]>
Commit | Line | Data |
---|---|---|
ffa16db0 | 1 | <?xml version='1.0'?> <!--*-nxml-*--> |
3a54a157 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
eea10b26 | 3 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"> |
db9ecf05 | 4 | <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
ffa16db0 | 5 | |
4623eecb | 6 | <refentry id="systemd.journal-fields" xmlns:xi="http://www.w3.org/2001/XInclude"> |
ffa16db0 | 7 | |
798d3a52 ZJS |
8 | <refentryinfo> |
9 | <title>systemd.journal-fields</title> | |
10 | <productname>systemd</productname> | |
798d3a52 ZJS |
11 | </refentryinfo> |
12 | ||
13 | <refmeta> | |
14 | <refentrytitle>systemd.journal-fields</refentrytitle> | |
15 | <manvolnum>7</manvolnum> | |
16 | </refmeta> | |
17 | ||
18 | <refnamediv> | |
19 | <refname>systemd.journal-fields</refname> | |
20 | <refpurpose>Special journal fields</refpurpose> | |
21 | </refnamediv> | |
22 | ||
23 | <refsect1> | |
24 | <title>Description</title> | |
25 | ||
5a5bd9f7 LP |
26 | <para>Entries in the journal (as written by |
27 | <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>) | |
98a13530 LP |
28 | resemble a UNIX process environment block in syntax but with field values that may include binary data, |
29 | and with non-unique field names permitted. Primarily, field values are formatted UTF-8 text strings — | |
30 | binary encoding is used only where formatting as UTF-8 text strings makes little sense. New fields may | |
31 | freely be defined by applications, but a few fields have special meanings, which are listed | |
32 | below. Typically, fields may only appear once per log entry, however there are special exceptions: some | |
33 | fields may appear more than once per entry, in which case this is explicitly mentioned below. Even though | |
34 | the logging subsystem makes no restrictions on which fields to accept non-unique values for, it is | |
35 | strongly recommended to avoid relying on this for the fields listed below (except where listed otherwise, | |
36 | as mentioned) in order to avoid unnecessary incompatibilities with other applications.</para> | |
798d3a52 ZJS |
37 | </refsect1> |
38 | ||
39 | <refsect1> | |
40 | <title>User Journal Fields</title> | |
41 | ||
42 | <para>User fields are fields that are directly passed from clients | |
43 | and stored in the journal.</para> | |
44 | ||
45 | <variablelist class='journal-directives'> | |
46 | <varlistentry> | |
47 | <term><varname>MESSAGE=</varname></term> | |
48 | <listitem> | |
98a13530 LP |
49 | <para>The human-readable message string for this entry. This is supposed to be the primary text |
50 | shown to the user. It is usually not translated (but might be in some cases), and is not supposed | |
51 | to be parsed for metadata. In order to encode multiple lines in a single log entry, separate them | |
52 | by newline characters (ASCII code 10), but encode them as a single <varname>MESSAGE=</varname> | |
53 | field. Do not add multiple values of this field type to the same entry (also see above), as | |
54 | consuming applications generally do not expect this and are unlikely to show all values in that | |
55 | case.</para> | |
798d3a52 ZJS |
56 | </listitem> |
57 | </varlistentry> | |
58 | ||
59 | <varlistentry> | |
60 | <term><varname>MESSAGE_ID=</varname></term> | |
61 | <listitem> | |
b9d016d6 LP |
62 | <para>A 128-bit message identifier ID for recognizing certain message types, if this is desirable. This |
63 | should contain a 128-bit ID formatted as a lower-case hexadecimal string, without any separating dashes or | |
64 | suchlike. This is recommended to be a UUID-compatible ID, but this is not enforced, and formatted | |
65 | differently. Developers can generate a new ID for this purpose with <command>systemd-id128 new</command>. | |
798d3a52 ZJS |
66 | </para> |
67 | </listitem> | |
68 | </varlistentry> | |
69 | ||
70 | <varlistentry> | |
71 | <term><varname>PRIORITY=</varname></term> | |
72 | <listitem> | |
73 | <para>A priority value between 0 (<literal>emerg</literal>) | |
74 | and 7 (<literal>debug</literal>) formatted as a decimal | |
75 | string. This field is compatible with syslog's priority | |
76 | concept.</para> | |
77 | </listitem> | |
78 | </varlistentry> | |
79 | ||
80 | <varlistentry> | |
81 | <term><varname>CODE_FILE=</varname></term> | |
82 | <term><varname>CODE_LINE=</varname></term> | |
83 | <term><varname>CODE_FUNC=</varname></term> | |
84 | <listitem> | |
85 | <para>The code location generating this message, if known. | |
86 | Contains the source filename, the line number and the | |
87 | function name.</para> | |
88 | </listitem> | |
89 | </varlistentry> | |
90 | ||
91 | <varlistentry> | |
92 | <term><varname>ERRNO=</varname></term> | |
93 | <listitem> | |
94 | <para>The low-level Unix error number causing this entry, if | |
95 | any. Contains the numeric value of | |
96 | <citerefentry project='man-pages'><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry> | |
97 | formatted as a decimal string.</para> | |
ec07c3c8 AK |
98 | |
99 | <xi:include href="version-info.xml" xpointer="v188"/> | |
798d3a52 ZJS |
100 | </listitem> |
101 | </varlistentry> | |
102 | ||
ef886390 AZ |
103 | <varlistentry> |
104 | <term><varname>INVOCATION_ID=</varname></term> | |
105 | <term><varname>USER_INVOCATION_ID=</varname></term> | |
106 | <listitem> | |
107 | <para>A randomized, unique 128-bit ID identifying each runtime cycle of the unit. This is different from | |
108 | <varname>_SYSTEMD_INVOCATION_ID</varname> in that it is only used for messages coming from systemd code | |
109 | (e.g. logs from the system/user manager or from forked processes performing systemd-related setup).</para> | |
ec07c3c8 AK |
110 | |
111 | <xi:include href="version-info.xml" xpointer="v245"/> | |
ef886390 AZ |
112 | </listitem> |
113 | </varlistentry> | |
114 | ||
798d3a52 ZJS |
115 | <varlistentry> |
116 | <term><varname>SYSLOG_FACILITY=</varname></term> | |
117 | <term><varname>SYSLOG_IDENTIFIER=</varname></term> | |
118 | <term><varname>SYSLOG_PID=</varname></term> | |
7c30c3c4 | 119 | <term><varname>SYSLOG_TIMESTAMP=</varname></term> |
798d3a52 | 120 | <listitem> |
7c30c3c4 ZJS |
121 | <para>Syslog compatibility fields containing the facility (formatted as |
122 | decimal string), the identifier string (i.e. "tag"), the client PID, and | |
123 | the timestamp as specified in the original datagram. (Note that the tag is | |
124 | usually derived from glibc's | |
125 | <varname>program_invocation_short_name</varname> variable, see | |
3ba3a79d | 126 | <citerefentry project='die-net'><refentrytitle>program_invocation_short_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.)</para> |
63ea8032 JS |
127 | <para>Note that the journal service does not validate the values of any structured |
128 | journal fields whose name is not prefixed with an underscore, and this includes any | |
129 | syslog related fields such as these. Hence, applications that supply a facility, PID, | |
130 | or log level are expected to do so properly formatted, i.e. as numeric integers formatted | |
131 | as decimal strings.</para> | |
798d3a52 | 132 | </listitem> |
df8701a3 | 133 | </varlistentry> |
798d3a52 | 134 | |
df8701a3 ZJS |
135 | <varlistentry> |
136 | <term><varname>SYSLOG_RAW=</varname></term> | |
137 | <listitem> | |
138 | <para>The original contents of the syslog line as received in the syslog | |
139 | datagram. This field is only included if the <varname>MESSAGE=</varname> | |
7c30c3c4 ZJS |
140 | field was modified compared to the original payload or the timestamp could |
141 | not be located properly and is not included in | |
84b10e53 | 142 | <varname>SYSLOG_TIMESTAMP=</varname>. Message truncation occurs when |
7c30c3c4 | 143 | the message contains leading or trailing whitespace (trailing and leading |
df8701a3 ZJS |
144 | whitespace is stripped), or it contains an embedded |
145 | <constant>NUL</constant> byte (the <constant>NUL</constant> byte and | |
146 | anything after it is not included). Thus, the original syslog line is | |
147 | either stored as <varname>SYSLOG_RAW=</varname> or it can be recreated | |
7c30c3c4 ZJS |
148 | based on the stored priority and facility, timestamp, identifier, and the |
149 | message payload in <varname>MESSAGE=</varname>. | |
150 | </para> | |
ec07c3c8 AK |
151 | |
152 | <xi:include href="version-info.xml" xpointer="v240"/> | |
df8701a3 | 153 | </listitem> |
798d3a52 | 154 | </varlistentry> |
dd587c3a LP |
155 | |
156 | <varlistentry> | |
157 | <term><varname>DOCUMENTATION=</varname></term> | |
158 | <listitem> | |
159 | <para>A documentation URL with further information about the topic of the log message. Tools such | |
5bc9ea07 | 160 | as <command>journalctl</command> will include a hyperlink to a URL specified this way in their |
c1d1742a | 161 | output. Should be an <literal>http://</literal>, <literal>https://</literal>, |
dd587c3a | 162 | <literal>file:/</literal>, <literal>man:</literal> or <literal>info:</literal> URL.</para> |
ec07c3c8 AK |
163 | |
164 | <xi:include href="version-info.xml" xpointer="v246"/> | |
dd587c3a LP |
165 | </listitem> |
166 | </varlistentry> | |
38ffc7d1 LP |
167 | |
168 | <varlistentry> | |
169 | <term><varname>TID=</varname></term> | |
170 | <listitem> | |
171 | <para>The numeric thread ID (TID) the log message originates from.</para> | |
ec07c3c8 AK |
172 | |
173 | <xi:include href="version-info.xml" xpointer="v247"/> | |
38ffc7d1 LP |
174 | </listitem> |
175 | </varlistentry> | |
c1d1742a ZJS |
176 | |
177 | <varlistentry> | |
178 | <term><varname>UNIT=</varname></term> | |
179 | <term><varname>USER_UNIT=</varname></term> | |
180 | <listitem> | |
181 | <para>The name of a unit. Used by the system and user managers when logging about specific | |
182 | units.</para> | |
183 | ||
184 | <para>When <option>--unit=<replaceable>name</replaceable></option> or | |
185 | <option>--user-unit=<replaceable>name</replaceable></option> are used with | |
186 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, a | |
187 | match pattern that includes <literal>UNIT=<replaceable>name</replaceable>.service</literal> or | |
188 | <literal>USER_UNIT=<replaceable>name</replaceable>.service</literal> will be generated.</para> | |
ec07c3c8 AK |
189 | |
190 | <xi:include href="version-info.xml" xpointer="v251"/> | |
c1d1742a ZJS |
191 | </listitem> |
192 | </varlistentry> | |
798d3a52 ZJS |
193 | </variablelist> |
194 | </refsect1> | |
195 | ||
196 | <refsect1> | |
197 | <title>Trusted Journal Fields</title> | |
198 | ||
199 | <para>Fields prefixed with an underscore are trusted fields, i.e. | |
200 | fields that are implicitly added by the journal and cannot be | |
201 | altered by client code.</para> | |
202 | ||
203 | <variablelist class='journal-directives'> | |
204 | <varlistentry> | |
205 | <term><varname>_PID=</varname></term> | |
206 | <term><varname>_UID=</varname></term> | |
207 | <term><varname>_GID=</varname></term> | |
208 | <listitem> | |
209 | <para>The process, user, and group ID of the process the | |
210 | journal entry originates from formatted as a decimal | |
a96f668e MK |
211 | string. Note that entries obtained via <literal>stdout</literal> or |
212 | <literal>stderr</literal> of forked processes will contain credentials valid for a parent | |
213 | process (that initiated the connection to <command>systemd-journald</command>).</para> | |
798d3a52 ZJS |
214 | </listitem> |
215 | </varlistentry> | |
216 | ||
217 | <varlistentry> | |
218 | <term><varname>_COMM=</varname></term> | |
219 | <term><varname>_EXE=</varname></term> | |
220 | <term><varname>_CMDLINE=</varname></term> | |
221 | <listitem> | |
222 | <para>The name, the executable path, and the command line of | |
223 | the process the journal entry originates from.</para> | |
224 | </listitem> | |
225 | </varlistentry> | |
226 | ||
227 | <varlistentry> | |
228 | <term><varname>_CAP_EFFECTIVE=</varname></term> | |
229 | <listitem> | |
230 | <para>The effective | |
231 | <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> | |
232 | of the process the journal entry originates from.</para> | |
ec07c3c8 AK |
233 | |
234 | <xi:include href="version-info.xml" xpointer="v206"/> | |
798d3a52 ZJS |
235 | </listitem> |
236 | </varlistentry> | |
237 | ||
238 | <varlistentry> | |
239 | <term><varname>_AUDIT_SESSION=</varname></term> | |
240 | <term><varname>_AUDIT_LOGINUID=</varname></term> | |
241 | <listitem> | |
242 | <para>The session and login UID of the process the journal | |
243 | entry originates from, as maintained by the kernel audit | |
244 | subsystem.</para> | |
245 | </listitem> | |
246 | </varlistentry> | |
247 | ||
248 | <varlistentry> | |
249 | <term><varname>_SYSTEMD_CGROUP=</varname></term> | |
fa93fe9c | 250 | <term><varname>_SYSTEMD_SLICE=</varname></term> |
798d3a52 ZJS |
251 | <term><varname>_SYSTEMD_UNIT=</varname></term> |
252 | <term><varname>_SYSTEMD_USER_UNIT=</varname></term> | |
0e4a4f56 | 253 | <term><varname>_SYSTEMD_USER_SLICE=</varname></term> |
fa93fe9c | 254 | <term><varname>_SYSTEMD_SESSION=</varname></term> |
798d3a52 | 255 | <term><varname>_SYSTEMD_OWNER_UID=</varname></term> |
798d3a52 ZJS |
256 | |
257 | <listitem> | |
885a4e6c ZJS |
258 | <para>The control group path in the systemd hierarchy, the systemd slice unit name, the systemd |
259 | unit name, the unit name in the systemd user manager (if any), the systemd session ID (if any), and | |
260 | the owner UID of the systemd user unit or systemd session (if any) of the process the journal entry | |
261 | originates from.</para> | |
798d3a52 ZJS |
262 | </listitem> |
263 | </varlistentry> | |
264 | ||
265 | <varlistentry> | |
266 | <term><varname>_SELINUX_CONTEXT=</varname></term> | |
267 | <listitem> | |
268 | <para>The SELinux security context (label) of the process | |
269 | the journal entry originates from.</para> | |
270 | </listitem> | |
271 | </varlistentry> | |
272 | ||
273 | <varlistentry> | |
274 | <term><varname>_SOURCE_REALTIME_TIMESTAMP=</varname></term> | |
275 | <listitem> | |
276 | <para>The earliest trusted timestamp of the message, if any | |
277 | is known that is different from the reception time of the | |
278 | journal. This is the time in microseconds since the epoch | |
279 | UTC, formatted as a decimal string.</para> | |
280 | </listitem> | |
281 | </varlistentry> | |
282 | ||
283 | <varlistentry> | |
284 | <term><varname>_BOOT_ID=</varname></term> | |
285 | <listitem> | |
286 | <para>The kernel boot ID for the boot the message was | |
287 | generated in, formatted as a 128-bit hexadecimal | |
288 | string.</para> | |
289 | </listitem> | |
290 | </varlistentry> | |
291 | ||
292 | <varlistentry> | |
293 | <term><varname>_MACHINE_ID=</varname></term> | |
294 | <listitem> | |
295 | <para>The machine ID of the originating host, as available | |
296 | in | |
297 | <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para> | |
298 | </listitem> | |
299 | </varlistentry> | |
300 | ||
dbb1d5cf LW |
301 | <varlistentry> |
302 | <term><varname>_SYSTEMD_INVOCATION_ID=</varname></term> | |
303 | <listitem> | |
304 | <para>The invocation ID for the runtime cycle of the unit | |
305 | the message was generated in, as available to processes | |
306 | of the unit in <varname>$INVOCATION_ID</varname> (see | |
307 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>).</para> | |
ec07c3c8 AK |
308 | |
309 | <xi:include href="version-info.xml" xpointer="v233"/> | |
dbb1d5cf LW |
310 | </listitem> |
311 | </varlistentry> | |
312 | ||
798d3a52 ZJS |
313 | <varlistentry> |
314 | <term><varname>_HOSTNAME=</varname></term> | |
315 | <listitem> | |
316 | <para>The name of the originating host.</para> | |
317 | </listitem> | |
318 | </varlistentry> | |
319 | ||
320 | <varlistentry> | |
321 | <term><varname>_TRANSPORT=</varname></term> | |
322 | <listitem> | |
323 | <para>How the entry was received by the journal service. | |
324 | Valid transports are: | |
325 | </para> | |
326 | <variablelist> | |
8983e16a EV |
327 | <varlistentry> |
328 | <term> | |
329 | <option>audit</option> | |
330 | </term> | |
331 | <listitem> | |
332 | <para>for those read from the kernel audit subsystem | |
333 | </para> | |
ec07c3c8 AK |
334 | |
335 | <xi:include href="version-info.xml" xpointer="v227"/> | |
8983e16a EV |
336 | </listitem> |
337 | </varlistentry> | |
338 | ||
798d3a52 ZJS |
339 | <varlistentry> |
340 | <term> | |
341 | <option>driver</option> | |
342 | </term> | |
343 | <listitem> | |
344 | <para>for internally generated messages | |
5199cbe4 | 345 | </para> |
ec07c3c8 AK |
346 | |
347 | <xi:include href="version-info.xml" xpointer="v205"/> | |
798d3a52 ZJS |
348 | </listitem> |
349 | </varlistentry> | |
350 | ||
351 | <varlistentry> | |
352 | <term> | |
353 | <option>syslog</option> | |
354 | </term> | |
355 | <listitem> | |
356 | <para>for those received via the local syslog socket | |
357 | with the syslog protocol | |
53057ef9 | 358 | </para> |
ec07c3c8 AK |
359 | |
360 | <xi:include href="version-info.xml" xpointer="v205"/> | |
798d3a52 ZJS |
361 | </listitem> |
362 | </varlistentry> | |
363 | ||
364 | <varlistentry> | |
365 | <term> | |
366 | <option>journal</option> | |
367 | </term> | |
368 | <listitem> | |
369 | <para>for those received via the native journal | |
370 | protocol | |
371 | </para> | |
ec07c3c8 AK |
372 | |
373 | <xi:include href="version-info.xml" xpointer="v205"/> | |
798d3a52 ZJS |
374 | </listitem> |
375 | </varlistentry> | |
376 | ||
377 | <varlistentry> | |
378 | <term> | |
379 | <option>stdout</option> | |
380 | </term> | |
381 | <listitem> | |
382 | <para>for those read from a service's standard output | |
383 | or error output | |
384 | </para> | |
ec07c3c8 AK |
385 | |
386 | <xi:include href="version-info.xml" xpointer="v205"/> | |
798d3a52 ZJS |
387 | </listitem> |
388 | </varlistentry> | |
389 | ||
390 | <varlistentry> | |
391 | <term> | |
392 | <option>kernel</option> | |
393 | </term> | |
394 | <listitem> | |
395 | <para>for those read from the kernel | |
396 | </para> | |
ec07c3c8 AK |
397 | |
398 | <xi:include href="version-info.xml" xpointer="v205"/> | |
798d3a52 ZJS |
399 | </listitem> |
400 | </varlistentry> | |
401 | </variablelist> | |
402 | </listitem> | |
403 | </varlistentry> | |
ec20fe5f LP |
404 | <varlistentry> |
405 | <term><varname>_STREAM_ID=</varname></term> | |
406 | <listitem> | |
da890466 | 407 | <para>Only applies to <literal>_TRANSPORT=stdout</literal> records: specifies a randomized 128-bit ID assigned |
ec20fe5f LP |
408 | to the stream connection when it was first created. This ID is useful to reconstruct individual log streams |
409 | from the log records: all log records carrying the same stream ID originate from the same stream.</para> | |
ec07c3c8 AK |
410 | |
411 | <xi:include href="version-info.xml" xpointer="v235"/> | |
ec20fe5f LP |
412 | </listitem> |
413 | </varlistentry> | |
414 | <varlistentry> | |
415 | <term><varname>_LINE_BREAK=</varname></term> | |
416 | <listitem> | |
a3d9aee1 LP |
417 | <para>Only applies to <literal>_TRANSPORT=stdout</literal> records: indicates that the log message |
418 | in the standard output/error stream was not terminated with a normal newline character | |
419 | (<literal>\n</literal>, i.e. ASCII 10). Specifically, when set this field is one of | |
6b44ad0b | 420 | <option>nul</option> (in case the line was terminated by a <constant>NUL</constant> byte), <option>line-max</option> (in |
a3d9aee1 LP |
421 | case the maximum log line length was reached, as configured with <varname>LineMax=</varname> in |
422 | <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>), | |
423 | <option>eof</option> (if this was the last log record of a stream and the stream ended without a | |
424 | final newline character), or <option>pid-change</option> (if the process which generated the log | |
425 | output changed in the middle of a line). Note that this record is not generated when a normal | |
426 | newline character was used for marking the log line end.</para> | |
ec07c3c8 AK |
427 | |
428 | <xi:include href="version-info.xml" xpointer="v235"/> | |
ec20fe5f LP |
429 | </listitem> |
430 | </varlistentry> | |
7d8155b3 LP |
431 | <varlistentry> |
432 | <term><varname>_NAMESPACE=</varname></term> | |
433 | ||
434 | <listitem><para>If this file was written by a <command>systemd-journald</command> instance managing a | |
435 | journal namespace that is not the default, this field contains the namespace identifier. See | |
436 | <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> | |
437 | for details about journal namespaces.</para> | |
ec07c3c8 AK |
438 | |
439 | <xi:include href="version-info.xml" xpointer="v245"/> | |
7d8155b3 LP |
440 | </listitem> |
441 | </varlistentry> | |
cae8edd9 | 442 | <varlistentry> |
abd6faae | 443 | <term><varname>_RUNTIME_SCOPE=</varname></term> |
cae8edd9 | 444 | |
abd6faae LP |
445 | <listitem><para>A string field that specifies the runtime scope in which the message was logged. If |
446 | <literal>initrd</literal>, the log message was processed while the system was running inside the | |
55c041b4 | 447 | initrd. If <literal>system</literal>, the log message was generated after the system switched |
ec07c3c8 AK |
448 | execution to the host root filesystem.</para> |
449 | ||
450 | <xi:include href="version-info.xml" xpointer="v252"/></listitem> | |
cae8edd9 | 451 | </varlistentry> |
798d3a52 ZJS |
452 | </variablelist> |
453 | </refsect1> | |
454 | ||
455 | <refsect1> | |
456 | <title>Kernel Journal Fields</title> | |
457 | ||
458 | <para>Kernel fields are fields that are used by messages | |
459 | originating in the kernel and stored in the journal.</para> | |
460 | ||
461 | <variablelist class='journal-directives'> | |
462 | <varlistentry> | |
463 | <term><varname>_KERNEL_DEVICE=</varname></term> | |
464 | <listitem> | |
885a4e6c ZJS |
465 | <para>The kernel device name. If the entry is associated to a block device, contains the major and |
466 | minor numbers of the device node, separated by <literal>:</literal> and prefixed by | |
467 | <literal>b</literal>. Similarly for character devices, but prefixed by <literal>c</literal>. For | |
468 | network devices, this is the interface index prefixed by <literal>n</literal>. For all other | |
469 | devices, this is the subsystem name prefixed by <literal>+</literal>, followed by | |
470 | <literal>:</literal>, followed by the kernel device name.</para> | |
ec07c3c8 AK |
471 | |
472 | <xi:include href="version-info.xml" xpointer="v189"/> | |
798d3a52 ZJS |
473 | </listitem> |
474 | </varlistentry> | |
475 | <varlistentry> | |
476 | <term><varname>_KERNEL_SUBSYSTEM=</varname></term> | |
477 | <listitem> | |
478 | <para>The kernel subsystem name.</para> | |
ec07c3c8 AK |
479 | |
480 | <xi:include href="version-info.xml" xpointer="v189"/> | |
798d3a52 ZJS |
481 | </listitem> |
482 | </varlistentry> | |
483 | <varlistentry> | |
484 | <term><varname>_UDEV_SYSNAME=</varname></term> | |
485 | <listitem> | |
486 | <para>The kernel device name as it shows up in the device | |
3b121157 | 487 | tree below <filename>/sys/</filename>.</para> |
ec07c3c8 AK |
488 | |
489 | <xi:include href="version-info.xml" xpointer="v189"/> | |
798d3a52 ZJS |
490 | </listitem> |
491 | </varlistentry> | |
492 | <varlistentry> | |
493 | <term><varname>_UDEV_DEVNODE=</varname></term> | |
494 | <listitem> | |
495 | <para>The device node path of this device in | |
3b121157 | 496 | <filename>/dev/</filename>.</para> |
ec07c3c8 AK |
497 | |
498 | <xi:include href="version-info.xml" xpointer="v189"/> | |
798d3a52 ZJS |
499 | </listitem> |
500 | </varlistentry> | |
501 | <varlistentry> | |
502 | <term><varname>_UDEV_DEVLINK=</varname></term> | |
503 | <listitem> | |
504 | <para>Additional symlink names pointing to the device node | |
3b121157 | 505 | in <filename>/dev/</filename>. This field is frequently set |
798d3a52 | 506 | more than once per entry.</para> |
ec07c3c8 AK |
507 | |
508 | <xi:include href="version-info.xml" xpointer="v189"/> | |
798d3a52 ZJS |
509 | </listitem> |
510 | </varlistentry> | |
511 | </variablelist> | |
512 | </refsect1> | |
513 | ||
514 | <refsect1> | |
515 | <title>Fields to log on behalf of a different program</title> | |
516 | ||
517 | <para>Fields in this section are used by programs to specify that | |
518 | they are logging on behalf of another program or unit. | |
519 | </para> | |
520 | ||
521 | <para>Fields used by the <command>systemd-coredump</command> | |
522 | coredump kernel helper: | |
523 | </para> | |
524 | ||
525 | <variablelist class='journal-directives'> | |
526 | <varlistentry> | |
527 | <term><varname>COREDUMP_UNIT=</varname></term> | |
528 | <term><varname>COREDUMP_USER_UNIT=</varname></term> | |
529 | <listitem> | |
530 | <para>Used to annotate messages containing coredumps from | |
531 | system and session units. See | |
532 | <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>. | |
533 | </para> | |
aefdc112 AK |
534 | |
535 | <xi:include href="version-info.xml" xpointer="v198"/> | |
798d3a52 ZJS |
536 | </listitem> |
537 | </varlistentry> | |
538 | </variablelist> | |
539 | ||
ff9b60f3 | 540 | <para>Privileged programs (currently UID 0) may attach |
798d3a52 ZJS |
541 | <varname>OBJECT_PID=</varname> to a message. This will instruct |
542 | <command>systemd-journald</command> to attach additional fields on | |
543 | behalf of the caller:</para> | |
544 | ||
545 | <variablelist class='journal-directives'> | |
546 | <varlistentry> | |
547 | <term><varname>OBJECT_PID=<replaceable>PID</replaceable></varname></term> | |
548 | <listitem> | |
549 | <para>PID of the program that this message pertains to. | |
550 | </para> | |
ec07c3c8 AK |
551 | |
552 | <xi:include href="version-info.xml" xpointer="v205"/> | |
798d3a52 ZJS |
553 | </listitem> |
554 | </varlistentry> | |
555 | ||
556 | <varlistentry> | |
557 | <term><varname>OBJECT_UID=</varname></term> | |
558 | <term><varname>OBJECT_GID=</varname></term> | |
559 | <term><varname>OBJECT_COMM=</varname></term> | |
560 | <term><varname>OBJECT_EXE=</varname></term> | |
561 | <term><varname>OBJECT_CMDLINE=</varname></term> | |
562 | <term><varname>OBJECT_AUDIT_SESSION=</varname></term> | |
563 | <term><varname>OBJECT_AUDIT_LOGINUID=</varname></term> | |
564 | <term><varname>OBJECT_SYSTEMD_CGROUP=</varname></term> | |
565 | <term><varname>OBJECT_SYSTEMD_SESSION=</varname></term> | |
566 | <term><varname>OBJECT_SYSTEMD_OWNER_UID=</varname></term> | |
567 | <term><varname>OBJECT_SYSTEMD_UNIT=</varname></term> | |
568 | <term><varname>OBJECT_SYSTEMD_USER_UNIT=</varname></term> | |
569 | <listitem> | |
570 | <para>These are additional fields added automatically by | |
571 | <command>systemd-journald</command>. Their meaning is the | |
572 | same as | |
573 | <varname>_UID=</varname>, | |
574 | <varname>_GID=</varname>, | |
575 | <varname>_COMM=</varname>, | |
576 | <varname>_EXE=</varname>, | |
577 | <varname>_CMDLINE=</varname>, | |
578 | <varname>_AUDIT_SESSION=</varname>, | |
579 | <varname>_AUDIT_LOGINUID=</varname>, | |
580 | <varname>_SYSTEMD_CGROUP=</varname>, | |
581 | <varname>_SYSTEMD_SESSION=</varname>, | |
582 | <varname>_SYSTEMD_UNIT=</varname>, | |
583 | <varname>_SYSTEMD_USER_UNIT=</varname>, and | |
584 | <varname>_SYSTEMD_OWNER_UID=</varname> | |
585 | as described above, except that the process identified by | |
586 | <replaceable>PID</replaceable> is described, instead of the | |
587 | process which logged the message.</para> | |
ec07c3c8 AK |
588 | |
589 | <xi:include href="version-info.xml" xpointer="v205"/> | |
798d3a52 ZJS |
590 | </listitem> |
591 | </varlistentry> | |
592 | </variablelist> | |
593 | ||
798d3a52 ZJS |
594 | </refsect1> |
595 | ||
596 | <refsect1> | |
597 | <title>Address Fields</title> | |
598 | ||
599 | <para>During serialization into external formats, such as the | |
717e92ce ZJS |
600 | <ulink url="https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-export-format">Journal Export Format</ulink> |
601 | or the | |
602 | <ulink url="https://systemd.io/JOURNAL_EXPORT_FORMATS#journal-json-format">Journal JSON Format</ulink>, | |
603 | the addresses of journal entries are | |
798d3a52 ZJS |
604 | serialized into fields prefixed with double underscores. Note that |
605 | these are not proper fields when stored in the journal but for | |
606 | addressing metadata of entries. They cannot be written as part of | |
607 | structured log entries via calls such as | |
608 | <citerefentry><refentrytitle>sd_journal_send</refentrytitle><manvolnum>3</manvolnum></citerefentry>. | |
609 | They may also not be used as matches for | |
e9dd6984 ZJS |
610 | <citerefentry><refentrytitle>sd_journal_add_match</refentrytitle><manvolnum>3</manvolnum></citerefentry>. |
611 | </para> | |
798d3a52 ZJS |
612 | |
613 | <variablelist class='journal-directives'> | |
614 | <varlistentry> | |
615 | <term><varname>__CURSOR=</varname></term> | |
616 | <listitem> | |
617 | <para>The cursor for the entry. A cursor is an opaque text | |
618 | string that uniquely describes the position of an entry in | |
619 | the journal and is portable across machines, platforms and | |
620 | journal files. | |
621 | </para> | |
622 | </listitem> | |
623 | </varlistentry> | |
624 | ||
625 | <varlistentry> | |
626 | <term><varname>__REALTIME_TIMESTAMP=</varname></term> | |
627 | <listitem> | |
628 | <para>The wallclock time | |
629 | (<constant>CLOCK_REALTIME</constant>) at the point in time | |
630 | the entry was received by the journal, in microseconds since | |
631 | the epoch UTC, formatted as a decimal string. This has | |
632 | different properties from | |
633 | <literal>_SOURCE_REALTIME_TIMESTAMP=</literal>, as it is | |
634 | usually a bit later but more likely to be monotonic. | |
635 | </para> | |
636 | </listitem> | |
637 | </varlistentry> | |
638 | ||
639 | <varlistentry> | |
640 | <term><varname>__MONOTONIC_TIMESTAMP=</varname></term> | |
641 | <listitem> | |
642 | <para>The monotonic time | |
643 | (<constant>CLOCK_MONOTONIC</constant>) at the point in time | |
644 | the entry was received by the journal in microseconds, | |
645 | formatted as a decimal string. To be useful as an address | |
646 | for the entry, this should be combined with the boot ID in | |
647 | <literal>_BOOT_ID=</literal>. | |
648 | </para> | |
649 | </listitem> | |
650 | </varlistentry> | |
11181f8a LP |
651 | |
652 | <varlistentry> | |
653 | <term><varname>__SEQNUM=</varname></term> | |
654 | <term><varname>__SEQNUM_ID=</varname></term> | |
655 | ||
656 | <listitem><para>The sequence number (and associated sequence number ID) of this journal entry in the | |
657 | journal file it originates from. See | |
658 | <citerefentry><refentrytitle>sd_journal_get_seqnum</refentrytitle><manvolnum>3</manvolnum></citerefentry> | |
ec07c3c8 AK |
659 | for details.</para> |
660 | ||
661 | <xi:include href="version-info.xml" xpointer="v254"/></listitem> | |
11181f8a | 662 | </varlistentry> |
798d3a52 ZJS |
663 | </variablelist> |
664 | </refsect1> | |
665 | ||
666 | <refsect1> | |
667 | <title>See Also</title> | |
13a69c12 DT |
668 | <para><simplelist type="inline"> |
669 | <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
670 | <member><citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member> | |
671 | <member><citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
672 | <member><citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member> | |
673 | <member><citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry></member> | |
674 | <member><citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
675 | <member><citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry></member> | |
676 | </simplelist></para> | |
798d3a52 | 677 | </refsect1> |
ffa16db0 LP |
678 | |
679 | </refentry> |