31fab17bcdbe302592a6c0dc5374ef56333ee879Michael Graff <para>User fields are fields that are directly passed
31fab17bcdbe302592a6c0dc5374ef56333ee879Michael Graff from clients and stored in the journal.</para>
31fab17bcdbe302592a6c0dc5374ef56333ee879Michael Graff <variablelist>
31fab17bcdbe302592a6c0dc5374ef56333ee879Michael Graff <varlistentry>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <para>The human readable
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff message string for this
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff entry. This is supposed to be
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff the primary text shown to the
f00d96a15cdd11e764437f9359e67328631caaeaMichael Graff user. It is not translated,
f00d96a15cdd11e764437f9359e67328631caaeaMichael Graff and is not supposed to be
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff parsed for meta data.</para>
3ac63b472022ff92691d1fe69ac715a729671965Michael Graff </varlistentry>
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff <varlistentry>
64828244e04e86dfa40f0a4f0c05f27923da499dMichael Graff <para>A 128bit message
213973a334f92d4aef4ef62b4538fc2e4d0e8082Michael Graff identifier ID for recognizing
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff certain message types, if this
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff is desirable. This should
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff contain a 128bit id formatted
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff as lower-case hexadecimal
bb143613cf26e0f27dfd9caf1a7336065d064b26Michael Graff string, without any separating
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff dashes or suchlike. This is
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff recommended to be a UUID
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff compatible ID, but this is not
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff enforced, and formatted
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff differently. Developers can
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff generate a new ID for this
11efdeb076d65fa9f0c5fc067dc040e7c99dfba6Michael Graff <command>journalctl
3ac63b472022ff92691d1fe69ac715a729671965Michael Graff </varlistentry>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <varlistentry>
e51511aa3281f8dc384eb1283115c7f8d5c402aeMichael Graff <para>A priority value between
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff formatted as decimal
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff string. This field is
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff compatible with syslog's
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff priority concept.</para>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff </varlistentry>
f181f94ec8da8b1dbcc6353e8be965ea4a5ea282Michael Graff <varlistentry>
213973a334f92d4aef4ef62b4538fc2e4d0e8082Michael Graff <para>The code location
30251e07d1705d1a85b0e1d5a969496e1aed612eMichael Graff generating this message, if
30251e07d1705d1a85b0e1d5a969496e1aed612eMichael Graff known. Contains the source
213973a334f92d4aef4ef62b4538fc2e4d0e8082Michael Graff file name, the line number and
213973a334f92d4aef4ef62b4538fc2e4d0e8082Michael Graff the function name.</para>
213973a334f92d4aef4ef62b4538fc2e4d0e8082Michael Graff </varlistentry>
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff <varlistentry>
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff <para>Syslog compatibility
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff fields containing the facility
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff (formatted as decimal string),
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff the identifier string
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff (i.e. "tag"), and the client
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff </varlistentry>
1f90c108282533a23b8362c34bcde4267c1eb4b1Michael Graff </variablelist>
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff <para>Fields prefixed with an underscore are trusted
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff fields, i.e. fields that are implicitly added by the
bb143613cf26e0f27dfd9caf1a7336065d064b26Michael Graff journal and cannot be altered by client code.</para>
d43c2cc7bc4022701f141e299ea8f3fb1d0640c2Michael Graff <variablelist>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <varlistentry>
bb143613cf26e0f27dfd9caf1a7336065d064b26Michael Graff <para>The process, user and
bb143613cf26e0f27dfd9caf1a7336065d064b26Michael Graff group ID of the process the
bb143613cf26e0f27dfd9caf1a7336065d064b26Michael Graff journal entry originates from
d43c2cc7bc4022701f141e299ea8f3fb1d0640c2Michael Graff formatted as decimal
bb143613cf26e0f27dfd9caf1a7336065d064b26Michael Graff string.</para>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff </varlistentry>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <varlistentry>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <para>The name, the executable
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff path and the command line of
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff the process the journal entry
d43c2cc7bc4022701f141e299ea8f3fb1d0640c2Michael Graff originates from.</para>
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff </varlistentry>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <varlistentry>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <para>The session and login
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff UID of the process the journal
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff entry originates from, as
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff maintained by the kernel audit
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff subsystem.</para>
d8590892d10fc9528b0dde7e2781935e7b8d7a87Michael Graff </varlistentry>
d43c2cc7bc4022701f141e299ea8f3fb1d0640c2Michael Graff <varlistentry>
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff <para>The contol group path in
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff the systemd hierarchy, the
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff systemd session ID (if any),
ad3a5c4b7e21af04d1b872f933c2e19e5c0a135bMichael Graff the systemd unit name (if any)
439c0011e642fb1d26011116144af698125262dbMichael Graff and the owner UID of the
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff systemd session (if any) of
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff the process the journal entry
f181f94ec8da8b1dbcc6353e8be965ea4a5ea282Michael Graff originates from.</para>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff </varlistentry>
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff <varlistentry>
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff <para>The SELinux security
66bd3b3c6b171271c705b897823dcdcf29464698Michael Graff context of the process the
11fcc67616fac1bc6a28b3d4fed24641137888e7Michael Graff journal entry originates
d8590892d10fc9528b0dde7e2781935e7b8d7a87Michael Graff </varlistentry>
439c0011e642fb1d26011116144af698125262dbMichael Graff <varlistentry>
f36a81c88493985ee2d1c53cc6fe88f4b00dbbc8Michael Graff <para>The earliest trusted
439c0011e642fb1d26011116144af698125262dbMichael Graff timestamp of the message, if
439c0011e642fb1d26011116144af698125262dbMichael Graff any is known that is different
439c0011e642fb1d26011116144af698125262dbMichael Graff from the reception time of the
439c0011e642fb1d26011116144af698125262dbMichael Graff journal. This is the time in
439c0011e642fb1d26011116144af698125262dbMichael Graff usec since the epoch UTC
439c0011e642fb1d26011116144af698125262dbMichael Graff formatted as decimal
439c0011e642fb1d26011116144af698125262dbMichael Graff string.</para>
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff </varlistentry>
439c0011e642fb1d26011116144af698125262dbMichael Graff <varlistentry>
439c0011e642fb1d26011116144af698125262dbMichael Graff <para>The kernel boot ID for
1c3bc66ada38236cc81c41b7174a9f0a872c9ab6Michael Graff the boot the message was
439c0011e642fb1d26011116144af698125262dbMichael Graff generated in, formatted as
439c0011e642fb1d26011116144af698125262dbMichael Graff 128bit hexadecimal
86944a4c8002e80ae9b6eb5a5e29b797879be45fMichael Graff string.</para>
30251e07d1705d1a85b0e1d5a969496e1aed612eMichael Graff </varlistentry>
30251e07d1705d1a85b0e1d5a969496e1aed612eMichael Graff <varlistentry>
439c0011e642fb1d26011116144af698125262dbMichael Graff <para>The machine ID of the
439c0011e642fb1d26011116144af698125262dbMichael Graff originating host, as available
d8590892d10fc9528b0dde7e2781935e7b8d7a87Michael Graff <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
30251e07d1705d1a85b0e1d5a969496e1aed612eMichael Graff </varlistentry>
a253e35c2451818fb39f9b808c7641adb5275fb3Michael Graff <varlistentry>
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff <para>The name of the
a253e35c2451818fb39f9b808c7641adb5275fb3Michael Graff originating host.</para>
651228967966ba4fb2e52f92d1207c790af4b130Michael Graff </varlistentry>
a253e35c2451818fb39f9b808c7641adb5275fb3Michael Graff <varlistentry>
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff <para>How the entry was
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff received by the journal
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff service. One of
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff internally generated messages,
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff for those received via the
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff local syslog socket with the
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff syslog protocol, for those
a253e35c2451818fb39f9b808c7641adb5275fb3Michael Graff received via the native
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff journal protocol, for the
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff those read from a services'
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff standard output or error
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff output, resp. for those read
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff from the kernel.
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff </varlistentry>
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff </variablelist>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <para>During serialization into external formats the
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff addresses of journal entries are serialized into
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff fields prefixed with double underscores. Note that
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff these aren't proper fields when stored in the journal,
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff but addressing meta data of entries.</para>
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff <variablelist>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <varlistentry>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <para>The cursor for the
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff entry. A cursor is an opaque
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff text string that uniquely
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff describes the position of an
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff entry in the journal and is
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff portable across machines,
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff platforms and journal
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff files.</para>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff </varlistentry>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <varlistentry>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <para>The wallclock time
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff (CLOCK_REALTIME) at the point
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff in time the entry was received
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff by the journal, in usec since
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff the epoch UTC formatted as
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff decimal string. This has
ff9bb3fc5453bbf310b67c560fbf04a5c0fb60daMichael Graff different properties from
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <literal>_SOURCE_REALTIME_TIMESTAMP=</literal>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff as it is usually a bit later
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff but more likely to be
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff monotonic.</para>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff </varlistentry>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <varlistentry>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <para>The monotonic time
d43c2cc7bc4022701f141e299ea8f3fb1d0640c2Michael Graff (CLOCK_MONOTONIC) at the point
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff in time the entry was received
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff by the journal in usec
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff formatted as decimal
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff string. To be useful as an
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff address for the entry this
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff should be combined with with
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff </varlistentry>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff </variablelist>
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
2bcb48cfcae36398454c98e40c563e2cde748e07Michael Graff <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>