src/shared/logs-show.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <signal.h>
   6 #include <stdint.h>
   7 #include <stdlib.h>
   8 #include <string.h>
   9 #include <sys/socket.h>
  10 #include <syslog.h>
  11 #include <time.h>
  12 #include <unistd.h>
  13
  14 #include "sd-id128.h"
  15 #include "sd-journal.h"
  16
  17 #include "alloc-util.h"
  18 #include "fd-util.h"
  19 #include "format-util.h"
  20 #include "hashmap.h"
  21 #include "hostname-util.h"
  22 #include "io-util.h"
  23 #include "journal-internal.h"
  24 #include "json.h"
  25 #include "log.h"
  26 #include "logs-show.h"
  27 #include "macro.h"
  28 #include "namespace-util.h"
  29 #include "output-mode.h"
  30 #include "parse-util.h"
  31 #include "process-util.h"
  32 #include "sparse-endian.h"
  33 #include "stdio-util.h"
  34 #include "string-table.h"
  35 #include "string-util.h"
  36 #include "strv.h"
  37 #include "terminal-util.h"
  38 #include "time-util.h"
  39 #include "utf8.h"
  40 #include "util.h"
  41
  42 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  43 #define PRINT_LINE_THRESHOLD 3
  44 #define PRINT_CHAR_THRESHOLD 300
  45
  46 #define JSON_THRESHOLD 4096U
  47
  48 static int print_catalog(FILE *f, sd_journal *j) {
  49         int r;
  50         _cleanup_free_ char *t = NULL, *z = NULL;
  51
  52         r = sd_journal_get_catalog(j, &t);
  53         if (r < 0)
  54                 return r;
  55
  56         z = strreplace(strstrip(t), "\n", "\n-- ");
  57         if (!z)
  58                 return log_oom();
  59
  60         fputs("-- ", f);
  61         fputs(z, f);
  62         fputc('\n', f);
  63
  64         return 0;
  65 }
  66
  67 static int parse_field(const void *data, size_t length, const char *field, size_t field_len, char **target, size_t *target_len) {
  68         size_t nl;
  69         char *buf;
  70
  71         assert(data);
  72         assert(field);
  73         assert(target);
  74
  75         if (length < field_len)
  76                 return 0;
  77
  78         if (memcmp(data, field, field_len))
  79                 return 0;
  80
  81         nl = length - field_len;
  82
  83         buf = newdup_suffix0(char, (const char*) data + field_len, nl);
  84         if (!buf)
  85                 return log_oom();
  86
  87         free(*target);
  88         *target = buf;
  89
  90         if (target_len)
  91                 *target_len = nl;
  92
  93         return 1;
  94 }
  95
  96 typedef struct ParseFieldVec {
  97         const char *field;
  98         size_t field_len;
  99         char **target;
 100         size_t *target_len;
 101 } ParseFieldVec;
 102
 103 #define PARSE_FIELD_VEC_ENTRY(_field, _target, _target_len) \
 104         { .field = _field, .field_len = strlen(_field), .target = _target, .target_len = _target_len }
 105
 106 static int parse_fieldv(const void *data, size_t length, const ParseFieldVec *fields, unsigned n_fields) {
 107         unsigned i;
 108
 109         for (i = 0; i < n_fields; i++) {
 110                 const ParseFieldVec *f = &fields[i];
 111                 int r;
 112
 113                 r = parse_field(data, length, f->field, f->field_len, f->target, f->target_len);
 114                 if (r < 0)
 115                         return r;
 116                 else if (r > 0)
 117                         break;
 118         }
 119
 120         return 0;
 121 }
 122
 123 static int field_set_test(Set *fields, const char *name, size_t n) {
 124         char *s = NULL;
 125
 126         if (!fields)
 127                 return 1;
 128
 129         s = strndupa(name, n);
 130         if (!s)
 131                 return log_oom();
 132
 133         return set_get(fields, s) ? 1 : 0;
 134 }
 135
 136 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 137         assert(p);
 138
 139         if (flags & OUTPUT_SHOW_ALL)
 140                 return true;
 141
 142         if (l >= PRINT_CHAR_THRESHOLD)
 143                 return false;
 144
 145         if (!utf8_is_printable(p, l))
 146                 return false;
 147
 148         return true;
 149 }
 150
 151 static bool print_multiline(
 152                 FILE *f,
 153                 unsigned prefix,
 154                 unsigned n_columns,
 155                 OutputFlags flags,
 156                 int priority,
 157                 bool audit,
 158                 const char* message,
 159                 size_t message_len,
 160                 size_t highlight[2]) {
 161
 162         const char *color_on = "", *color_off = "", *highlight_on = "";
 163         const char *pos, *end;
 164         bool ellipsized = false;
 165         int line = 0;
 166
 167         if (flags & OUTPUT_COLOR) {
 168                 get_log_colors(priority, &color_on, &color_off, &highlight_on);
 169
 170                 if (audit && strempty(color_on)) {
 171                         color_on = ANSI_BLUE;
 172                         color_off = ANSI_NORMAL;
 173                 }
 174         }
 175
 176         /* A special case: make sure that we print a newline when
 177            the message is empty. */
 178         if (message_len == 0)
 179                 fputs("\n", f);
 180
 181         for (pos = message;
 182              pos < message + message_len;
 183              pos = end + 1, line++) {
 184                 bool continuation = line > 0;
 185                 bool tail_line;
 186                 int len;
 187                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 188                         ;
 189                 len = end - pos;
 190                 assert(len >= 0);
 191
 192                 /* We need to figure out when we are showing not-last line, *and*
 193                  * will skip subsequent lines. In that case, we will put the dots
 194                  * at the end of the line, instead of putting dots in the middle
 195                  * or not at all.
 196                  */
 197                 tail_line =
 198                         line + 1 == PRINT_LINE_THRESHOLD ||
 199                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 200
 201                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 202                     (prefix + len + 1 < n_columns && !tail_line)) {
 203                         if (highlight &&
 204                             (size_t) (pos - message) <= highlight[0] &&
 205                             highlight[0] < (size_t) len) {
 206
 207                                 fprintf(f, "%*s%s%.*s",
 208                                         continuation * prefix, "",
 209                                         color_on, (int) highlight[0], pos);
 210                                 fprintf(f, "%s%.*s",
 211                                         highlight_on,
 212                                         (int) (MIN((size_t) len, highlight[1]) - highlight[0]),
 213                                         pos + highlight[0]);
 214                                 if ((size_t) len > highlight[1])
 215                                         fprintf(f, "%s%.*s",
 216                                                 color_on,
 217                                                 (int) (len - highlight[1]),
 218                                                 pos + highlight[1]);
 219                                 fprintf(f, "%s\n", color_off);
 220
 221                         } else
 222                                 fprintf(f, "%*s%s%.*s%s\n",
 223                                         continuation * prefix, "",
 224                                         color_on, len, pos, color_off);
 225                         continue;
 226                 }
 227
 228                 /* Beyond this point, ellipsization will happen. */
 229                 ellipsized = true;
 230
 231                 if (prefix < n_columns && n_columns - prefix >= 3) {
 232                         if (n_columns - prefix > (unsigned) len + 3)
 233                                 fprintf(f, "%*s%s%.*s...%s\n",
 234                                         continuation * prefix, "",
 235                                         color_on, len, pos, color_off);
 236                         else {
 237                                 _cleanup_free_ char *e;
 238
 239                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 240                                                   tail_line ? 100 : 90);
 241                                 if (!e)
 242                                         fprintf(f, "%*s%s%.*s%s\n",
 243                                                 continuation * prefix, "",
 244                                                 color_on, len, pos, color_off);
 245                                 else
 246                                         fprintf(f, "%*s%s%s%s\n",
 247                                                 continuation * prefix, "",
 248                                                 color_on, e, color_off);
 249                         }
 250                 } else
 251                         fputs("...\n", f);
 252
 253                 if (tail_line)
 254                         break;
 255         }
 256
 257         return ellipsized;
 258 }
 259
 260 static int output_timestamp_monotonic(FILE *f, sd_journal *j, const char *monotonic) {
 261         sd_id128_t boot_id;
 262         uint64_t t;
 263         int r;
 264
 265         assert(f);
 266         assert(j);
 267
 268         r = -ENXIO;
 269         if (monotonic)
 270                 r = safe_atou64(monotonic, &t);
 271         if (r < 0)
 272                 r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 273         if (r < 0)
 274                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 275
 276         fprintf(f, "[%5"PRI_USEC".%06"PRI_USEC"]", t / USEC_PER_SEC, t % USEC_PER_SEC);
 277         return 1 + 5 + 1 + 6 + 1;
 278 }
 279
 280 static int output_timestamp_realtime(FILE *f, sd_journal *j, OutputMode mode, OutputFlags flags, const char *realtime) {
 281         char buf[MAX(FORMAT_TIMESTAMP_MAX, 64)];
 282         struct tm *(*gettime_r)(const time_t *, struct tm *);
 283         struct tm tm;
 284         uint64_t x;
 285         time_t t;
 286         int r;
 287
 288         assert(f);
 289         assert(j);
 290
 291         if (realtime)
 292                 r = safe_atou64(realtime, &x);
 293         if (!realtime || r < 0 || !VALID_REALTIME(x))
 294                 r = sd_journal_get_realtime_usec(j, &x);
 295         if (r < 0)
 296                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 297
 298         if (IN_SET(mode, OUTPUT_SHORT_FULL, OUTPUT_WITH_UNIT)) {
 299                 const char *k;
 300
 301                 if (flags & OUTPUT_UTC)
 302                         k = format_timestamp_utc(buf, sizeof(buf), x);
 303                 else
 304                         k = format_timestamp(buf, sizeof(buf), x);
 305                 if (!k)
 306                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 307                                                "Failed to format timestamp: %" PRIu64, x);
 308
 309         } else {
 310                 char usec[7];
 311
 312                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 313                 t = (time_t) (x / USEC_PER_SEC);
 314
 315                 switch (mode) {
 316
 317                 case OUTPUT_SHORT_UNIX:
 318                         xsprintf(buf, "%10"PRI_TIME".%06"PRIu64, t, x % USEC_PER_SEC);
 319                         break;
 320
 321                 case OUTPUT_SHORT_ISO:
 322                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm)) <= 0)
 323                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 324                                                        "Failed to format ISO time");
 325                         break;
 326
 327                 case OUTPUT_SHORT_ISO_PRECISE:
 328                         /* No usec in strftime, so we leave space and copy over */
 329                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S.xxxxxx%z", gettime_r(&t, &tm)) <= 0)
 330                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 331                                                        "Failed to format ISO-precise time");
 332                         xsprintf(usec, "%06"PRI_USEC, x % USEC_PER_SEC);
 333                         memcpy(buf + 20, usec, 6);
 334                         break;
 335
 336                 case OUTPUT_SHORT:
 337                 case OUTPUT_SHORT_PRECISE:
 338
 339                         if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm)) <= 0)
 340                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 341                                                        "Failed to format syslog time");
 342
 343                         if (mode == OUTPUT_SHORT_PRECISE) {
 344                                 size_t k;
 345
 346                                 assert(sizeof(buf) > strlen(buf));
 347                                 k = sizeof(buf) - strlen(buf);
 348
 349                                 r = snprintf(buf + strlen(buf), k, ".%06"PRIu64, x % USEC_PER_SEC);
 350                                 if (r <= 0 || (size_t) r >= k) /* too long? */
 351                                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 352                                                                "Failed to format precise time");
 353                         }
 354                         break;
 355
 356                 default:
 357                         assert_not_reached("Unknown time format");
 358                 }
 359         }
 360
 361         fputs(buf, f);
 362         return (int) strlen(buf);
 363 }
 364
 365 static int output_short(
 366                 FILE *f,
 367                 sd_journal *j,
 368                 OutputMode mode,
 369                 unsigned n_columns,
 370                 OutputFlags flags,
 371                 Set *output_fields,
 372                 const size_t highlight[2]) {
 373
 374         int r;
 375         const void *data;
 376         size_t length;
 377         size_t n = 0;
 378         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL, *transport = NULL, *unit = NULL, *user_unit = NULL;
 379         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0, transport_len = 0, unit_len = 0, user_unit_len = 0;
 380         int p = LOG_INFO;
 381         bool ellipsized = false, audit;
 382         const ParseFieldVec fields[] = {
 383                 PARSE_FIELD_VEC_ENTRY("_PID=", &pid, &pid_len),
 384                 PARSE_FIELD_VEC_ENTRY("_COMM=", &comm, &comm_len),
 385                 PARSE_FIELD_VEC_ENTRY("MESSAGE=", &message, &message_len),
 386                 PARSE_FIELD_VEC_ENTRY("PRIORITY=", &priority, &priority_len),
 387                 PARSE_FIELD_VEC_ENTRY("_TRANSPORT=", &transport, &transport_len),
 388                 PARSE_FIELD_VEC_ENTRY("_HOSTNAME=", &hostname, &hostname_len),
 389                 PARSE_FIELD_VEC_ENTRY("SYSLOG_PID=", &fake_pid, &fake_pid_len),
 390                 PARSE_FIELD_VEC_ENTRY("SYSLOG_IDENTIFIER=", &identifier, &identifier_len),
 391                 PARSE_FIELD_VEC_ENTRY("_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len),
 392                 PARSE_FIELD_VEC_ENTRY("_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len),
 393                 PARSE_FIELD_VEC_ENTRY("_SYSTEMD_UNIT=", &unit, &unit_len),
 394                 PARSE_FIELD_VEC_ENTRY("_SYSTEMD_USER_UNIT=", &user_unit, &user_unit_len),
 395         };
 396         size_t highlight_shifted[] = {highlight ? highlight[0] : 0, highlight ? highlight[1] : 0};
 397
 398         assert(f);
 399         assert(j);
 400
 401         /* Set the threshold to one bigger than the actual print
 402          * threshold, so that if the line is actually longer than what
 403          * we're willing to print, ellipsization will occur. This way
 404          * we won't output a misleading line without any indication of
 405          * truncation.
 406          */
 407         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 408
 409         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 410                 r = parse_fieldv(data, length, fields, ELEMENTSOF(fields));
 411                 if (r < 0)
 412                         return r;
 413         }
 414         if (r == -EBADMSG) {
 415                 log_debug_errno(r, "Skipping message we can't read: %m");
 416                 return 0;
 417         }
 418         if (r < 0)
 419                 return log_error_errno(r, "Failed to get journal fields: %m");
 420
 421         if (!message) {
 422                 log_debug("Skipping message without MESSAGE= field.");
 423                 return 0;
 424         }
 425
 426         if (!(flags & OUTPUT_SHOW_ALL))
 427                 strip_tab_ansi(&message, &message_len, highlight_shifted);
 428
 429         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 430                 p = *priority - '0';
 431
 432
 433         audit = streq_ptr(transport, "audit");
 434
 435         if (mode == OUTPUT_SHORT_MONOTONIC)
 436                 r = output_timestamp_monotonic(f, j, monotonic);
 437         else
 438                 r = output_timestamp_realtime(f, j, mode, flags, realtime);
 439         if (r < 0)
 440                 return r;
 441         n += r;
 442
 443         if (flags & OUTPUT_NO_HOSTNAME) {
 444                 /* Suppress display of the hostname if this is requested. */
 445                 hostname = mfree(hostname);
 446                 hostname_len = 0;
 447         }
 448
 449         if (hostname && shall_print(hostname, hostname_len, flags)) {
 450                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 451                 n += hostname_len + 1;
 452         }
 453
 454         if (mode == OUTPUT_WITH_UNIT && ((unit && shall_print(unit, unit_len, flags)) || (user_unit && shall_print(user_unit, user_unit_len, flags)))) {
 455                 if (unit) {
 456                         fprintf(f, " %.*s", (int) unit_len, unit);
 457                         n += unit_len + 1;
 458                 }
 459                 if (user_unit) {
 460                         if (unit)
 461                                 fprintf(f, "/%.*s", (int) user_unit_len, user_unit);
 462                         else
 463                                 fprintf(f, " %.*s", (int) user_unit_len, user_unit);
 464                         n += unit_len + 1;
 465                 }
 466         } else if (identifier && shall_print(identifier, identifier_len, flags)) {
 467                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 468                 n += identifier_len + 1;
 469         } else if (comm && shall_print(comm, comm_len, flags)) {
 470                 fprintf(f, " %.*s", (int) comm_len, comm);
 471                 n += comm_len + 1;
 472         } else
 473                 fputs(" unknown", f);
 474
 475         if (pid && shall_print(pid, pid_len, flags)) {
 476                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 477                 n += pid_len + 2;
 478         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 479                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 480                 n += fake_pid_len + 2;
 481         }
 482
 483         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 484                 char bytes[FORMAT_BYTES_MAX];
 485                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 486         } else {
 487                 fputs(": ", f);
 488                 ellipsized |=
 489                         print_multiline(f, n + 2, n_columns, flags, p, audit,
 490                                         message, message_len,
 491                                         highlight_shifted);
 492         }
 493
 494         if (flags & OUTPUT_CATALOG)
 495                 print_catalog(f, j);
 496
 497         return ellipsized;
 498 }
 499
 500 static int output_verbose(
 501                 FILE *f,
 502                 sd_journal *j,
 503                 OutputMode mode,
 504                 unsigned n_columns,
 505                 OutputFlags flags,
 506                 Set *output_fields,
 507                 const size_t highlight[2]) {
 508
 509         const void *data;
 510         size_t length;
 511         _cleanup_free_ char *cursor = NULL;
 512         uint64_t realtime = 0;
 513         char ts[FORMAT_TIMESTAMP_MAX + 7];
 514         const char *timestamp;
 515         int r;
 516
 517         assert(f);
 518         assert(j);
 519
 520         sd_journal_set_data_threshold(j, 0);
 521
 522         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 523         if (r == -ENOENT)
 524                 log_debug("Source realtime timestamp not found");
 525         else if (r < 0)
 526                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 527         else {
 528                 _cleanup_free_ char *value = NULL;
 529
 530                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=",
 531                                 STRLEN("_SOURCE_REALTIME_TIMESTAMP="), &value,
 532                                 NULL);
 533                 if (r < 0)
 534                         return r;
 535                 assert(r > 0);
 536
 537                 r = safe_atou64(value, &realtime);
 538                 if (r < 0)
 539                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 540         }
 541
 542         if (r < 0) {
 543                 r = sd_journal_get_realtime_usec(j, &realtime);
 544                 if (r < 0)
 545                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 546         }
 547
 548         r = sd_journal_get_cursor(j, &cursor);
 549         if (r < 0)
 550                 return log_error_errno(r, "Failed to get cursor: %m");
 551
 552         timestamp = flags & OUTPUT_UTC ? format_timestamp_us_utc(ts, sizeof ts, realtime)
 553                                        : format_timestamp_us(ts, sizeof ts, realtime);
 554         fprintf(f, "%s [%s]\n",
 555                 timestamp ?: "(no timestamp)",
 556                 cursor);
 557
 558         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 559                 const char *c;
 560                 int fieldlen;
 561                 const char *on = "", *off = "";
 562
 563                 c = memchr(data, '=', length);
 564                 if (!c)
 565                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 566                                                "Invalid field.");
 567                 fieldlen = c - (const char*) data;
 568
 569                 r = field_set_test(output_fields, data, fieldlen);
 570                 if (r < 0)
 571                         return r;
 572                 if (!r)
 573                         continue;
 574
 575                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 576                         on = ANSI_HIGHLIGHT;
 577                         off = ANSI_NORMAL;
 578                 }
 579
 580                 if ((flags & OUTPUT_SHOW_ALL) ||
 581                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 582                      && utf8_is_printable(data, length))) {
 583                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 584                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, false,
 585                                         c + 1, length - fieldlen - 1,
 586                                         NULL);
 587                         fputs(off, f);
 588                 } else {
 589                         char bytes[FORMAT_BYTES_MAX];
 590
 591                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 592                                 on,
 593                                 (int) (c - (const char*) data),
 594                                 (const char*) data,
 595                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 596                                 off);
 597                 }
 598         }
 599
 600         if (r < 0)
 601                 return r;
 602
 603         if (flags & OUTPUT_CATALOG)
 604                 print_catalog(f, j);
 605
 606         return 0;
 607 }
 608
 609 static int output_export(
 610                 FILE *f,
 611                 sd_journal *j,
 612                 OutputMode mode,
 613                 unsigned n_columns,
 614                 OutputFlags flags,
 615                 Set *output_fields,
 616                 const size_t highlight[2]) {
 617
 618         sd_id128_t boot_id;
 619         char sid[33];
 620         int r;
 621         usec_t realtime, monotonic;
 622         _cleanup_free_ char *cursor = NULL;
 623         const void *data;
 624         size_t length;
 625
 626         assert(j);
 627
 628         sd_journal_set_data_threshold(j, 0);
 629
 630         r = sd_journal_get_realtime_usec(j, &realtime);
 631         if (r < 0)
 632                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 633
 634         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 635         if (r < 0)
 636                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 637
 638         r = sd_journal_get_cursor(j, &cursor);
 639         if (r < 0)
 640                 return log_error_errno(r, "Failed to get cursor: %m");
 641
 642         fprintf(f,
 643                 "__CURSOR=%s\n"
 644                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 645                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 646                 "_BOOT_ID=%s\n",
 647                 cursor,
 648                 realtime,
 649                 monotonic,
 650                 sd_id128_to_string(boot_id, sid));
 651
 652         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 653                 const char *c;
 654
 655                 /* We already printed the boot id from the data in the header, hence let's suppress it here */
 656                 if (memory_startswith(data, length, "_BOOT_ID="))
 657                         continue;
 658
 659                 c = memchr(data, '=', length);
 660                 if (!c)
 661                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 662                                                "Invalid field.");
 663
 664                 r = field_set_test(output_fields, data, c - (const char *) data);
 665                 if (r < 0)
 666                         return r;
 667                 if (!r)
 668                         continue;
 669
 670                 if (utf8_is_printable_newline(data, length, false))
 671                         fwrite(data, length, 1, f);
 672                 else {
 673                         uint64_t le64;
 674
 675                         fwrite(data, c - (const char*) data, 1, f);
 676                         fputc('\n', f);
 677                         le64 = htole64(length - (c - (const char*) data) - 1);
 678                         fwrite(&le64, sizeof(le64), 1, f);
 679                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 680                 }
 681
 682                 fputc('\n', f);
 683         }
 684         if (r == -EBADMSG) {
 685                 log_debug_errno(r, "Skipping message we can't read: %m");
 686                 return 0;
 687         }
 688
 689         if (r < 0)
 690                 return r;
 691
 692         fputc('\n', f);
 693
 694         return 0;
 695 }
 696
 697 void json_escape(
 698                 FILE *f,
 699                 const char* p,
 700                 size_t l,
 701                 OutputFlags flags) {
 702
 703         assert(f);
 704         assert(p);
 705
 706         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 707                 fputs("null", f);
 708
 709         else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
 710                 bool not_first = false;
 711
 712                 fputs("[ ", f);
 713
 714                 while (l > 0) {
 715                         if (not_first)
 716                                 fprintf(f, ", %u", (uint8_t) *p);
 717                         else {
 718                                 not_first = true;
 719                                 fprintf(f, "%u", (uint8_t) *p);
 720                         }
 721
 722                         p++;
 723                         l--;
 724                 }
 725
 726                 fputs(" ]", f);
 727         } else {
 728                 fputc('"', f);
 729
 730                 while (l > 0) {
 731                         if (IN_SET(*p, '"', '\\')) {
 732                                 fputc('\\', f);
 733                                 fputc(*p, f);
 734                         } else if (*p == '\n')
 735                                 fputs("\\n", f);
 736                         else if ((uint8_t) *p < ' ')
 737                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 738                         else
 739                                 fputc(*p, f);
 740
 741                         p++;
 742                         l--;
 743                 }
 744
 745                 fputc('"', f);
 746         }
 747 }
 748
 749 struct json_data {
 750         JsonVariant* name;
 751         size_t n_values;
 752         JsonVariant* values[];
 753 };
 754
 755 static int update_json_data(
 756                 Hashmap *h,
 757                 OutputFlags flags,
 758                 const char *name,
 759                 const void *value,
 760                 size_t size) {
 761
 762         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 763         struct json_data *d;
 764         int r;
 765
 766         if (!(flags & OUTPUT_SHOW_ALL) && strlen(name) + 1 + size >= JSON_THRESHOLD)
 767                 r = json_variant_new_null(&v);
 768         else if (utf8_is_printable(value, size))
 769                 r = json_variant_new_stringn(&v, value, size);
 770         else
 771                 r = json_variant_new_array_bytes(&v, value, size);
 772         if (r < 0)
 773                 return log_error_errno(r, "Failed to allocate JSON data: %m");
 774
 775         d = hashmap_get(h, name);
 776         if (d) {
 777                 struct json_data *w;
 778
 779                 w = realloc(d, offsetof(struct json_data, values) + sizeof(JsonVariant*) * (d->n_values + 1));
 780                 if (!w)
 781                         return log_oom();
 782
 783                 d = w;
 784                 assert_se(hashmap_update(h, json_variant_string(d->name), d) >= 0);
 785         } else {
 786                 _cleanup_(json_variant_unrefp) JsonVariant *n = NULL;
 787
 788                 r = json_variant_new_string(&n, name);
 789                 if (r < 0)
 790                         return log_error_errno(r, "Failed to allocate JSON name variant: %m");
 791
 792                 d = malloc0(offsetof(struct json_data, values) + sizeof(JsonVariant*));
 793                 if (!d)
 794                         return log_oom();
 795
 796                 r = hashmap_put(h, json_variant_string(n), d);
 797                 if (r < 0) {
 798                         free(d);
 799                         return log_error_errno(r, "Failed to insert JSON name into hashmap: %m");
 800                 }
 801
 802                 d->name = TAKE_PTR(n);
 803         }
 804
 805         d->values[d->n_values++] = TAKE_PTR(v);
 806         return 0;
 807 }
 808
 809 static int update_json_data_split(
 810                 Hashmap *h,
 811                 OutputFlags flags,
 812                 Set *output_fields,
 813                 const void *data,
 814                 size_t size) {
 815
 816         const char *eq;
 817         char *name;
 818
 819         assert(h);
 820         assert(data || size == 0);
 821
 822         if (memory_startswith(data, size, "_BOOT_ID="))
 823                 return 0;
 824
 825         eq = memchr(data, '=', MIN(size, JSON_THRESHOLD));
 826         if (!eq)
 827                 return 0;
 828
 829         if (eq == data)
 830                 return 0;
 831
 832         name = strndupa(data, eq - (const char*) data);
 833         if (output_fields && !set_get(output_fields, name))
 834                 return 0;
 835
 836         return update_json_data(h, flags, name, eq + 1, size - (eq - (const char*) data) - 1);
 837 }
 838
 839 static int output_json(
 840                 FILE *f,
 841                 sd_journal *j,
 842                 OutputMode mode,
 843                 unsigned n_columns,
 844                 OutputFlags flags,
 845                 Set *output_fields,
 846                 const size_t highlight[2]) {
 847
 848         char sid[SD_ID128_STRING_MAX], usecbuf[DECIMAL_STR_MAX(usec_t)];
 849         _cleanup_(json_variant_unrefp) JsonVariant *object = NULL;
 850         _cleanup_free_ char *cursor = NULL;
 851         uint64_t realtime, monotonic;
 852         JsonVariant **array = NULL;
 853         struct json_data *d;
 854         sd_id128_t boot_id;
 855         Hashmap *h = NULL;
 856         size_t n = 0;
 857         Iterator i;
 858         int r;
 859
 860         assert(j);
 861
 862         (void) sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 863
 864         r = sd_journal_get_realtime_usec(j, &realtime);
 865         if (r < 0)
 866                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 867
 868         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 869         if (r < 0)
 870                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 871
 872         r = sd_journal_get_cursor(j, &cursor);
 873         if (r < 0)
 874                 return log_error_errno(r, "Failed to get cursor: %m");
 875
 876         h = hashmap_new(&string_hash_ops);
 877         if (!h)
 878                 return log_oom();
 879
 880         r = update_json_data(h, flags, "__CURSOR", cursor, strlen(cursor));
 881         if (r < 0)
 882                 goto finish;
 883
 884         xsprintf(usecbuf, USEC_FMT, realtime);
 885         r = update_json_data(h, flags, "__REALTIME_TIMESTAMP", usecbuf, strlen(usecbuf));
 886         if (r < 0)
 887                 goto finish;
 888
 889         xsprintf(usecbuf, USEC_FMT, monotonic);
 890         r = update_json_data(h, flags, "__MONOTONIC_TIMESTAMP", usecbuf, strlen(usecbuf));
 891         if (r < 0)
 892                 goto finish;
 893
 894         sd_id128_to_string(boot_id, sid);
 895         r = update_json_data(h, flags, "_BOOT_ID", sid, strlen(sid));
 896         if (r < 0)
 897                 goto finish;
 898
 899         for (;;) {
 900                 const void *data;
 901                 size_t size;
 902
 903                 r = sd_journal_enumerate_data(j, &data, &size);
 904                 if (r == -EBADMSG) {
 905                         log_debug_errno(r, "Skipping message we can't read: %m");
 906                         r = 0;
 907                         goto finish;
 908                 }
 909                 if (r < 0) {
 910                         log_error_errno(r, "Failed to read journal: %m");
 911                         goto finish;
 912                 }
 913                 if (r == 0)
 914                         break;
 915
 916                 r = update_json_data_split(h, flags, output_fields, data, size);
 917                 if (r < 0)
 918                         goto finish;
 919         }
 920
 921         array = new(JsonVariant*, hashmap_size(h)*2);
 922         if (!array) {
 923                 r = log_oom();
 924                 goto finish;
 925         }
 926
 927         HASHMAP_FOREACH(d, h, i) {
 928                 assert(d->n_values > 0);
 929
 930                 array[n++] = json_variant_ref(d->name);
 931
 932                 if (d->n_values == 1)
 933                         array[n++] = json_variant_ref(d->values[0]);
 934                 else {
 935                         _cleanup_(json_variant_unrefp) JsonVariant *q = NULL;
 936
 937                         r = json_variant_new_array(&q, d->values, d->n_values);
 938                         if (r < 0) {
 939                                 log_error_errno(r, "Failed to create JSON array: %m");
 940                                 goto finish;
 941                         }
 942
 943                         array[n++] = TAKE_PTR(q);
 944                 }
 945         }
 946
 947         r = json_variant_new_object(&object, array, n);
 948         if (r < 0) {
 949                 log_error_errno(r, "Failed to allocate JSON object: %m");
 950                 goto finish;
 951         }
 952
 953         json_variant_dump(object,
 954                           output_mode_to_json_format_flags(mode) |
 955                           (FLAGS_SET(flags, OUTPUT_COLOR) ? JSON_FORMAT_COLOR : 0),
 956                           f, NULL);
 957
 958         r = 0;
 959
 960 finish:
 961         while ((d = hashmap_steal_first(h))) {
 962                 size_t k;
 963
 964                 json_variant_unref(d->name);
 965                 for (k = 0; k < d->n_values; k++)
 966                         json_variant_unref(d->values[k]);
 967
 968                 free(d);
 969         }
 970
 971         hashmap_free(h);
 972
 973         json_variant_unref_many(array, n);
 974         free(array);
 975
 976         return r;
 977 }
 978
 979 static int output_cat(
 980                 FILE *f,
 981                 sd_journal *j,
 982                 OutputMode mode,
 983                 unsigned n_columns,
 984                 OutputFlags flags,
 985                 Set *output_fields,
 986                 const size_t highlight[2]) {
 987
 988         const void *data;
 989         size_t l;
 990         int r;
 991         const char *highlight_on = "", *highlight_off = "";
 992
 993         assert(j);
 994         assert(f);
 995
 996         if (flags & OUTPUT_COLOR) {
 997                 highlight_on = ANSI_HIGHLIGHT_RED;
 998                 highlight_off = ANSI_NORMAL;
 999         }
1000
1001         sd_journal_set_data_threshold(j, 0);
1002
1003         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
1004         if (r == -EBADMSG) {
1005                 log_debug_errno(r, "Skipping message we can't read: %m");
1006                 return 0;
1007         }
1008         if (r < 0) {
1009                 /* An entry without MESSAGE=? */
1010                 if (r == -ENOENT)
1011                         return 0;
1012
1013                 return log_error_errno(r, "Failed to get data: %m");
1014         }
1015
1016         assert(l >= 8);
1017
1018         if (highlight && (flags & OUTPUT_COLOR)) {
1019                 assert(highlight[0] <= highlight[1]);
1020                 assert(highlight[1] <= l - 8);
1021
1022                 fwrite((const char*) data + 8, 1, highlight[0], f);
1023                 fwrite(highlight_on, 1, strlen(highlight_on), f);
1024                 fwrite((const char*) data + 8 + highlight[0], 1, highlight[1] - highlight[0], f);
1025                 fwrite(highlight_off, 1, strlen(highlight_off), f);
1026                 fwrite((const char*) data + 8 + highlight[1], 1, l - 8 - highlight[1], f);
1027         } else
1028                 fwrite((const char*) data + 8, 1, l - 8, f);
1029         fputc('\n', f);
1030
1031         return 0;
1032 }
1033
1034 static int (*output_funcs[_OUTPUT_MODE_MAX])(
1035                 FILE *f,
1036                 sd_journal *j,
1037                 OutputMode mode,
1038                 unsigned n_columns,
1039                 OutputFlags flags,
1040                 Set *output_fields,
1041                 const size_t highlight[2]) = {
1042
1043         [OUTPUT_SHORT] = output_short,
1044         [OUTPUT_SHORT_ISO] = output_short,
1045         [OUTPUT_SHORT_ISO_PRECISE] = output_short,
1046         [OUTPUT_SHORT_PRECISE] = output_short,
1047         [OUTPUT_SHORT_MONOTONIC] = output_short,
1048         [OUTPUT_SHORT_UNIX] = output_short,
1049         [OUTPUT_SHORT_FULL] = output_short,
1050         [OUTPUT_VERBOSE] = output_verbose,
1051         [OUTPUT_EXPORT] = output_export,
1052         [OUTPUT_JSON] = output_json,
1053         [OUTPUT_JSON_PRETTY] = output_json,
1054         [OUTPUT_JSON_SSE] = output_json,
1055         [OUTPUT_JSON_SEQ] = output_json,
1056         [OUTPUT_CAT] = output_cat,
1057         [OUTPUT_WITH_UNIT] = output_short,
1058 };
1059
1060 int show_journal_entry(
1061                 FILE *f,
1062                 sd_journal *j,
1063                 OutputMode mode,
1064                 unsigned n_columns,
1065                 OutputFlags flags,
1066                 char **output_fields,
1067                 const size_t highlight[2],
1068                 bool *ellipsized) {
1069
1070         int ret;
1071         _cleanup_set_free_free_ Set *fields = NULL;
1072         assert(mode >= 0);
1073         assert(mode < _OUTPUT_MODE_MAX);
1074
1075         if (n_columns <= 0)
1076                 n_columns = columns();
1077
1078         if (output_fields) {
1079                 fields = set_new(&string_hash_ops);
1080                 if (!fields)
1081                         return log_oom();
1082
1083                 ret = set_put_strdupv(fields, output_fields);
1084                 if (ret < 0)
1085                         return ret;
1086         }
1087
1088         ret = output_funcs[mode](f, j, mode, n_columns, flags, fields, highlight);
1089
1090         if (ellipsized && ret > 0)
1091                 *ellipsized = true;
1092
1093         return ret;
1094 }
1095
1096 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
1097         assert(f);
1098         assert(flags);
1099
1100         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
1101                 return 0;
1102
1103         /* Print a beginning new line if that's request, but only once
1104          * on the first line we print. */
1105
1106         fputc('\n', f);
1107         *flags &= ~OUTPUT_BEGIN_NEWLINE;
1108         return 0;
1109 }
1110
1111 int show_journal(
1112                 FILE *f,
1113                 sd_journal *j,
1114                 OutputMode mode,
1115                 unsigned n_columns,
1116                 usec_t not_before,
1117                 unsigned how_many,
1118                 OutputFlags flags,
1119                 bool *ellipsized) {
1120
1121         int r;
1122         unsigned line = 0;
1123         bool need_seek = false;
1124         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
1125
1126         assert(j);
1127         assert(mode >= 0);
1128         assert(mode < _OUTPUT_MODE_MAX);
1129
1130         if (how_many == (unsigned) -1)
1131                 need_seek = true;
1132         else {
1133                 /* Seek to end */
1134                 r = sd_journal_seek_tail(j);
1135                 if (r < 0)
1136                         return log_error_errno(r, "Failed to seek to tail: %m");
1137
1138                 r = sd_journal_previous_skip(j, how_many);
1139                 if (r < 0)
1140                         return log_error_errno(r, "Failed to skip previous: %m");
1141         }
1142
1143         for (;;) {
1144                 for (;;) {
1145                         usec_t usec;
1146
1147                         if (need_seek) {
1148                                 r = sd_journal_next(j);
1149                                 if (r < 0)
1150                                         return log_error_errno(r, "Failed to iterate through journal: %m");
1151                         }
1152
1153                         if (r == 0)
1154                                 break;
1155
1156                         need_seek = true;
1157
1158                         if (not_before > 0) {
1159                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1160
1161                                 /* -ESTALE is returned if the
1162                                    timestamp is not from this boot */
1163                                 if (r == -ESTALE)
1164                                         continue;
1165                                 else if (r < 0)
1166                                         return log_error_errno(r, "Failed to get journal time: %m");
1167
1168                                 if (usec < not_before)
1169                                         continue;
1170                         }
1171
1172                         line++;
1173                         maybe_print_begin_newline(f, &flags);
1174
1175                         r = show_journal_entry(f, j, mode, n_columns, flags, NULL, NULL, ellipsized);
1176                         if (r < 0)
1177                                 return r;
1178                 }
1179
1180                 if (warn_cutoff && line < how_many && not_before > 0) {
1181                         sd_id128_t boot_id;
1182                         usec_t cutoff = 0;
1183
1184                         /* Check whether the cutoff line is too early */
1185
1186                         r = sd_id128_get_boot(&boot_id);
1187                         if (r < 0)
1188                                 return log_error_errno(r, "Failed to get boot id: %m");
1189
1190                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1191                         if (r < 0)
1192                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1193
1194                         if (r > 0 && not_before < cutoff) {
1195                                 maybe_print_begin_newline(f, &flags);
1196                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1197                         }
1198
1199                         warn_cutoff = false;
1200                 }
1201
1202                 if (!(flags & OUTPUT_FOLLOW))
1203                         break;
1204
1205                 r = sd_journal_wait(j, USEC_INFINITY);
1206                 if (r < 0)
1207                         return log_error_errno(r, "Failed to wait for journal: %m");
1208
1209         }
1210
1211         return 0;
1212 }
1213
1214 int add_matches_for_unit(sd_journal *j, const char *unit) {
1215         const char *m1, *m2, *m3, *m4;
1216         int r;
1217
1218         assert(j);
1219         assert(unit);
1220
1221         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1222         m2 = strjoina("COREDUMP_UNIT=", unit);
1223         m3 = strjoina("UNIT=", unit);
1224         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1225
1226         (void)(
1227             /* Look for messages from the service itself */
1228             (r = sd_journal_add_match(j, m1, 0)) ||
1229
1230             /* Look for coredumps of the service */
1231             (r = sd_journal_add_disjunction(j)) ||
1232             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1233             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1234             (r = sd_journal_add_match(j, m2, 0)) ||
1235
1236              /* Look for messages from PID 1 about this service */
1237             (r = sd_journal_add_disjunction(j)) ||
1238             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1239             (r = sd_journal_add_match(j, m3, 0)) ||
1240
1241             /* Look for messages from authorized daemons about this service */
1242             (r = sd_journal_add_disjunction(j)) ||
1243             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1244             (r = sd_journal_add_match(j, m4, 0))
1245         );
1246
1247         if (r == 0 && endswith(unit, ".slice")) {
1248                 const char *m5;
1249
1250                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1251
1252                 /* Show all messages belonging to a slice */
1253                 (void)(
1254                         (r = sd_journal_add_disjunction(j)) ||
1255                         (r = sd_journal_add_match(j, m5, 0))
1256                         );
1257         }
1258
1259         return r;
1260 }
1261
1262 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1263         int r;
1264         char *m1, *m2, *m3, *m4;
1265         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1266
1267         assert(j);
1268         assert(unit);
1269
1270         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1271         m2 = strjoina("USER_UNIT=", unit);
1272         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1273         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1274         sprintf(muid, "_UID="UID_FMT, uid);
1275
1276         (void) (
1277                 /* Look for messages from the user service itself */
1278                 (r = sd_journal_add_match(j, m1, 0)) ||
1279                 (r = sd_journal_add_match(j, muid, 0)) ||
1280
1281                 /* Look for messages from systemd about this service */
1282                 (r = sd_journal_add_disjunction(j)) ||
1283                 (r = sd_journal_add_match(j, m2, 0)) ||
1284                 (r = sd_journal_add_match(j, muid, 0)) ||
1285
1286                 /* Look for coredumps of the service */
1287                 (r = sd_journal_add_disjunction(j)) ||
1288                 (r = sd_journal_add_match(j, m3, 0)) ||
1289                 (r = sd_journal_add_match(j, muid, 0)) ||
1290                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1291
1292                 /* Look for messages from authorized daemons about this service */
1293                 (r = sd_journal_add_disjunction(j)) ||
1294                 (r = sd_journal_add_match(j, m4, 0)) ||
1295                 (r = sd_journal_add_match(j, muid, 0)) ||
1296                 (r = sd_journal_add_match(j, "_UID=0", 0))
1297         );
1298
1299         if (r == 0 && endswith(unit, ".slice")) {
1300                 const char *m5;
1301
1302                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1303
1304                 /* Show all messages belonging to a slice */
1305                 (void)(
1306                         (r = sd_journal_add_disjunction(j)) ||
1307                         (r = sd_journal_add_match(j, m5, 0)) ||
1308                         (r = sd_journal_add_match(j, muid, 0))
1309                         );
1310         }
1311
1312         return r;
1313 }
1314
1315 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1316         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1317         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1318         pid_t pid, child;
1319         char buf[37];
1320         ssize_t k;
1321         int r;
1322
1323         assert(machine);
1324         assert(boot_id);
1325
1326         if (!machine_name_is_valid(machine))
1327                 return -EINVAL;
1328
1329         r = container_get_leader(machine, &pid);
1330         if (r < 0)
1331                 return r;
1332
1333         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1334         if (r < 0)
1335                 return r;
1336
1337         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1338                 return -errno;
1339
1340         r = namespace_fork("(sd-bootidns)", "(sd-bootid)", NULL, 0, FORK_RESET_SIGNALS|FORK_DEATHSIG,
1341                            pidnsfd, mntnsfd, -1, -1, rootfd, &child);
1342         if (r < 0)
1343                 return r;
1344         if (r == 0) {
1345                 int fd;
1346
1347                 pair[0] = safe_close(pair[0]);
1348
1349                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1350                 if (fd < 0)
1351                         _exit(EXIT_FAILURE);
1352
1353                 r = loop_read_exact(fd, buf, 36, false);
1354                 safe_close(fd);
1355                 if (r < 0)
1356                         _exit(EXIT_FAILURE);
1357
1358                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1359                 if (k != 36)
1360                         _exit(EXIT_FAILURE);
1361
1362                 _exit(EXIT_SUCCESS);
1363         }
1364
1365         pair[1] = safe_close(pair[1]);
1366
1367         r = wait_for_terminate_and_check("(sd-bootidns)", child, 0);
1368         if (r < 0)
1369                 return r;
1370         if (r != EXIT_SUCCESS)
1371                 return -EIO;
1372
1373         k = recv(pair[0], buf, 36, 0);
1374         if (k != 36)
1375                 return -EIO;
1376
1377         buf[36] = 0;
1378         r = sd_id128_from_string(buf, boot_id);
1379         if (r < 0)
1380                 return r;
1381
1382         return 0;
1383 }
1384
1385 int add_match_this_boot(sd_journal *j, const char *machine) {
1386         char match[9+32+1] = "_BOOT_ID=";
1387         sd_id128_t boot_id;
1388         int r;
1389
1390         assert(j);
1391
1392         if (machine) {
1393                 r = get_boot_id_for_machine(machine, &boot_id);
1394                 if (r < 0)
1395                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1396         } else {
1397                 r = sd_id128_get_boot(&boot_id);
1398                 if (r < 0)
1399                         return log_error_errno(r, "Failed to get boot id: %m");
1400         }
1401
1402         sd_id128_to_string(boot_id, match + 9);
1403         r = sd_journal_add_match(j, match, strlen(match));
1404         if (r < 0)
1405                 return log_error_errno(r, "Failed to add match: %m");
1406
1407         r = sd_journal_add_conjunction(j);
1408         if (r < 0)
1409                 return log_error_errno(r, "Failed to add conjunction: %m");
1410
1411         return 0;
1412 }
1413
1414 int show_journal_by_unit(
1415                 FILE *f,
1416                 const char *unit,
1417                 OutputMode mode,
1418                 unsigned n_columns,
1419                 usec_t not_before,
1420                 unsigned how_many,
1421                 uid_t uid,
1422                 OutputFlags flags,
1423                 int journal_open_flags,
1424                 bool system_unit,
1425                 bool *ellipsized) {
1426
1427         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1428         int r;
1429
1430         assert(mode >= 0);
1431         assert(mode < _OUTPUT_MODE_MAX);
1432         assert(unit);
1433
1434         if (how_many <= 0)
1435                 return 0;
1436
1437         r = sd_journal_open(&j, journal_open_flags);
1438         if (r < 0)
1439                 return log_error_errno(r, "Failed to open journal: %m");
1440
1441         r = add_match_this_boot(j, NULL);
1442         if (r < 0)
1443                 return r;
1444
1445         if (system_unit)
1446                 r = add_matches_for_unit(j, unit);
1447         else
1448                 r = add_matches_for_user_unit(j, unit, uid);
1449         if (r < 0)
1450                 return log_error_errno(r, "Failed to add unit matches: %m");
1451
1452         if (DEBUG_LOGGING) {
1453                 _cleanup_free_ char *filter;
1454
1455                 filter = journal_make_match_string(j);
1456                 if (!filter)
1457                         return log_oom();
1458
1459                 log_debug("Journal filter: %s", filter);
1460         }
1461
1462         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1463 }