src/shared/logs-show.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <signal.h>
  23 #include <stdint.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <syslog.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32 #include "sd-journal.h"
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "format-util.h"
  37 #include "hashmap.h"
  38 #include "hostname-util.h"
  39 #include "io-util.h"
  40 #include "journal-internal.h"
  41 #include "log.h"
  42 #include "logs-show.h"
  43 #include "macro.h"
  44 #include "output-mode.h"
  45 #include "parse-util.h"
  46 #include "process-util.h"
  47 #include "sparse-endian.h"
  48 #include "stdio-util.h"
  49 #include "string-table.h"
  50 #include "string-util.h"
  51 #include "terminal-util.h"
  52 #include "time-util.h"
  53 #include "utf8.h"
  54 #include "util.h"
  55
  56 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  57 #define PRINT_LINE_THRESHOLD 3
  58 #define PRINT_CHAR_THRESHOLD 300
  59
  60 #define JSON_THRESHOLD 4096
  61
  62 static int print_catalog(FILE *f, sd_journal *j) {
  63         int r;
  64         _cleanup_free_ char *t = NULL, *z = NULL;
  65
  66
  67         r = sd_journal_get_catalog(j, &t);
  68         if (r < 0)
  69                 return r;
  70
  71         z = strreplace(strstrip(t), "\n", "\n-- ");
  72         if (!z)
  73                 return log_oom();
  74
  75         fputs("-- ", f);
  76         fputs(z, f);
  77         fputc('\n', f);
  78
  79         return 0;
  80 }
  81
  82 static int parse_field(const void *data, size_t length, const char *field, char **target, size_t *target_size) {
  83         size_t fl, nl;
  84         char *buf;
  85
  86         assert(data);
  87         assert(field);
  88         assert(target);
  89
  90         fl = strlen(field);
  91         if (length < fl)
  92                 return 0;
  93
  94         if (memcmp(data, field, fl))
  95                 return 0;
  96
  97         nl = length - fl;
  98         buf = new(char, nl+1);
  99         if (!buf)
 100                 return log_oom();
 101
 102         memcpy(buf, (const char*) data + fl, nl);
 103         buf[nl] = 0;
 104
 105         free(*target);
 106         *target = buf;
 107
 108         if (target_size)
 109                 *target_size = nl;
 110
 111         return 1;
 112 }
 113
 114 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 115         assert(p);
 116
 117         if (flags & OUTPUT_SHOW_ALL)
 118                 return true;
 119
 120         if (l >= PRINT_CHAR_THRESHOLD)
 121                 return false;
 122
 123         if (!utf8_is_printable(p, l))
 124                 return false;
 125
 126         return true;
 127 }
 128
 129 static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
 130         const char *color_on = "", *color_off = "";
 131         const char *pos, *end;
 132         bool ellipsized = false;
 133         int line = 0;
 134
 135         if (flags & OUTPUT_COLOR) {
 136                 if (priority <= LOG_ERR) {
 137                         color_on = ANSI_HIGHLIGHT_RED;
 138                         color_off = ANSI_NORMAL;
 139                 } else if (priority <= LOG_NOTICE) {
 140                         color_on = ANSI_HIGHLIGHT;
 141                         color_off = ANSI_NORMAL;
 142                 }
 143         }
 144
 145         /* A special case: make sure that we print a newline when
 146            the message is empty. */
 147         if (message_len == 0)
 148                 fputs("\n", f);
 149
 150         for (pos = message;
 151              pos < message + message_len;
 152              pos = end + 1, line++) {
 153                 bool continuation = line > 0;
 154                 bool tail_line;
 155                 int len;
 156                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 157                         ;
 158                 len = end - pos;
 159                 assert(len >= 0);
 160
 161                 /* We need to figure out when we are showing not-last line, *and*
 162                  * will skip subsequent lines. In that case, we will put the dots
 163                  * at the end of the line, instead of putting dots in the middle
 164                  * or not at all.
 165                  */
 166                 tail_line =
 167                         line + 1 == PRINT_LINE_THRESHOLD ||
 168                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 169
 170                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 171                     (prefix + len + 1 < n_columns && !tail_line)) {
 172                         fprintf(f, "%*s%s%.*s%s\n",
 173                                 continuation * prefix, "",
 174                                 color_on, len, pos, color_off);
 175                         continue;
 176                 }
 177
 178                 /* Beyond this point, ellipsization will happen. */
 179                 ellipsized = true;
 180
 181                 if (prefix < n_columns && n_columns - prefix >= 3) {
 182                         if (n_columns - prefix > (unsigned) len + 3)
 183                                 fprintf(f, "%*s%s%.*s...%s\n",
 184                                         continuation * prefix, "",
 185                                         color_on, len, pos, color_off);
 186                         else {
 187                                 _cleanup_free_ char *e;
 188
 189                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 190                                                   tail_line ? 100 : 90);
 191                                 if (!e)
 192                                         fprintf(f, "%*s%s%.*s%s\n",
 193                                                 continuation * prefix, "",
 194                                                 color_on, len, pos, color_off);
 195                                 else
 196                                         fprintf(f, "%*s%s%s%s\n",
 197                                                 continuation * prefix, "",
 198                                                 color_on, e, color_off);
 199                         }
 200                 } else
 201                         fputs("...\n", f);
 202
 203                 if (tail_line)
 204                         break;
 205         }
 206
 207         return ellipsized;
 208 }
 209
 210 static int output_timestamp_monotonic(FILE *f, sd_journal *j, const char *monotonic) {
 211         sd_id128_t boot_id;
 212         uint64_t t;
 213         int r;
 214
 215         assert(f);
 216         assert(j);
 217
 218         r = -ENXIO;
 219         if (monotonic)
 220                 r = safe_atou64(monotonic, &t);
 221         if (r < 0)
 222                 r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 223         if (r < 0)
 224                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 225
 226         fprintf(f, "[%5"PRI_USEC".%06"PRI_USEC"]", t / USEC_PER_SEC, t % USEC_PER_SEC);
 227         return 1 + 5 + 1 + 6 + 1;
 228 }
 229
 230 static int output_timestamp_realtime(FILE *f, sd_journal *j, OutputMode mode, OutputFlags flags, const char *realtime) {
 231         char buf[MAX(FORMAT_TIMESTAMP_MAX, 64)];
 232         struct tm *(*gettime_r)(const time_t *, struct tm *);
 233         struct tm tm;
 234         uint64_t x;
 235         time_t t;
 236         int r;
 237
 238         assert(f);
 239         assert(j);
 240
 241         r = -ENXIO;
 242         if (realtime)
 243                 r = safe_atou64(realtime, &x);
 244         if (r < 0)
 245                 r = sd_journal_get_realtime_usec(j, &x);
 246         if (r < 0)
 247                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 248
 249         if (mode == OUTPUT_SHORT_FULL) {
 250                 const char *k;
 251
 252                 if (flags & OUTPUT_UTC)
 253                         k = format_timestamp_utc(buf, sizeof(buf), x);
 254                 else
 255                         k = format_timestamp(buf, sizeof(buf), x);
 256                 if (!k) {
 257                         log_error("Failed to format timestamp.");
 258                         return -EINVAL;
 259                 }
 260
 261         } else {
 262                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 263                 t = (time_t) (x / USEC_PER_SEC);
 264
 265                 switch (mode) {
 266
 267                 case OUTPUT_SHORT_UNIX:
 268                         xsprintf(buf, "%10"PRI_TIME".%06"PRIu64, t, x % USEC_PER_SEC);
 269                         break;
 270
 271                 case OUTPUT_SHORT_ISO:
 272                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm)) <= 0) {
 273                                 log_error("Failed for format ISO time");
 274                                 return -EINVAL;
 275                         }
 276                         break;
 277
 278                 case OUTPUT_SHORT:
 279                 case OUTPUT_SHORT_PRECISE:
 280
 281                         if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm)) <= 0) {
 282                                 log_error("Failed to format syslog time");
 283                                 return -EINVAL;
 284                         }
 285
 286                         if (mode == OUTPUT_SHORT_PRECISE) {
 287                                 size_t k;
 288
 289                                 assert(sizeof(buf) > strlen(buf));
 290                                 k = sizeof(buf) - strlen(buf);
 291
 292                                 r = snprintf(buf + strlen(buf), k, ".%06"PRIu64, x % USEC_PER_SEC);
 293                                 if (r <= 0 || (size_t) r >= k) { /* too long? */
 294                                         log_error("Failed to format precise time");
 295                                         return -EINVAL;
 296                                 }
 297                         }
 298                         break;
 299
 300                 default:
 301                         assert_not_reached("Unknown time format");
 302                 }
 303         }
 304
 305         fputs(buf, f);
 306         return (int) strlen(buf);
 307 }
 308
 309 static int output_short(
 310                 FILE *f,
 311                 sd_journal *j,
 312                 OutputMode mode,
 313                 unsigned n_columns,
 314                 OutputFlags flags) {
 315
 316         int r;
 317         const void *data;
 318         size_t length;
 319         size_t n = 0;
 320         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
 321         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
 322         int p = LOG_INFO;
 323         bool ellipsized = false;
 324
 325         assert(f);
 326         assert(j);
 327
 328         /* Set the threshold to one bigger than the actual print
 329          * threshold, so that if the line is actually longer than what
 330          * we're willing to print, ellipsization will occur. This way
 331          * we won't output a misleading line without any indication of
 332          * truncation.
 333          */
 334         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 335
 336         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 337
 338                 r = parse_field(data, length, "PRIORITY=", &priority, &priority_len);
 339                 if (r < 0)
 340                         return r;
 341                 else if (r > 0)
 342                         continue;
 343
 344                 r = parse_field(data, length, "_HOSTNAME=", &hostname, &hostname_len);
 345                 if (r < 0)
 346                         return r;
 347                 else if (r > 0)
 348                         continue;
 349
 350                 r = parse_field(data, length, "SYSLOG_IDENTIFIER=", &identifier, &identifier_len);
 351                 if (r < 0)
 352                         return r;
 353                 else if (r > 0)
 354                         continue;
 355
 356                 r = parse_field(data, length, "_COMM=", &comm, &comm_len);
 357                 if (r < 0)
 358                         return r;
 359                 else if (r > 0)
 360                         continue;
 361
 362                 r = parse_field(data, length, "_PID=", &pid, &pid_len);
 363                 if (r < 0)
 364                         return r;
 365                 else if (r > 0)
 366                         continue;
 367
 368                 r = parse_field(data, length, "SYSLOG_PID=", &fake_pid, &fake_pid_len);
 369                 if (r < 0)
 370                         return r;
 371                 else if (r > 0)
 372                         continue;
 373
 374                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len);
 375                 if (r < 0)
 376                         return r;
 377                 else if (r > 0)
 378                         continue;
 379
 380                 r = parse_field(data, length, "_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len);
 381                 if (r < 0)
 382                         return r;
 383                 else if (r > 0)
 384                         continue;
 385
 386                 r = parse_field(data, length, "MESSAGE=", &message, &message_len);
 387                 if (r < 0)
 388                         return r;
 389         }
 390         if (r == -EBADMSG) {
 391                 log_debug_errno(r, "Skipping message we can't read: %m");
 392                 return 0;
 393         }
 394         if (r < 0)
 395                 return log_error_errno(r, "Failed to get journal fields: %m");
 396
 397         if (!message) {
 398                 log_debug("Skipping message without MESSAGE= field.");
 399                 return 0;
 400         }
 401
 402         if (!(flags & OUTPUT_SHOW_ALL))
 403                 strip_tab_ansi(&message, &message_len);
 404
 405         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 406                 p = *priority - '0';
 407
 408         if (mode == OUTPUT_SHORT_MONOTONIC)
 409                 r = output_timestamp_monotonic(f, j, monotonic);
 410         else
 411                 r = output_timestamp_realtime(f, j, mode, flags, realtime);
 412         if (r < 0)
 413                 return r;
 414         n += r;
 415
 416         if (flags & OUTPUT_NO_HOSTNAME) {
 417                 /* Suppress display of the hostname if this is requested. */
 418                 hostname = mfree(hostname);
 419                 hostname_len = 0;
 420         }
 421
 422         if (hostname && shall_print(hostname, hostname_len, flags)) {
 423                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 424                 n += hostname_len + 1;
 425         }
 426
 427         if (identifier && shall_print(identifier, identifier_len, flags)) {
 428                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 429                 n += identifier_len + 1;
 430         } else if (comm && shall_print(comm, comm_len, flags)) {
 431                 fprintf(f, " %.*s", (int) comm_len, comm);
 432                 n += comm_len + 1;
 433         } else
 434                 fputs(" unknown", f);
 435
 436         if (pid && shall_print(pid, pid_len, flags)) {
 437                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 438                 n += pid_len + 2;
 439         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 440                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 441                 n += fake_pid_len + 2;
 442         }
 443
 444         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 445                 char bytes[FORMAT_BYTES_MAX];
 446                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 447         } else {
 448                 fputs(": ", f);
 449                 ellipsized |=
 450                         print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
 451         }
 452
 453         if (flags & OUTPUT_CATALOG)
 454                 print_catalog(f, j);
 455
 456         return ellipsized;
 457 }
 458
 459 static int output_verbose(
 460                 FILE *f,
 461                 sd_journal *j,
 462                 OutputMode mode,
 463                 unsigned n_columns,
 464                 OutputFlags flags) {
 465
 466         const void *data;
 467         size_t length;
 468         _cleanup_free_ char *cursor = NULL;
 469         uint64_t realtime = 0;
 470         char ts[FORMAT_TIMESTAMP_MAX + 7];
 471         int r;
 472
 473         assert(f);
 474         assert(j);
 475
 476         sd_journal_set_data_threshold(j, 0);
 477
 478         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 479         if (r == -ENOENT)
 480                 log_debug("Source realtime timestamp not found");
 481         else if (r < 0)
 482                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 483         else {
 484                 _cleanup_free_ char *value = NULL;
 485
 486                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &value, NULL);
 487                 if (r < 0)
 488                         return r;
 489                 assert(r > 0);
 490
 491                 r = safe_atou64(value, &realtime);
 492                 if (r < 0)
 493                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 494         }
 495
 496         if (r < 0) {
 497                 r = sd_journal_get_realtime_usec(j, &realtime);
 498                 if (r < 0)
 499                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 500         }
 501
 502         r = sd_journal_get_cursor(j, &cursor);
 503         if (r < 0)
 504                 return log_error_errno(r, "Failed to get cursor: %m");
 505
 506         fprintf(f, "%s [%s]\n",
 507                 flags & OUTPUT_UTC ?
 508                 format_timestamp_us_utc(ts, sizeof(ts), realtime) :
 509                 format_timestamp_us(ts, sizeof(ts), realtime),
 510                 cursor);
 511
 512         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 513                 const char *c;
 514                 int fieldlen;
 515                 const char *on = "", *off = "";
 516
 517                 c = memchr(data, '=', length);
 518                 if (!c) {
 519                         log_error("Invalid field.");
 520                         return -EINVAL;
 521                 }
 522                 fieldlen = c - (const char*) data;
 523
 524                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 525                         on = ANSI_HIGHLIGHT;
 526                         off = ANSI_NORMAL;
 527                 }
 528
 529                 if ((flags & OUTPUT_SHOW_ALL) ||
 530                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 531                      && utf8_is_printable(data, length))) {
 532                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 533                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
 534                         fputs(off, f);
 535                 } else {
 536                         char bytes[FORMAT_BYTES_MAX];
 537
 538                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 539                                 on,
 540                                 (int) (c - (const char*) data),
 541                                 (const char*) data,
 542                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 543                                 off);
 544                 }
 545         }
 546
 547         if (r < 0)
 548                 return r;
 549
 550         if (flags & OUTPUT_CATALOG)
 551                 print_catalog(f, j);
 552
 553         return 0;
 554 }
 555
 556 static int output_export(
 557                 FILE *f,
 558                 sd_journal *j,
 559                 OutputMode mode,
 560                 unsigned n_columns,
 561                 OutputFlags flags) {
 562
 563         sd_id128_t boot_id;
 564         char sid[33];
 565         int r;
 566         usec_t realtime, monotonic;
 567         _cleanup_free_ char *cursor = NULL;
 568         const void *data;
 569         size_t length;
 570
 571         assert(j);
 572
 573         sd_journal_set_data_threshold(j, 0);
 574
 575         r = sd_journal_get_realtime_usec(j, &realtime);
 576         if (r < 0)
 577                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 578
 579         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 580         if (r < 0)
 581                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 582
 583         r = sd_journal_get_cursor(j, &cursor);
 584         if (r < 0)
 585                 return log_error_errno(r, "Failed to get cursor: %m");
 586
 587         fprintf(f,
 588                 "__CURSOR=%s\n"
 589                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 590                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 591                 "_BOOT_ID=%s\n",
 592                 cursor,
 593                 realtime,
 594                 monotonic,
 595                 sd_id128_to_string(boot_id, sid));
 596
 597         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 598
 599                 /* We already printed the boot id, from the data in
 600                  * the header, hence let's suppress it here */
 601                 if (length >= 9 &&
 602                     startswith(data, "_BOOT_ID="))
 603                         continue;
 604
 605                 if (utf8_is_printable_newline(data, length, false))
 606                         fwrite(data, length, 1, f);
 607                 else {
 608                         const char *c;
 609                         uint64_t le64;
 610
 611                         c = memchr(data, '=', length);
 612                         if (!c) {
 613                                 log_error("Invalid field.");
 614                                 return -EINVAL;
 615                         }
 616
 617                         fwrite(data, c - (const char*) data, 1, f);
 618                         fputc('\n', f);
 619                         le64 = htole64(length - (c - (const char*) data) - 1);
 620                         fwrite(&le64, sizeof(le64), 1, f);
 621                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 622                 }
 623
 624                 fputc('\n', f);
 625         }
 626
 627         if (r < 0)
 628                 return r;
 629
 630         fputc('\n', f);
 631
 632         return 0;
 633 }
 634
 635 void json_escape(
 636                 FILE *f,
 637                 const char* p,
 638                 size_t l,
 639                 OutputFlags flags) {
 640
 641         assert(f);
 642         assert(p);
 643
 644         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 645                 fputs("null", f);
 646
 647         else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
 648                 bool not_first = false;
 649
 650                 fputs("[ ", f);
 651
 652                 while (l > 0) {
 653                         if (not_first)
 654                                 fprintf(f, ", %u", (uint8_t) *p);
 655                         else {
 656                                 not_first = true;
 657                                 fprintf(f, "%u", (uint8_t) *p);
 658                         }
 659
 660                         p++;
 661                         l--;
 662                 }
 663
 664                 fputs(" ]", f);
 665         } else {
 666                 fputc('\"', f);
 667
 668                 while (l > 0) {
 669                         if (*p == '"' || *p == '\\') {
 670                                 fputc('\\', f);
 671                                 fputc(*p, f);
 672                         } else if (*p == '\n')
 673                                 fputs("\\n", f);
 674                         else if ((uint8_t) *p < ' ')
 675                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 676                         else
 677                                 fputc(*p, f);
 678
 679                         p++;
 680                         l--;
 681                 }
 682
 683                 fputc('\"', f);
 684         }
 685 }
 686
 687 static int output_json(
 688                 FILE *f,
 689                 sd_journal *j,
 690                 OutputMode mode,
 691                 unsigned n_columns,
 692                 OutputFlags flags) {
 693
 694         uint64_t realtime, monotonic;
 695         _cleanup_free_ char *cursor = NULL;
 696         const void *data;
 697         size_t length;
 698         sd_id128_t boot_id;
 699         char sid[33], *k;
 700         int r;
 701         Hashmap *h = NULL;
 702         bool done, separator;
 703
 704         assert(j);
 705
 706         sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 707
 708         r = sd_journal_get_realtime_usec(j, &realtime);
 709         if (r < 0)
 710                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 711
 712         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 713         if (r < 0)
 714                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 715
 716         r = sd_journal_get_cursor(j, &cursor);
 717         if (r < 0)
 718                 return log_error_errno(r, "Failed to get cursor: %m");
 719
 720         if (mode == OUTPUT_JSON_PRETTY)
 721                 fprintf(f,
 722                         "{\n"
 723                         "\t\"__CURSOR\" : \"%s\",\n"
 724                         "\t\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\",\n"
 725                         "\t\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\",\n"
 726                         "\t\"_BOOT_ID\" : \"%s\"",
 727                         cursor,
 728                         realtime,
 729                         monotonic,
 730                         sd_id128_to_string(boot_id, sid));
 731         else {
 732                 if (mode == OUTPUT_JSON_SSE)
 733                         fputs("data: ", f);
 734
 735                 fprintf(f,
 736                         "{ \"__CURSOR\" : \"%s\", "
 737                         "\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\", "
 738                         "\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\", "
 739                         "\"_BOOT_ID\" : \"%s\"",
 740                         cursor,
 741                         realtime,
 742                         monotonic,
 743                         sd_id128_to_string(boot_id, sid));
 744         }
 745
 746         h = hashmap_new(&string_hash_ops);
 747         if (!h)
 748                 return log_oom();
 749
 750         /* First round, iterate through the entry and count how often each field appears */
 751         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 752                 const char *eq;
 753                 char *n;
 754                 unsigned u;
 755
 756                 if (length >= 9 &&
 757                     memcmp(data, "_BOOT_ID=", 9) == 0)
 758                         continue;
 759
 760                 eq = memchr(data, '=', length);
 761                 if (!eq)
 762                         continue;
 763
 764                 n = strndup(data, eq - (const char*) data);
 765                 if (!n) {
 766                         r = log_oom();
 767                         goto finish;
 768                 }
 769
 770                 u = PTR_TO_UINT(hashmap_get(h, n));
 771                 if (u == 0) {
 772                         r = hashmap_put(h, n, UINT_TO_PTR(1));
 773                         if (r < 0) {
 774                                 free(n);
 775                                 log_oom();
 776                                 goto finish;
 777                         }
 778                 } else {
 779                         r = hashmap_update(h, n, UINT_TO_PTR(u + 1));
 780                         free(n);
 781                         if (r < 0) {
 782                                 log_oom();
 783                                 goto finish;
 784                         }
 785                 }
 786         }
 787
 788         if (r < 0)
 789                 return r;
 790
 791         separator = true;
 792         do {
 793                 done = true;
 794
 795                 SD_JOURNAL_FOREACH_DATA(j, data, length) {
 796                         const char *eq;
 797                         char *kk, *n;
 798                         size_t m;
 799                         unsigned u;
 800
 801                         /* We already printed the boot id, from the data in
 802                          * the header, hence let's suppress it here */
 803                         if (length >= 9 &&
 804                             memcmp(data, "_BOOT_ID=", 9) == 0)
 805                                 continue;
 806
 807                         eq = memchr(data, '=', length);
 808                         if (!eq)
 809                                 continue;
 810
 811                         if (separator) {
 812                                 if (mode == OUTPUT_JSON_PRETTY)
 813                                         fputs(",\n\t", f);
 814                                 else
 815                                         fputs(", ", f);
 816                         }
 817
 818                         m = eq - (const char*) data;
 819
 820                         n = strndup(data, m);
 821                         if (!n) {
 822                                 r = log_oom();
 823                                 goto finish;
 824                         }
 825
 826                         u = PTR_TO_UINT(hashmap_get2(h, n, (void**) &kk));
 827                         if (u == 0) {
 828                                 /* We already printed this, let's jump to the next */
 829                                 free(n);
 830                                 separator = false;
 831
 832                                 continue;
 833                         } else if (u == 1) {
 834                                 /* Field only appears once, output it directly */
 835
 836                                 json_escape(f, data, m, flags);
 837                                 fputs(" : ", f);
 838
 839                                 json_escape(f, eq + 1, length - m - 1, flags);
 840
 841                                 hashmap_remove(h, n);
 842                                 free(kk);
 843                                 free(n);
 844
 845                                 separator = true;
 846
 847                                 continue;
 848
 849                         } else {
 850                                 /* Field appears multiple times, output it as array */
 851                                 json_escape(f, data, m, flags);
 852                                 fputs(" : [ ", f);
 853                                 json_escape(f, eq + 1, length - m - 1, flags);
 854
 855                                 /* Iterate through the end of the list */
 856
 857                                 while (sd_journal_enumerate_data(j, &data, &length) > 0) {
 858                                         if (length < m + 1)
 859                                                 continue;
 860
 861                                         if (memcmp(data, n, m) != 0)
 862                                                 continue;
 863
 864                                         if (((const char*) data)[m] != '=')
 865                                                 continue;
 866
 867                                         fputs(", ", f);
 868                                         json_escape(f, (const char*) data + m + 1, length - m - 1, flags);
 869                                 }
 870
 871                                 fputs(" ]", f);
 872
 873                                 hashmap_remove(h, n);
 874                                 free(kk);
 875                                 free(n);
 876
 877                                 /* Iterate data fields form the beginning */
 878                                 done = false;
 879                                 separator = true;
 880
 881                                 break;
 882                         }
 883                 }
 884
 885         } while (!done);
 886
 887         if (mode == OUTPUT_JSON_PRETTY)
 888                 fputs("\n}\n", f);
 889         else if (mode == OUTPUT_JSON_SSE)
 890                 fputs("}\n\n", f);
 891         else
 892                 fputs(" }\n", f);
 893
 894         r = 0;
 895
 896 finish:
 897         while ((k = hashmap_steal_first_key(h)))
 898                 free(k);
 899
 900         hashmap_free(h);
 901
 902         return r;
 903 }
 904
 905 static int output_cat(
 906                 FILE *f,
 907                 sd_journal *j,
 908                 OutputMode mode,
 909                 unsigned n_columns,
 910                 OutputFlags flags) {
 911
 912         const void *data;
 913         size_t l;
 914         int r;
 915
 916         assert(j);
 917         assert(f);
 918
 919         sd_journal_set_data_threshold(j, 0);
 920
 921         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
 922         if (r < 0) {
 923                 /* An entry without MESSAGE=? */
 924                 if (r == -ENOENT)
 925                         return 0;
 926
 927                 return log_error_errno(r, "Failed to get data: %m");
 928         }
 929
 930         assert(l >= 8);
 931
 932         fwrite((const char*) data + 8, 1, l - 8, f);
 933         fputc('\n', f);
 934
 935         return 0;
 936 }
 937
 938 static int (*output_funcs[_OUTPUT_MODE_MAX])(
 939                 FILE *f,
 940                 sd_journal*j,
 941                 OutputMode mode,
 942                 unsigned n_columns,
 943                 OutputFlags flags) = {
 944
 945         [OUTPUT_SHORT] = output_short,
 946         [OUTPUT_SHORT_ISO] = output_short,
 947         [OUTPUT_SHORT_PRECISE] = output_short,
 948         [OUTPUT_SHORT_MONOTONIC] = output_short,
 949         [OUTPUT_SHORT_UNIX] = output_short,
 950         [OUTPUT_SHORT_FULL] = output_short,
 951         [OUTPUT_VERBOSE] = output_verbose,
 952         [OUTPUT_EXPORT] = output_export,
 953         [OUTPUT_JSON] = output_json,
 954         [OUTPUT_JSON_PRETTY] = output_json,
 955         [OUTPUT_JSON_SSE] = output_json,
 956         [OUTPUT_CAT] = output_cat
 957 };
 958
 959 int output_journal(
 960                 FILE *f,
 961                 sd_journal *j,
 962                 OutputMode mode,
 963                 unsigned n_columns,
 964                 OutputFlags flags,
 965                 bool *ellipsized) {
 966
 967         int ret;
 968         assert(mode >= 0);
 969         assert(mode < _OUTPUT_MODE_MAX);
 970
 971         if (n_columns <= 0)
 972                 n_columns = columns();
 973
 974         ret = output_funcs[mode](f, j, mode, n_columns, flags);
 975         fflush(stdout);
 976
 977         if (ellipsized && ret > 0)
 978                 *ellipsized = true;
 979
 980         return ret;
 981 }
 982
 983 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
 984         assert(f);
 985         assert(flags);
 986
 987         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
 988                 return 0;
 989
 990         /* Print a beginning new line if that's request, but only once
 991          * on the first line we print. */
 992
 993         fputc('\n', f);
 994         *flags &= ~OUTPUT_BEGIN_NEWLINE;
 995         return 0;
 996 }
 997
 998 static int show_journal(FILE *f,
 999                         sd_journal *j,
1000                         OutputMode mode,
1001                         unsigned n_columns,
1002                         usec_t not_before,
1003                         unsigned how_many,
1004                         OutputFlags flags,
1005                         bool *ellipsized) {
1006
1007         int r;
1008         unsigned line = 0;
1009         bool need_seek = false;
1010         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
1011
1012         assert(j);
1013         assert(mode >= 0);
1014         assert(mode < _OUTPUT_MODE_MAX);
1015
1016         /* Seek to end */
1017         r = sd_journal_seek_tail(j);
1018         if (r < 0)
1019                 return log_error_errno(r, "Failed to seek to tail: %m");
1020
1021         r = sd_journal_previous_skip(j, how_many);
1022         if (r < 0)
1023                 return log_error_errno(r, "Failed to skip previous: %m");
1024
1025         for (;;) {
1026                 for (;;) {
1027                         usec_t usec;
1028
1029                         if (need_seek) {
1030                                 r = sd_journal_next(j);
1031                                 if (r < 0)
1032                                         return log_error_errno(r, "Failed to iterate through journal: %m");
1033                         }
1034
1035                         if (r == 0)
1036                                 break;
1037
1038                         need_seek = true;
1039
1040                         if (not_before > 0) {
1041                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1042
1043                                 /* -ESTALE is returned if the
1044                                    timestamp is not from this boot */
1045                                 if (r == -ESTALE)
1046                                         continue;
1047                                 else if (r < 0)
1048                                         return log_error_errno(r, "Failed to get journal time: %m");
1049
1050                                 if (usec < not_before)
1051                                         continue;
1052                         }
1053
1054                         line++;
1055                         maybe_print_begin_newline(f, &flags);
1056
1057                         r = output_journal(f, j, mode, n_columns, flags, ellipsized);
1058                         if (r < 0)
1059                                 return r;
1060                 }
1061
1062                 if (warn_cutoff && line < how_many && not_before > 0) {
1063                         sd_id128_t boot_id;
1064                         usec_t cutoff = 0;
1065
1066                         /* Check whether the cutoff line is too early */
1067
1068                         r = sd_id128_get_boot(&boot_id);
1069                         if (r < 0)
1070                                 return log_error_errno(r, "Failed to get boot id: %m");
1071
1072                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1073                         if (r < 0)
1074                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1075
1076                         if (r > 0 && not_before < cutoff) {
1077                                 maybe_print_begin_newline(f, &flags);
1078                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1079                         }
1080
1081                         warn_cutoff = false;
1082                 }
1083
1084                 if (!(flags & OUTPUT_FOLLOW))
1085                         break;
1086
1087                 r = sd_journal_wait(j, USEC_INFINITY);
1088                 if (r < 0)
1089                         return log_error_errno(r, "Failed to wait for journal: %m");
1090
1091         }
1092
1093         return 0;
1094 }
1095
1096 int add_matches_for_unit(sd_journal *j, const char *unit) {
1097         const char *m1, *m2, *m3, *m4;
1098         int r;
1099
1100         assert(j);
1101         assert(unit);
1102
1103         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1104         m2 = strjoina("COREDUMP_UNIT=", unit);
1105         m3 = strjoina("UNIT=", unit);
1106         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1107
1108         (void)(
1109             /* Look for messages from the service itself */
1110             (r = sd_journal_add_match(j, m1, 0)) ||
1111
1112             /* Look for coredumps of the service */
1113             (r = sd_journal_add_disjunction(j)) ||
1114             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1115             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1116             (r = sd_journal_add_match(j, m2, 0)) ||
1117
1118              /* Look for messages from PID 1 about this service */
1119             (r = sd_journal_add_disjunction(j)) ||
1120             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1121             (r = sd_journal_add_match(j, m3, 0)) ||
1122
1123             /* Look for messages from authorized daemons about this service */
1124             (r = sd_journal_add_disjunction(j)) ||
1125             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1126             (r = sd_journal_add_match(j, m4, 0))
1127         );
1128
1129         if (r == 0 && endswith(unit, ".slice")) {
1130                 const char *m5;
1131
1132                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1133
1134                 /* Show all messages belonging to a slice */
1135                 (void)(
1136                         (r = sd_journal_add_disjunction(j)) ||
1137                         (r = sd_journal_add_match(j, m5, 0))
1138                         );
1139         }
1140
1141         return r;
1142 }
1143
1144 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1145         int r;
1146         char *m1, *m2, *m3, *m4;
1147         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1148
1149         assert(j);
1150         assert(unit);
1151
1152         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1153         m2 = strjoina("USER_UNIT=", unit);
1154         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1155         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1156         sprintf(muid, "_UID="UID_FMT, uid);
1157
1158         (void) (
1159                 /* Look for messages from the user service itself */
1160                 (r = sd_journal_add_match(j, m1, 0)) ||
1161                 (r = sd_journal_add_match(j, muid, 0)) ||
1162
1163                 /* Look for messages from systemd about this service */
1164                 (r = sd_journal_add_disjunction(j)) ||
1165                 (r = sd_journal_add_match(j, m2, 0)) ||
1166                 (r = sd_journal_add_match(j, muid, 0)) ||
1167
1168                 /* Look for coredumps of the service */
1169                 (r = sd_journal_add_disjunction(j)) ||
1170                 (r = sd_journal_add_match(j, m3, 0)) ||
1171                 (r = sd_journal_add_match(j, muid, 0)) ||
1172                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1173
1174                 /* Look for messages from authorized daemons about this service */
1175                 (r = sd_journal_add_disjunction(j)) ||
1176                 (r = sd_journal_add_match(j, m4, 0)) ||
1177                 (r = sd_journal_add_match(j, muid, 0)) ||
1178                 (r = sd_journal_add_match(j, "_UID=0", 0))
1179         );
1180
1181         if (r == 0 && endswith(unit, ".slice")) {
1182                 const char *m5;
1183
1184                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1185
1186                 /* Show all messages belonging to a slice */
1187                 (void)(
1188                         (r = sd_journal_add_disjunction(j)) ||
1189                         (r = sd_journal_add_match(j, m5, 0)) ||
1190                         (r = sd_journal_add_match(j, muid, 0))
1191                         );
1192         }
1193
1194         return r;
1195 }
1196
1197 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1198         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1199         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1200         pid_t pid, child;
1201         siginfo_t si;
1202         char buf[37];
1203         ssize_t k;
1204         int r;
1205
1206         assert(machine);
1207         assert(boot_id);
1208
1209         if (!machine_name_is_valid(machine))
1210                 return -EINVAL;
1211
1212         r = container_get_leader(machine, &pid);
1213         if (r < 0)
1214                 return r;
1215
1216         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1217         if (r < 0)
1218                 return r;
1219
1220         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1221                 return -errno;
1222
1223         child = fork();
1224         if (child < 0)
1225                 return -errno;
1226
1227         if (child == 0) {
1228                 int fd;
1229
1230                 pair[0] = safe_close(pair[0]);
1231
1232                 r = namespace_enter(pidnsfd, mntnsfd, -1, -1, rootfd);
1233                 if (r < 0)
1234                         _exit(EXIT_FAILURE);
1235
1236                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1237                 if (fd < 0)
1238                         _exit(EXIT_FAILURE);
1239
1240                 r = loop_read_exact(fd, buf, 36, false);
1241                 safe_close(fd);
1242                 if (r < 0)
1243                         _exit(EXIT_FAILURE);
1244
1245                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1246                 if (k != 36)
1247                         _exit(EXIT_FAILURE);
1248
1249                 _exit(EXIT_SUCCESS);
1250         }
1251
1252         pair[1] = safe_close(pair[1]);
1253
1254         r = wait_for_terminate(child, &si);
1255         if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS)
1256                 return r < 0 ? r : -EIO;
1257
1258         k = recv(pair[0], buf, 36, 0);
1259         if (k != 36)
1260                 return -EIO;
1261
1262         buf[36] = 0;
1263         r = sd_id128_from_string(buf, boot_id);
1264         if (r < 0)
1265                 return r;
1266
1267         return 0;
1268 }
1269
1270 int add_match_this_boot(sd_journal *j, const char *machine) {
1271         char match[9+32+1] = "_BOOT_ID=";
1272         sd_id128_t boot_id;
1273         int r;
1274
1275         assert(j);
1276
1277         if (machine) {
1278                 r = get_boot_id_for_machine(machine, &boot_id);
1279                 if (r < 0)
1280                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1281         } else {
1282                 r = sd_id128_get_boot(&boot_id);
1283                 if (r < 0)
1284                         return log_error_errno(r, "Failed to get boot id: %m");
1285         }
1286
1287         sd_id128_to_string(boot_id, match + 9);
1288         r = sd_journal_add_match(j, match, strlen(match));
1289         if (r < 0)
1290                 return log_error_errno(r, "Failed to add match: %m");
1291
1292         r = sd_journal_add_conjunction(j);
1293         if (r < 0)
1294                 return log_error_errno(r, "Failed to add conjunction: %m");
1295
1296         return 0;
1297 }
1298
1299 int show_journal_by_unit(
1300                 FILE *f,
1301                 const char *unit,
1302                 OutputMode mode,
1303                 unsigned n_columns,
1304                 usec_t not_before,
1305                 unsigned how_many,
1306                 uid_t uid,
1307                 OutputFlags flags,
1308                 int journal_open_flags,
1309                 bool system_unit,
1310                 bool *ellipsized) {
1311
1312         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1313         int r;
1314
1315         assert(mode >= 0);
1316         assert(mode < _OUTPUT_MODE_MAX);
1317         assert(unit);
1318
1319         if (how_many <= 0)
1320                 return 0;
1321
1322         r = sd_journal_open(&j, journal_open_flags);
1323         if (r < 0)
1324                 return log_error_errno(r, "Failed to open journal: %m");
1325
1326         r = add_match_this_boot(j, NULL);
1327         if (r < 0)
1328                 return r;
1329
1330         if (system_unit)
1331                 r = add_matches_for_unit(j, unit);
1332         else
1333                 r = add_matches_for_user_unit(j, unit, uid);
1334         if (r < 0)
1335                 return log_error_errno(r, "Failed to add unit matches: %m");
1336
1337         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1338                 _cleanup_free_ char *filter;
1339
1340                 filter = journal_make_match_string(j);
1341                 if (!filter)
1342                         return log_oom();
1343
1344                 log_debug("Journal filter: %s", filter);
1345         }
1346
1347         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1348 }