src/shared/logs-show.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <signal.h>
   6 #include <stdint.h>
   7 #include <stdlib.h>
   8 #include <string.h>
   9 #include <sys/socket.h>
  10 #include <syslog.h>
  11 #include <time.h>
  12 #include <unistd.h>
  13
  14 #include "sd-id128.h"
  15 #include "sd-journal.h"
  16
  17 #include "alloc-util.h"
  18 #include "fd-util.h"
  19 #include "format-util.h"
  20 #include "hashmap.h"
  21 #include "hostname-util.h"
  22 #include "io-util.h"
  23 #include "journal-internal.h"
  24 #include "json.h"
  25 #include "log.h"
  26 #include "logs-show.h"
  27 #include "macro.h"
  28 #include "output-mode.h"
  29 #include "parse-util.h"
  30 #include "process-util.h"
  31 #include "sparse-endian.h"
  32 #include "stdio-util.h"
  33 #include "string-table.h"
  34 #include "string-util.h"
  35 #include "strv.h"
  36 #include "terminal-util.h"
  37 #include "time-util.h"
  38 #include "utf8.h"
  39 #include "util.h"
  40
  41 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  42 #define PRINT_LINE_THRESHOLD 3
  43 #define PRINT_CHAR_THRESHOLD 300
  44
  45 #define JSON_THRESHOLD 4096U
  46
  47 static int print_catalog(FILE *f, sd_journal *j) {
  48         int r;
  49         _cleanup_free_ char *t = NULL, *z = NULL;
  50
  51         r = sd_journal_get_catalog(j, &t);
  52         if (r < 0)
  53                 return r;
  54
  55         z = strreplace(strstrip(t), "\n", "\n-- ");
  56         if (!z)
  57                 return log_oom();
  58
  59         fputs("-- ", f);
  60         fputs(z, f);
  61         fputc('\n', f);
  62
  63         return 0;
  64 }
  65
  66 static int parse_field(const void *data, size_t length, const char *field, size_t field_len, char **target, size_t *target_len) {
  67         size_t nl;
  68         char *buf;
  69
  70         assert(data);
  71         assert(field);
  72         assert(target);
  73
  74         if (length < field_len)
  75                 return 0;
  76
  77         if (memcmp(data, field, field_len))
  78                 return 0;
  79
  80         nl = length - field_len;
  81
  82         buf = newdup_suffix0(char, (const char*) data + field_len, nl);
  83         if (!buf)
  84                 return log_oom();
  85
  86         free(*target);
  87         *target = buf;
  88
  89         if (target_len)
  90                 *target_len = nl;
  91
  92         return 1;
  93 }
  94
  95 typedef struct ParseFieldVec {
  96         const char *field;
  97         size_t field_len;
  98         char **target;
  99         size_t *target_len;
 100 } ParseFieldVec;
 101
 102 #define PARSE_FIELD_VEC_ENTRY(_field, _target, _target_len) \
 103         { .field = _field, .field_len = strlen(_field), .target = _target, .target_len = _target_len }
 104
 105 static int parse_fieldv(const void *data, size_t length, const ParseFieldVec *fields, unsigned n_fields) {
 106         unsigned i;
 107
 108         for (i = 0; i < n_fields; i++) {
 109                 const ParseFieldVec *f = &fields[i];
 110                 int r;
 111
 112                 r = parse_field(data, length, f->field, f->field_len, f->target, f->target_len);
 113                 if (r < 0)
 114                         return r;
 115                 else if (r > 0)
 116                         break;
 117         }
 118
 119         return 0;
 120 }
 121
 122 static int field_set_test(Set *fields, const char *name, size_t n) {
 123         char *s = NULL;
 124
 125         if (!fields)
 126                 return 1;
 127
 128         s = strndupa(name, n);
 129         if (!s)
 130                 return log_oom();
 131
 132         return set_get(fields, s) ? 1 : 0;
 133 }
 134
 135 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 136         assert(p);
 137
 138         if (flags & OUTPUT_SHOW_ALL)
 139                 return true;
 140
 141         if (l >= PRINT_CHAR_THRESHOLD)
 142                 return false;
 143
 144         if (!utf8_is_printable(p, l))
 145                 return false;
 146
 147         return true;
 148 }
 149
 150 static bool print_multiline(
 151                 FILE *f,
 152                 unsigned prefix,
 153                 unsigned n_columns,
 154                 OutputFlags flags,
 155                 int priority,
 156                 const char* message,
 157                 size_t message_len,
 158                 size_t highlight[2]) {
 159
 160         const char *color_on = "", *color_off = "", *highlight_on = "";
 161         const char *pos, *end;
 162         bool ellipsized = false;
 163         int line = 0;
 164
 165         if (flags & OUTPUT_COLOR) {
 166                 if (priority <= LOG_ERR) {
 167                         color_on = ANSI_HIGHLIGHT_RED;
 168                         color_off = ANSI_NORMAL;
 169                         highlight_on = ANSI_HIGHLIGHT;
 170                 } else if (priority <= LOG_NOTICE) {
 171                         color_on = ANSI_HIGHLIGHT;
 172                         color_off = ANSI_NORMAL;
 173                         highlight_on = ANSI_HIGHLIGHT_RED;
 174                 }
 175         }
 176
 177         /* A special case: make sure that we print a newline when
 178            the message is empty. */
 179         if (message_len == 0)
 180                 fputs("\n", f);
 181
 182         for (pos = message;
 183              pos < message + message_len;
 184              pos = end + 1, line++) {
 185                 bool continuation = line > 0;
 186                 bool tail_line;
 187                 int len;
 188                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 189                         ;
 190                 len = end - pos;
 191                 assert(len >= 0);
 192
 193                 /* We need to figure out when we are showing not-last line, *and*
 194                  * will skip subsequent lines. In that case, we will put the dots
 195                  * at the end of the line, instead of putting dots in the middle
 196                  * or not at all.
 197                  */
 198                 tail_line =
 199                         line + 1 == PRINT_LINE_THRESHOLD ||
 200                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 201
 202                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 203                     (prefix + len + 1 < n_columns && !tail_line)) {
 204                         if (highlight &&
 205                             (size_t) (pos - message) <= highlight[0] &&
 206                             highlight[0] < (size_t) len) {
 207
 208                                 fprintf(f, "%*s%s%.*s",
 209                                         continuation * prefix, "",
 210                                         color_on, (int) highlight[0], pos);
 211                                 fprintf(f, "%s%.*s",
 212                                         highlight_on,
 213                                         (int) (MIN((size_t) len, highlight[1]) - highlight[0]),
 214                                         pos + highlight[0]);
 215                                 if ((size_t) len > highlight[1])
 216                                         fprintf(f, "%s%.*s",
 217                                                 color_on,
 218                                                 (int) (len - highlight[1]),
 219                                                 pos + highlight[1]);
 220                                 fprintf(f, "%s\n", color_off);
 221
 222                         } else
 223                                 fprintf(f, "%*s%s%.*s%s\n",
 224                                         continuation * prefix, "",
 225                                         color_on, len, pos, color_off);
 226                         continue;
 227                 }
 228
 229                 /* Beyond this point, ellipsization will happen. */
 230                 ellipsized = true;
 231
 232                 if (prefix < n_columns && n_columns - prefix >= 3) {
 233                         if (n_columns - prefix > (unsigned) len + 3)
 234                                 fprintf(f, "%*s%s%.*s...%s\n",
 235                                         continuation * prefix, "",
 236                                         color_on, len, pos, color_off);
 237                         else {
 238                                 _cleanup_free_ char *e;
 239
 240                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 241                                                   tail_line ? 100 : 90);
 242                                 if (!e)
 243                                         fprintf(f, "%*s%s%.*s%s\n",
 244                                                 continuation * prefix, "",
 245                                                 color_on, len, pos, color_off);
 246                                 else
 247                                         fprintf(f, "%*s%s%s%s\n",
 248                                                 continuation * prefix, "",
 249                                                 color_on, e, color_off);
 250                         }
 251                 } else
 252                         fputs("...\n", f);
 253
 254                 if (tail_line)
 255                         break;
 256         }
 257
 258         return ellipsized;
 259 }
 260
 261 static int output_timestamp_monotonic(FILE *f, sd_journal *j, const char *monotonic) {
 262         sd_id128_t boot_id;
 263         uint64_t t;
 264         int r;
 265
 266         assert(f);
 267         assert(j);
 268
 269         r = -ENXIO;
 270         if (monotonic)
 271                 r = safe_atou64(monotonic, &t);
 272         if (r < 0)
 273                 r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 274         if (r < 0)
 275                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 276
 277         fprintf(f, "[%5"PRI_USEC".%06"PRI_USEC"]", t / USEC_PER_SEC, t % USEC_PER_SEC);
 278         return 1 + 5 + 1 + 6 + 1;
 279 }
 280
 281 static int output_timestamp_realtime(FILE *f, sd_journal *j, OutputMode mode, OutputFlags flags, const char *realtime) {
 282         char buf[MAX(FORMAT_TIMESTAMP_MAX, 64)];
 283         struct tm *(*gettime_r)(const time_t *, struct tm *);
 284         struct tm tm;
 285         uint64_t x;
 286         time_t t;
 287         int r;
 288
 289         assert(f);
 290         assert(j);
 291
 292         if (realtime)
 293                 r = safe_atou64(realtime, &x);
 294         if (!realtime || r < 0 || !VALID_REALTIME(x))
 295                 r = sd_journal_get_realtime_usec(j, &x);
 296         if (r < 0)
 297                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 298
 299         if (IN_SET(mode, OUTPUT_SHORT_FULL, OUTPUT_WITH_UNIT)) {
 300                 const char *k;
 301
 302                 if (flags & OUTPUT_UTC)
 303                         k = format_timestamp_utc(buf, sizeof(buf), x);
 304                 else
 305                         k = format_timestamp(buf, sizeof(buf), x);
 306                 if (!k) {
 307                         log_error("Failed to format timestamp: %"PRIu64, x);
 308                         return -EINVAL;
 309                 }
 310
 311         } else {
 312                 char usec[7];
 313
 314                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 315                 t = (time_t) (x / USEC_PER_SEC);
 316
 317                 switch (mode) {
 318
 319                 case OUTPUT_SHORT_UNIX:
 320                         xsprintf(buf, "%10"PRI_TIME".%06"PRIu64, t, x % USEC_PER_SEC);
 321                         break;
 322
 323                 case OUTPUT_SHORT_ISO:
 324                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm)) <= 0) {
 325                                 log_error("Failed to format ISO time");
 326                                 return -EINVAL;
 327                         }
 328                         break;
 329
 330                 case OUTPUT_SHORT_ISO_PRECISE:
 331                         /* No usec in strftime, so we leave space and copy over */
 332                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S.xxxxxx%z", gettime_r(&t, &tm)) <= 0) {
 333                                 log_error("Failed to format ISO-precise time");
 334                                 return -EINVAL;
 335                         }
 336                         xsprintf(usec, "%06"PRI_USEC, x % USEC_PER_SEC);
 337                         memcpy(buf + 20, usec, 6);
 338                         break;
 339
 340                 case OUTPUT_SHORT:
 341                 case OUTPUT_SHORT_PRECISE:
 342
 343                         if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm)) <= 0) {
 344                                 log_error("Failed to format syslog time");
 345                                 return -EINVAL;
 346                         }
 347
 348                         if (mode == OUTPUT_SHORT_PRECISE) {
 349                                 size_t k;
 350
 351                                 assert(sizeof(buf) > strlen(buf));
 352                                 k = sizeof(buf) - strlen(buf);
 353
 354                                 r = snprintf(buf + strlen(buf), k, ".%06"PRIu64, x % USEC_PER_SEC);
 355                                 if (r <= 0 || (size_t) r >= k) { /* too long? */
 356                                         log_error("Failed to format precise time");
 357                                         return -EINVAL;
 358                                 }
 359                         }
 360                         break;
 361
 362                 default:
 363                         assert_not_reached("Unknown time format");
 364                 }
 365         }
 366
 367         fputs(buf, f);
 368         return (int) strlen(buf);
 369 }
 370
 371 static int output_short(
 372                 FILE *f,
 373                 sd_journal *j,
 374                 OutputMode mode,
 375                 unsigned n_columns,
 376                 OutputFlags flags,
 377                 Set *output_fields,
 378                 const size_t highlight[2]) {
 379
 380         int r;
 381         const void *data;
 382         size_t length;
 383         size_t n = 0;
 384         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL, *unit = NULL, *user_unit = NULL;
 385         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0, unit_len = 0, user_unit_len = 0;
 386         int p = LOG_INFO;
 387         bool ellipsized = false;
 388         const ParseFieldVec fields[] = {
 389                 PARSE_FIELD_VEC_ENTRY("_PID=", &pid, &pid_len),
 390                 PARSE_FIELD_VEC_ENTRY("_COMM=", &comm, &comm_len),
 391                 PARSE_FIELD_VEC_ENTRY("MESSAGE=", &message, &message_len),
 392                 PARSE_FIELD_VEC_ENTRY("PRIORITY=", &priority, &priority_len),
 393                 PARSE_FIELD_VEC_ENTRY("_HOSTNAME=", &hostname, &hostname_len),
 394                 PARSE_FIELD_VEC_ENTRY("SYSLOG_PID=", &fake_pid, &fake_pid_len),
 395                 PARSE_FIELD_VEC_ENTRY("SYSLOG_IDENTIFIER=", &identifier, &identifier_len),
 396                 PARSE_FIELD_VEC_ENTRY("_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len),
 397                 PARSE_FIELD_VEC_ENTRY("_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len),
 398                 PARSE_FIELD_VEC_ENTRY("_SYSTEMD_UNIT=", &unit, &unit_len),
 399                 PARSE_FIELD_VEC_ENTRY("_SYSTEMD_USER_UNIT=", &user_unit, &user_unit_len),
 400         };
 401         size_t highlight_shifted[] = {highlight ? highlight[0] : 0, highlight ? highlight[1] : 0};
 402
 403         assert(f);
 404         assert(j);
 405
 406         /* Set the threshold to one bigger than the actual print
 407          * threshold, so that if the line is actually longer than what
 408          * we're willing to print, ellipsization will occur. This way
 409          * we won't output a misleading line without any indication of
 410          * truncation.
 411          */
 412         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 413
 414         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 415                 r = parse_fieldv(data, length, fields, ELEMENTSOF(fields));
 416                 if (r < 0)
 417                         return r;
 418         }
 419         if (r == -EBADMSG) {
 420                 log_debug_errno(r, "Skipping message we can't read: %m");
 421                 return 0;
 422         }
 423         if (r < 0)
 424                 return log_error_errno(r, "Failed to get journal fields: %m");
 425
 426         if (!message) {
 427                 log_debug("Skipping message without MESSAGE= field.");
 428                 return 0;
 429         }
 430
 431         if (!(flags & OUTPUT_SHOW_ALL))
 432                 strip_tab_ansi(&message, &message_len, highlight_shifted);
 433
 434         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 435                 p = *priority - '0';
 436
 437         if (mode == OUTPUT_SHORT_MONOTONIC)
 438                 r = output_timestamp_monotonic(f, j, monotonic);
 439         else
 440                 r = output_timestamp_realtime(f, j, mode, flags, realtime);
 441         if (r < 0)
 442                 return r;
 443         n += r;
 444
 445         if (flags & OUTPUT_NO_HOSTNAME) {
 446                 /* Suppress display of the hostname if this is requested. */
 447                 hostname = mfree(hostname);
 448                 hostname_len = 0;
 449         }
 450
 451         if (hostname && shall_print(hostname, hostname_len, flags)) {
 452                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 453                 n += hostname_len + 1;
 454         }
 455
 456         if (mode == OUTPUT_WITH_UNIT && ((unit && shall_print(unit, unit_len, flags)) || (user_unit && shall_print(user_unit, user_unit_len, flags)))) {
 457                 if (unit) {
 458                         fprintf(f, " %.*s", (int) unit_len, unit);
 459                         n += unit_len + 1;
 460                 }
 461                 if (user_unit) {
 462                         if (unit)
 463                                 fprintf(f, "/%.*s", (int) user_unit_len, user_unit);
 464                         else
 465                                 fprintf(f, " %.*s", (int) user_unit_len, user_unit);
 466                         n += unit_len + 1;
 467                 }
 468         } else if (identifier && shall_print(identifier, identifier_len, flags)) {
 469                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 470                 n += identifier_len + 1;
 471         } else if (comm && shall_print(comm, comm_len, flags)) {
 472                 fprintf(f, " %.*s", (int) comm_len, comm);
 473                 n += comm_len + 1;
 474         } else
 475                 fputs(" unknown", f);
 476
 477         if (pid && shall_print(pid, pid_len, flags)) {
 478                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 479                 n += pid_len + 2;
 480         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 481                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 482                 n += fake_pid_len + 2;
 483         }
 484
 485         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 486                 char bytes[FORMAT_BYTES_MAX];
 487                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 488         } else {
 489                 fputs(": ", f);
 490                 ellipsized |=
 491                         print_multiline(f, n + 2, n_columns, flags, p,
 492                                         message, message_len,
 493                                         highlight_shifted);
 494         }
 495
 496         if (flags & OUTPUT_CATALOG)
 497                 print_catalog(f, j);
 498
 499         return ellipsized;
 500 }
 501
 502 static int output_verbose(
 503                 FILE *f,
 504                 sd_journal *j,
 505                 OutputMode mode,
 506                 unsigned n_columns,
 507                 OutputFlags flags,
 508                 Set *output_fields,
 509                 const size_t highlight[2]) {
 510
 511         const void *data;
 512         size_t length;
 513         _cleanup_free_ char *cursor = NULL;
 514         uint64_t realtime = 0;
 515         char ts[FORMAT_TIMESTAMP_MAX + 7];
 516         const char *timestamp;
 517         int r;
 518
 519         assert(f);
 520         assert(j);
 521
 522         sd_journal_set_data_threshold(j, 0);
 523
 524         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 525         if (r == -ENOENT)
 526                 log_debug("Source realtime timestamp not found");
 527         else if (r < 0)
 528                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 529         else {
 530                 _cleanup_free_ char *value = NULL;
 531
 532                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=",
 533                                 STRLEN("_SOURCE_REALTIME_TIMESTAMP="), &value,
 534                                 NULL);
 535                 if (r < 0)
 536                         return r;
 537                 assert(r > 0);
 538
 539                 r = safe_atou64(value, &realtime);
 540                 if (r < 0)
 541                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 542         }
 543
 544         if (r < 0) {
 545                 r = sd_journal_get_realtime_usec(j, &realtime);
 546                 if (r < 0)
 547                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 548         }
 549
 550         r = sd_journal_get_cursor(j, &cursor);
 551         if (r < 0)
 552                 return log_error_errno(r, "Failed to get cursor: %m");
 553
 554         timestamp = flags & OUTPUT_UTC ? format_timestamp_us_utc(ts, sizeof ts, realtime)
 555                                        : format_timestamp_us(ts, sizeof ts, realtime);
 556         fprintf(f, "%s [%s]\n",
 557                 timestamp ?: "(no timestamp)",
 558                 cursor);
 559
 560         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 561                 const char *c;
 562                 int fieldlen;
 563                 const char *on = "", *off = "";
 564
 565                 c = memchr(data, '=', length);
 566                 if (!c) {
 567                         log_error("Invalid field.");
 568                         return -EINVAL;
 569                 }
 570                 fieldlen = c - (const char*) data;
 571
 572                 r = field_set_test(output_fields, data, fieldlen);
 573                 if (r < 0)
 574                         return r;
 575                 if (!r)
 576                         continue;
 577
 578                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 579                         on = ANSI_HIGHLIGHT;
 580                         off = ANSI_NORMAL;
 581                 }
 582
 583                 if ((flags & OUTPUT_SHOW_ALL) ||
 584                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 585                      && utf8_is_printable(data, length))) {
 586                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 587                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1, NULL);
 588                         fputs(off, f);
 589                 } else {
 590                         char bytes[FORMAT_BYTES_MAX];
 591
 592                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 593                                 on,
 594                                 (int) (c - (const char*) data),
 595                                 (const char*) data,
 596                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 597                                 off);
 598                 }
 599         }
 600
 601         if (r < 0)
 602                 return r;
 603
 604         if (flags & OUTPUT_CATALOG)
 605                 print_catalog(f, j);
 606
 607         return 0;
 608 }
 609
 610 static int output_export(
 611                 FILE *f,
 612                 sd_journal *j,
 613                 OutputMode mode,
 614                 unsigned n_columns,
 615                 OutputFlags flags,
 616                 Set *output_fields,
 617                 const size_t highlight[2]) {
 618
 619         sd_id128_t boot_id;
 620         char sid[33];
 621         int r;
 622         usec_t realtime, monotonic;
 623         _cleanup_free_ char *cursor = NULL;
 624         const void *data;
 625         size_t length;
 626
 627         assert(j);
 628
 629         sd_journal_set_data_threshold(j, 0);
 630
 631         r = sd_journal_get_realtime_usec(j, &realtime);
 632         if (r < 0)
 633                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 634
 635         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 636         if (r < 0)
 637                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 638
 639         r = sd_journal_get_cursor(j, &cursor);
 640         if (r < 0)
 641                 return log_error_errno(r, "Failed to get cursor: %m");
 642
 643         fprintf(f,
 644                 "__CURSOR=%s\n"
 645                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 646                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 647                 "_BOOT_ID=%s\n",
 648                 cursor,
 649                 realtime,
 650                 monotonic,
 651                 sd_id128_to_string(boot_id, sid));
 652
 653         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 654                 const char *c;
 655
 656                 /* We already printed the boot id from the data in the header, hence let's suppress it here */
 657                 if (memory_startswith(data, length, "_BOOT_ID="))
 658                         continue;
 659
 660                 c = memchr(data, '=', length);
 661                 if (!c) {
 662                         log_error("Invalid field.");
 663                         return -EINVAL;
 664                 }
 665
 666                 r = field_set_test(output_fields, data, c - (const char *) data);
 667                 if (r < 0)
 668                         return r;
 669                 if (!r)
 670                         continue;
 671
 672                 if (utf8_is_printable_newline(data, length, false))
 673                         fwrite(data, length, 1, f);
 674                 else {
 675                         uint64_t le64;
 676
 677                         fwrite(data, c - (const char*) data, 1, f);
 678                         fputc('\n', f);
 679                         le64 = htole64(length - (c - (const char*) data) - 1);
 680                         fwrite(&le64, sizeof(le64), 1, f);
 681                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 682                 }
 683
 684                 fputc('\n', f);
 685         }
 686         if (r == -EBADMSG) {
 687                 log_debug_errno(r, "Skipping message we can't read: %m");
 688                 return 0;
 689         }
 690
 691         if (r < 0)
 692                 return r;
 693
 694         fputc('\n', f);
 695
 696         return 0;
 697 }
 698
 699 void json_escape(
 700                 FILE *f,
 701                 const char* p,
 702                 size_t l,
 703                 OutputFlags flags) {
 704
 705         assert(f);
 706         assert(p);
 707
 708         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 709                 fputs("null", f);
 710
 711         else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
 712                 bool not_first = false;
 713
 714                 fputs("[ ", f);
 715
 716                 while (l > 0) {
 717                         if (not_first)
 718                                 fprintf(f, ", %u", (uint8_t) *p);
 719                         else {
 720                                 not_first = true;
 721                                 fprintf(f, "%u", (uint8_t) *p);
 722                         }
 723
 724                         p++;
 725                         l--;
 726                 }
 727
 728                 fputs(" ]", f);
 729         } else {
 730                 fputc('\"', f);
 731
 732                 while (l > 0) {
 733                         if (IN_SET(*p, '"', '\\')) {
 734                                 fputc('\\', f);
 735                                 fputc(*p, f);
 736                         } else if (*p == '\n')
 737                                 fputs("\\n", f);
 738                         else if ((uint8_t) *p < ' ')
 739                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 740                         else
 741                                 fputc(*p, f);
 742
 743                         p++;
 744                         l--;
 745                 }
 746
 747                 fputc('\"', f);
 748         }
 749 }
 750
 751 struct json_data {
 752         JsonVariant* name;
 753         size_t n_values;
 754         JsonVariant* values[];
 755 };
 756
 757 static int update_json_data(
 758                 Hashmap *h,
 759                 OutputFlags flags,
 760                 const char *name,
 761                 const void *value,
 762                 size_t size) {
 763
 764         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 765         struct json_data *d;
 766         int r;
 767
 768         if (!(flags & OUTPUT_SHOW_ALL) && strlen(name) + 1 + size >= JSON_THRESHOLD)
 769                 r = json_variant_new_null(&v);
 770         else if (utf8_is_printable(value, size))
 771                 r = json_variant_new_stringn(&v, value, size);
 772         else
 773                 r = json_variant_new_array_bytes(&v, value, size);
 774         if (r < 0)
 775                 return log_error_errno(r, "Failed to allocate JSON data: %m");
 776
 777         d = hashmap_get(h, name);
 778         if (d) {
 779                 struct json_data *w;
 780
 781                 w = realloc(d, offsetof(struct json_data, values) + sizeof(JsonVariant*) * (d->n_values + 1));
 782                 if (!w)
 783                         return log_oom();
 784
 785                 d = w;
 786                 assert_se(hashmap_update(h, json_variant_string(d->name), d) >= 0);
 787         } else {
 788                 _cleanup_(json_variant_unrefp) JsonVariant *n = NULL;
 789
 790                 r = json_variant_new_string(&n, name);
 791                 if (r < 0)
 792                         return log_error_errno(r, "Failed to allocate JSON name variant: %m");
 793
 794                 d = malloc0(offsetof(struct json_data, values) + sizeof(JsonVariant*));
 795                 if (!d)
 796                         return log_oom();
 797
 798                 r = hashmap_put(h, json_variant_string(n), d);
 799                 if (r < 0) {
 800                         free(d);
 801                         return log_error_errno(r, "Failed to insert JSON name into hashmap: %m");
 802                 }
 803
 804                 d->name = TAKE_PTR(n);
 805         }
 806
 807         d->values[d->n_values++] = TAKE_PTR(v);
 808         return 0;
 809 }
 810
 811 static int update_json_data_split(
 812                 Hashmap *h,
 813                 OutputFlags flags,
 814                 Set *output_fields,
 815                 const void *data,
 816                 size_t size) {
 817
 818         const char *eq;
 819         char *name;
 820
 821         assert(h);
 822         assert(data || size == 0);
 823
 824         if (memory_startswith(data, size, "_BOOT_ID="))
 825                 return 0;
 826
 827         eq = memchr(data, '=', MIN(size, JSON_THRESHOLD));
 828         if (!eq)
 829                 return 0;
 830
 831         if (eq == data)
 832                 return 0;
 833
 834         name = strndupa(data, eq - (const char*) data);
 835         if (output_fields && !set_get(output_fields, name))
 836                 return 0;
 837
 838         return update_json_data(h, flags, name, eq + 1, size - (eq - (const char*) data) - 1);
 839 }
 840
 841 static int output_json(
 842                 FILE *f,
 843                 sd_journal *j,
 844                 OutputMode mode,
 845                 unsigned n_columns,
 846                 OutputFlags flags,
 847                 Set *output_fields,
 848                 const size_t highlight[2]) {
 849
 850         char sid[SD_ID128_STRING_MAX], usecbuf[DECIMAL_STR_MAX(usec_t)];
 851         _cleanup_(json_variant_unrefp) JsonVariant *object = NULL;
 852         _cleanup_free_ char *cursor = NULL;
 853         uint64_t realtime, monotonic;
 854         JsonVariant **array = NULL;
 855         struct json_data *d;
 856         sd_id128_t boot_id;
 857         Hashmap *h = NULL;
 858         size_t n = 0;
 859         Iterator i;
 860         int r;
 861
 862         assert(j);
 863
 864         (void) sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 865
 866         r = sd_journal_get_realtime_usec(j, &realtime);
 867         if (r < 0)
 868                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 869
 870         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 871         if (r < 0)
 872                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 873
 874         r = sd_journal_get_cursor(j, &cursor);
 875         if (r < 0)
 876                 return log_error_errno(r, "Failed to get cursor: %m");
 877
 878         h = hashmap_new(&string_hash_ops);
 879         if (!h)
 880                 return log_oom();
 881
 882         r = update_json_data(h, flags, "__CURSOR", cursor, strlen(cursor));
 883         if (r < 0)
 884                 goto finish;
 885
 886         xsprintf(usecbuf, USEC_FMT, realtime);
 887         r = update_json_data(h, flags, "__REALTIME_TIMESTAMP", usecbuf, strlen(usecbuf));
 888         if (r < 0)
 889                 goto finish;
 890
 891         xsprintf(usecbuf, USEC_FMT, monotonic);
 892         r = update_json_data(h, flags, "__MONOTONIC_TIMESTAMP", usecbuf, strlen(usecbuf));
 893         if (r < 0)
 894                 goto finish;
 895
 896         sd_id128_to_string(boot_id, sid);
 897         r = update_json_data(h, flags, "_BOOT_ID", sid, strlen(sid));
 898         if (r < 0)
 899                 goto finish;
 900
 901         for (;;) {
 902                 const void *data;
 903                 size_t size;
 904
 905                 r = sd_journal_enumerate_data(j, &data, &size);
 906                 if (r == -EBADMSG) {
 907                         log_debug_errno(r, "Skipping message we can't read: %m");
 908                         r = 0;
 909                         goto finish;
 910                 }
 911                 if (r < 0) {
 912                         log_error_errno(r, "Failed to read journal: %m");
 913                         goto finish;
 914                 }
 915                 if (r == 0)
 916                         break;
 917
 918                 r = update_json_data_split(h, flags, output_fields, data, size);
 919                 if (r < 0)
 920                         goto finish;
 921         }
 922
 923         array = new(JsonVariant*, hashmap_size(h)*2);
 924         if (!array) {
 925                 r = log_oom();
 926                 goto finish;
 927         }
 928
 929         HASHMAP_FOREACH(d, h, i) {
 930                 assert(d->n_values > 0);
 931
 932                 array[n++] = json_variant_ref(d->name);
 933
 934                 if (d->n_values == 1)
 935                         array[n++] = json_variant_ref(d->values[0]);
 936                 else {
 937                         _cleanup_(json_variant_unrefp) JsonVariant *q = NULL;
 938
 939                         r = json_variant_new_array(&q, d->values, d->n_values);
 940                         if (r < 0) {
 941                                 log_error_errno(r, "Failed to create JSON array: %m");
 942                                 goto finish;
 943                         }
 944
 945                         array[n++] = TAKE_PTR(q);
 946                 }
 947         }
 948
 949         r = json_variant_new_object(&object, array, n);
 950         if (r < 0) {
 951                 log_error_errno(r, "Failed to allocate JSON object: %m");
 952                 goto finish;
 953         }
 954
 955         json_variant_dump(object,
 956                           (mode == OUTPUT_JSON_SSE    ? JSON_FORMAT_SSE :
 957                            mode == OUTPUT_JSON_SEQ    ? JSON_FORMAT_SEQ :
 958                            mode == OUTPUT_JSON_PRETTY ? JSON_FORMAT_PRETTY :
 959                                                         JSON_FORMAT_NEWLINE) |
 960                           (FLAGS_SET(flags, OUTPUT_COLOR) ? JSON_FORMAT_COLOR : 0),
 961                           f, NULL);
 962
 963         r = 0;
 964
 965 finish:
 966         while ((d = hashmap_steal_first(h))) {
 967                 size_t k;
 968
 969                 json_variant_unref(d->name);
 970                 for (k = 0; k < d->n_values; k++)
 971                         json_variant_unref(d->values[k]);
 972
 973                 free(d);
 974         }
 975
 976         hashmap_free(h);
 977
 978         json_variant_unref_many(array, n);
 979         free(array);
 980
 981         return r;
 982 }
 983
 984 static int output_cat(
 985                 FILE *f,
 986                 sd_journal *j,
 987                 OutputMode mode,
 988                 unsigned n_columns,
 989                 OutputFlags flags,
 990                 Set *output_fields,
 991                 const size_t highlight[2]) {
 992
 993         const void *data;
 994         size_t l;
 995         int r;
 996         const char *highlight_on = "", *highlight_off = "";
 997
 998         assert(j);
 999         assert(f);
1000
1001         if (flags & OUTPUT_COLOR) {
1002                 highlight_on = ANSI_HIGHLIGHT_RED;
1003                 highlight_off = ANSI_NORMAL;
1004         }
1005
1006         sd_journal_set_data_threshold(j, 0);
1007
1008         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
1009         if (r == -EBADMSG) {
1010                 log_debug_errno(r, "Skipping message we can't read: %m");
1011                 return 0;
1012         }
1013         if (r < 0) {
1014                 /* An entry without MESSAGE=? */
1015                 if (r == -ENOENT)
1016                         return 0;
1017
1018                 return log_error_errno(r, "Failed to get data: %m");
1019         }
1020
1021         assert(l >= 8);
1022
1023         if (highlight && (flags & OUTPUT_COLOR)) {
1024                 assert(highlight[0] <= highlight[1]);
1025                 assert(highlight[1] <= l - 8);
1026
1027                 fwrite((const char*) data + 8, 1, highlight[0], f);
1028                 fwrite(highlight_on, 1, strlen(highlight_on), f);
1029                 fwrite((const char*) data + 8 + highlight[0], 1, highlight[1] - highlight[0], f);
1030                 fwrite(highlight_off, 1, strlen(highlight_off), f);
1031                 fwrite((const char*) data + 8 + highlight[1], 1, l - 8 - highlight[1], f);
1032         } else
1033                 fwrite((const char*) data + 8, 1, l - 8, f);
1034         fputc('\n', f);
1035
1036         return 0;
1037 }
1038
1039 static int (*output_funcs[_OUTPUT_MODE_MAX])(
1040                 FILE *f,
1041                 sd_journal*j,
1042                 OutputMode mode,
1043                 unsigned n_columns,
1044                 OutputFlags flags,
1045                 Set *output_fields,
1046                 const size_t highlight[2]) = {
1047
1048         [OUTPUT_SHORT] = output_short,
1049         [OUTPUT_SHORT_ISO] = output_short,
1050         [OUTPUT_SHORT_ISO_PRECISE] = output_short,
1051         [OUTPUT_SHORT_PRECISE] = output_short,
1052         [OUTPUT_SHORT_MONOTONIC] = output_short,
1053         [OUTPUT_SHORT_UNIX] = output_short,
1054         [OUTPUT_SHORT_FULL] = output_short,
1055         [OUTPUT_VERBOSE] = output_verbose,
1056         [OUTPUT_EXPORT] = output_export,
1057         [OUTPUT_JSON] = output_json,
1058         [OUTPUT_JSON_PRETTY] = output_json,
1059         [OUTPUT_JSON_SSE] = output_json,
1060         [OUTPUT_JSON_SEQ] = output_json,
1061         [OUTPUT_CAT] = output_cat,
1062         [OUTPUT_WITH_UNIT] = output_short,
1063 };
1064
1065 int show_journal_entry(
1066                 FILE *f,
1067                 sd_journal *j,
1068                 OutputMode mode,
1069                 unsigned n_columns,
1070                 OutputFlags flags,
1071                 char **output_fields,
1072                 const size_t highlight[2],
1073                 bool *ellipsized) {
1074
1075         int ret;
1076         _cleanup_set_free_free_ Set *fields = NULL;
1077         assert(mode >= 0);
1078         assert(mode < _OUTPUT_MODE_MAX);
1079
1080         if (n_columns <= 0)
1081                 n_columns = columns();
1082
1083         if (output_fields) {
1084                 fields = set_new(&string_hash_ops);
1085                 if (!fields)
1086                         return log_oom();
1087
1088                 ret = set_put_strdupv(fields, output_fields);
1089                 if (ret < 0)
1090                         return ret;
1091         }
1092
1093         ret = output_funcs[mode](f, j, mode, n_columns, flags, fields, highlight);
1094
1095         if (ellipsized && ret > 0)
1096                 *ellipsized = true;
1097
1098         return ret;
1099 }
1100
1101 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
1102         assert(f);
1103         assert(flags);
1104
1105         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
1106                 return 0;
1107
1108         /* Print a beginning new line if that's request, but only once
1109          * on the first line we print. */
1110
1111         fputc('\n', f);
1112         *flags &= ~OUTPUT_BEGIN_NEWLINE;
1113         return 0;
1114 }
1115
1116 int show_journal(
1117                 FILE *f,
1118                 sd_journal *j,
1119                 OutputMode mode,
1120                 unsigned n_columns,
1121                 usec_t not_before,
1122                 unsigned how_many,
1123                 OutputFlags flags,
1124                 bool *ellipsized) {
1125
1126         int r;
1127         unsigned line = 0;
1128         bool need_seek = false;
1129         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
1130
1131         assert(j);
1132         assert(mode >= 0);
1133         assert(mode < _OUTPUT_MODE_MAX);
1134
1135         if (how_many == (unsigned) -1)
1136                 need_seek = true;
1137         else {
1138                 /* Seek to end */
1139                 r = sd_journal_seek_tail(j);
1140                 if (r < 0)
1141                         return log_error_errno(r, "Failed to seek to tail: %m");
1142
1143                 r = sd_journal_previous_skip(j, how_many);
1144                 if (r < 0)
1145                         return log_error_errno(r, "Failed to skip previous: %m");
1146         }
1147
1148         for (;;) {
1149                 for (;;) {
1150                         usec_t usec;
1151
1152                         if (need_seek) {
1153                                 r = sd_journal_next(j);
1154                                 if (r < 0)
1155                                         return log_error_errno(r, "Failed to iterate through journal: %m");
1156                         }
1157
1158                         if (r == 0)
1159                                 break;
1160
1161                         need_seek = true;
1162
1163                         if (not_before > 0) {
1164                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1165
1166                                 /* -ESTALE is returned if the
1167                                    timestamp is not from this boot */
1168                                 if (r == -ESTALE)
1169                                         continue;
1170                                 else if (r < 0)
1171                                         return log_error_errno(r, "Failed to get journal time: %m");
1172
1173                                 if (usec < not_before)
1174                                         continue;
1175                         }
1176
1177                         line++;
1178                         maybe_print_begin_newline(f, &flags);
1179
1180                         r = show_journal_entry(f, j, mode, n_columns, flags, NULL, NULL, ellipsized);
1181                         if (r < 0)
1182                                 return r;
1183                 }
1184
1185                 if (warn_cutoff && line < how_many && not_before > 0) {
1186                         sd_id128_t boot_id;
1187                         usec_t cutoff = 0;
1188
1189                         /* Check whether the cutoff line is too early */
1190
1191                         r = sd_id128_get_boot(&boot_id);
1192                         if (r < 0)
1193                                 return log_error_errno(r, "Failed to get boot id: %m");
1194
1195                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1196                         if (r < 0)
1197                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1198
1199                         if (r > 0 && not_before < cutoff) {
1200                                 maybe_print_begin_newline(f, &flags);
1201                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1202                         }
1203
1204                         warn_cutoff = false;
1205                 }
1206
1207                 if (!(flags & OUTPUT_FOLLOW))
1208                         break;
1209
1210                 r = sd_journal_wait(j, USEC_INFINITY);
1211                 if (r < 0)
1212                         return log_error_errno(r, "Failed to wait for journal: %m");
1213
1214         }
1215
1216         return 0;
1217 }
1218
1219 int add_matches_for_unit(sd_journal *j, const char *unit) {
1220         const char *m1, *m2, *m3, *m4;
1221         int r;
1222
1223         assert(j);
1224         assert(unit);
1225
1226         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1227         m2 = strjoina("COREDUMP_UNIT=", unit);
1228         m3 = strjoina("UNIT=", unit);
1229         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1230
1231         (void)(
1232             /* Look for messages from the service itself */
1233             (r = sd_journal_add_match(j, m1, 0)) ||
1234
1235             /* Look for coredumps of the service */
1236             (r = sd_journal_add_disjunction(j)) ||
1237             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1238             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1239             (r = sd_journal_add_match(j, m2, 0)) ||
1240
1241              /* Look for messages from PID 1 about this service */
1242             (r = sd_journal_add_disjunction(j)) ||
1243             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1244             (r = sd_journal_add_match(j, m3, 0)) ||
1245
1246             /* Look for messages from authorized daemons about this service */
1247             (r = sd_journal_add_disjunction(j)) ||
1248             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1249             (r = sd_journal_add_match(j, m4, 0))
1250         );
1251
1252         if (r == 0 && endswith(unit, ".slice")) {
1253                 const char *m5;
1254
1255                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1256
1257                 /* Show all messages belonging to a slice */
1258                 (void)(
1259                         (r = sd_journal_add_disjunction(j)) ||
1260                         (r = sd_journal_add_match(j, m5, 0))
1261                         );
1262         }
1263
1264         return r;
1265 }
1266
1267 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1268         int r;
1269         char *m1, *m2, *m3, *m4;
1270         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1271
1272         assert(j);
1273         assert(unit);
1274
1275         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1276         m2 = strjoina("USER_UNIT=", unit);
1277         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1278         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1279         sprintf(muid, "_UID="UID_FMT, uid);
1280
1281         (void) (
1282                 /* Look for messages from the user service itself */
1283                 (r = sd_journal_add_match(j, m1, 0)) ||
1284                 (r = sd_journal_add_match(j, muid, 0)) ||
1285
1286                 /* Look for messages from systemd about this service */
1287                 (r = sd_journal_add_disjunction(j)) ||
1288                 (r = sd_journal_add_match(j, m2, 0)) ||
1289                 (r = sd_journal_add_match(j, muid, 0)) ||
1290
1291                 /* Look for coredumps of the service */
1292                 (r = sd_journal_add_disjunction(j)) ||
1293                 (r = sd_journal_add_match(j, m3, 0)) ||
1294                 (r = sd_journal_add_match(j, muid, 0)) ||
1295                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1296
1297                 /* Look for messages from authorized daemons about this service */
1298                 (r = sd_journal_add_disjunction(j)) ||
1299                 (r = sd_journal_add_match(j, m4, 0)) ||
1300                 (r = sd_journal_add_match(j, muid, 0)) ||
1301                 (r = sd_journal_add_match(j, "_UID=0", 0))
1302         );
1303
1304         if (r == 0 && endswith(unit, ".slice")) {
1305                 const char *m5;
1306
1307                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1308
1309                 /* Show all messages belonging to a slice */
1310                 (void)(
1311                         (r = sd_journal_add_disjunction(j)) ||
1312                         (r = sd_journal_add_match(j, m5, 0)) ||
1313                         (r = sd_journal_add_match(j, muid, 0))
1314                         );
1315         }
1316
1317         return r;
1318 }
1319
1320 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1321         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1322         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1323         pid_t pid, child;
1324         char buf[37];
1325         ssize_t k;
1326         int r;
1327
1328         assert(machine);
1329         assert(boot_id);
1330
1331         if (!machine_name_is_valid(machine))
1332                 return -EINVAL;
1333
1334         r = container_get_leader(machine, &pid);
1335         if (r < 0)
1336                 return r;
1337
1338         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1339         if (r < 0)
1340                 return r;
1341
1342         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1343                 return -errno;
1344
1345         r = namespace_fork("(sd-bootidns)", "(sd-bootid)", NULL, 0, FORK_RESET_SIGNALS|FORK_DEATHSIG,
1346                            pidnsfd, mntnsfd, -1, -1, rootfd, &child);
1347         if (r < 0)
1348                 return r;
1349         if (r == 0) {
1350                 int fd;
1351
1352                 pair[0] = safe_close(pair[0]);
1353
1354                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1355                 if (fd < 0)
1356                         _exit(EXIT_FAILURE);
1357
1358                 r = loop_read_exact(fd, buf, 36, false);
1359                 safe_close(fd);
1360                 if (r < 0)
1361                         _exit(EXIT_FAILURE);
1362
1363                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1364                 if (k != 36)
1365                         _exit(EXIT_FAILURE);
1366
1367                 _exit(EXIT_SUCCESS);
1368         }
1369
1370         pair[1] = safe_close(pair[1]);
1371
1372         r = wait_for_terminate_and_check("(sd-bootidns)", child, 0);
1373         if (r < 0)
1374                 return r;
1375         if (r != EXIT_SUCCESS)
1376                 return -EIO;
1377
1378         k = recv(pair[0], buf, 36, 0);
1379         if (k != 36)
1380                 return -EIO;
1381
1382         buf[36] = 0;
1383         r = sd_id128_from_string(buf, boot_id);
1384         if (r < 0)
1385                 return r;
1386
1387         return 0;
1388 }
1389
1390 int add_match_this_boot(sd_journal *j, const char *machine) {
1391         char match[9+32+1] = "_BOOT_ID=";
1392         sd_id128_t boot_id;
1393         int r;
1394
1395         assert(j);
1396
1397         if (machine) {
1398                 r = get_boot_id_for_machine(machine, &boot_id);
1399                 if (r < 0)
1400                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1401         } else {
1402                 r = sd_id128_get_boot(&boot_id);
1403                 if (r < 0)
1404                         return log_error_errno(r, "Failed to get boot id: %m");
1405         }
1406
1407         sd_id128_to_string(boot_id, match + 9);
1408         r = sd_journal_add_match(j, match, strlen(match));
1409         if (r < 0)
1410                 return log_error_errno(r, "Failed to add match: %m");
1411
1412         r = sd_journal_add_conjunction(j);
1413         if (r < 0)
1414                 return log_error_errno(r, "Failed to add conjunction: %m");
1415
1416         return 0;
1417 }
1418
1419 int show_journal_by_unit(
1420                 FILE *f,
1421                 const char *unit,
1422                 OutputMode mode,
1423                 unsigned n_columns,
1424                 usec_t not_before,
1425                 unsigned how_many,
1426                 uid_t uid,
1427                 OutputFlags flags,
1428                 int journal_open_flags,
1429                 bool system_unit,
1430                 bool *ellipsized) {
1431
1432         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1433         int r;
1434
1435         assert(mode >= 0);
1436         assert(mode < _OUTPUT_MODE_MAX);
1437         assert(unit);
1438
1439         if (how_many <= 0)
1440                 return 0;
1441
1442         r = sd_journal_open(&j, journal_open_flags);
1443         if (r < 0)
1444                 return log_error_errno(r, "Failed to open journal: %m");
1445
1446         r = add_match_this_boot(j, NULL);
1447         if (r < 0)
1448                 return r;
1449
1450         if (system_unit)
1451                 r = add_matches_for_unit(j, unit);
1452         else
1453                 r = add_matches_for_user_unit(j, unit, uid);
1454         if (r < 0)
1455                 return log_error_errno(r, "Failed to add unit matches: %m");
1456
1457         if (DEBUG_LOGGING) {
1458                 _cleanup_free_ char *filter;
1459
1460                 filter = journal_make_match_string(j);
1461                 if (!filter)
1462                         return log_oom();
1463
1464                 log_debug("Journal filter: %s", filter);
1465         }
1466
1467         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1468 }