src/shared/logs-show.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <signal.h>
  23 #include <stdint.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <syslog.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32 #include "sd-journal.h"
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "formats-util.h"
  37 #include "hashmap.h"
  38 #include "hostname-util.h"
  39 #include "io-util.h"
  40 #include "journal-internal.h"
  41 #include "log.h"
  42 #include "logs-show.h"
  43 #include "macro.h"
  44 #include "output-mode.h"
  45 #include "parse-util.h"
  46 #include "process-util.h"
  47 #include "sparse-endian.h"
  48 #include "string-table.h"
  49 #include "string-util.h"
  50 #include "terminal-util.h"
  51 #include "time-util.h"
  52 #include "utf8.h"
  53 #include "util.h"
  54
  55 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  56 #define PRINT_LINE_THRESHOLD 3
  57 #define PRINT_CHAR_THRESHOLD 300
  58
  59 #define JSON_THRESHOLD 4096
  60
  61 static int print_catalog(FILE *f, sd_journal *j) {
  62         int r;
  63         _cleanup_free_ char *t = NULL, *z = NULL;
  64
  65
  66         r = sd_journal_get_catalog(j, &t);
  67         if (r < 0)
  68                 return r;
  69
  70         z = strreplace(strstrip(t), "\n", "\n-- ");
  71         if (!z)
  72                 return log_oom();
  73
  74         fputs("-- ", f);
  75         fputs(z, f);
  76         fputc('\n', f);
  77
  78         return 0;
  79 }
  80
  81 static int parse_field(const void *data, size_t length, const char *field, char **target, size_t *target_size) {
  82         size_t fl, nl;
  83         char *buf;
  84
  85         assert(data);
  86         assert(field);
  87         assert(target);
  88
  89         fl = strlen(field);
  90         if (length < fl)
  91                 return 0;
  92
  93         if (memcmp(data, field, fl))
  94                 return 0;
  95
  96         nl = length - fl;
  97         buf = new(char, nl+1);
  98         if (!buf)
  99                 return log_oom();
 100
 101         memcpy(buf, (const char*) data + fl, nl);
 102         buf[nl] = 0;
 103
 104         free(*target);
 105         *target = buf;
 106
 107         if (target_size)
 108                 *target_size = nl;
 109
 110         return 1;
 111 }
 112
 113 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 114         assert(p);
 115
 116         if (flags & OUTPUT_SHOW_ALL)
 117                 return true;
 118
 119         if (l >= PRINT_CHAR_THRESHOLD)
 120                 return false;
 121
 122         if (!utf8_is_printable(p, l))
 123                 return false;
 124
 125         return true;
 126 }
 127
 128 static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
 129         const char *color_on = "", *color_off = "";
 130         const char *pos, *end;
 131         bool ellipsized = false;
 132         int line = 0;
 133
 134         if (flags & OUTPUT_COLOR) {
 135                 if (priority <= LOG_ERR) {
 136                         color_on = ANSI_HIGHLIGHT_RED;
 137                         color_off = ANSI_NORMAL;
 138                 } else if (priority <= LOG_NOTICE) {
 139                         color_on = ANSI_HIGHLIGHT;
 140                         color_off = ANSI_NORMAL;
 141                 }
 142         }
 143
 144         /* A special case: make sure that we print a newline when
 145            the message is empty. */
 146         if (message_len == 0)
 147                 fputs("\n", f);
 148
 149         for (pos = message;
 150              pos < message + message_len;
 151              pos = end + 1, line++) {
 152                 bool continuation = line > 0;
 153                 bool tail_line;
 154                 int len;
 155                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 156                         ;
 157                 len = end - pos;
 158                 assert(len >= 0);
 159
 160                 /* We need to figure out when we are showing not-last line, *and*
 161                  * will skip subsequent lines. In that case, we will put the dots
 162                  * at the end of the line, instead of putting dots in the middle
 163                  * or not at all.
 164                  */
 165                 tail_line =
 166                         line + 1 == PRINT_LINE_THRESHOLD ||
 167                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 168
 169                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 170                     (prefix + len + 1 < n_columns && !tail_line)) {
 171                         fprintf(f, "%*s%s%.*s%s\n",
 172                                 continuation * prefix, "",
 173                                 color_on, len, pos, color_off);
 174                         continue;
 175                 }
 176
 177                 /* Beyond this point, ellipsization will happen. */
 178                 ellipsized = true;
 179
 180                 if (prefix < n_columns && n_columns - prefix >= 3) {
 181                         if (n_columns - prefix > (unsigned) len + 3)
 182                                 fprintf(f, "%*s%s%.*s...%s\n",
 183                                         continuation * prefix, "",
 184                                         color_on, len, pos, color_off);
 185                         else {
 186                                 _cleanup_free_ char *e;
 187
 188                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 189                                                   tail_line ? 100 : 90);
 190                                 if (!e)
 191                                         fprintf(f, "%*s%s%.*s%s\n",
 192                                                 continuation * prefix, "",
 193                                                 color_on, len, pos, color_off);
 194                                 else
 195                                         fprintf(f, "%*s%s%s%s\n",
 196                                                 continuation * prefix, "",
 197                                                 color_on, e, color_off);
 198                         }
 199                 } else
 200                         fputs("...\n", f);
 201
 202                 if (tail_line)
 203                         break;
 204         }
 205
 206         return ellipsized;
 207 }
 208
 209 static int output_short(
 210                 FILE *f,
 211                 sd_journal *j,
 212                 OutputMode mode,
 213                 unsigned n_columns,
 214                 OutputFlags flags) {
 215
 216         int r;
 217         const void *data;
 218         size_t length;
 219         size_t n = 0;
 220         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
 221         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
 222         int p = LOG_INFO;
 223         bool ellipsized = false;
 224
 225         assert(f);
 226         assert(j);
 227
 228         /* Set the threshold to one bigger than the actual print
 229          * threshold, so that if the line is actually longer than what
 230          * we're willing to print, ellipsization will occur. This way
 231          * we won't output a misleading line without any indication of
 232          * truncation.
 233          */
 234         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 235
 236         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 237
 238                 r = parse_field(data, length, "PRIORITY=", &priority, &priority_len);
 239                 if (r < 0)
 240                         return r;
 241                 else if (r > 0)
 242                         continue;
 243
 244                 r = parse_field(data, length, "_HOSTNAME=", &hostname, &hostname_len);
 245                 if (r < 0)
 246                         return r;
 247                 else if (r > 0)
 248                         continue;
 249
 250                 r = parse_field(data, length, "SYSLOG_IDENTIFIER=", &identifier, &identifier_len);
 251                 if (r < 0)
 252                         return r;
 253                 else if (r > 0)
 254                         continue;
 255
 256                 r = parse_field(data, length, "_COMM=", &comm, &comm_len);
 257                 if (r < 0)
 258                         return r;
 259                 else if (r > 0)
 260                         continue;
 261
 262                 r = parse_field(data, length, "_PID=", &pid, &pid_len);
 263                 if (r < 0)
 264                         return r;
 265                 else if (r > 0)
 266                         continue;
 267
 268                 r = parse_field(data, length, "SYSLOG_PID=", &fake_pid, &fake_pid_len);
 269                 if (r < 0)
 270                         return r;
 271                 else if (r > 0)
 272                         continue;
 273
 274                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len);
 275                 if (r < 0)
 276                         return r;
 277                 else if (r > 0)
 278                         continue;
 279
 280                 r = parse_field(data, length, "_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len);
 281                 if (r < 0)
 282                         return r;
 283                 else if (r > 0)
 284                         continue;
 285
 286                 r = parse_field(data, length, "MESSAGE=", &message, &message_len);
 287                 if (r < 0)
 288                         return r;
 289         }
 290         if (r == -EBADMSG) {
 291                 log_debug_errno(r, "Skipping message we can't read: %m");
 292                 return 0;
 293         }
 294         if (r < 0)
 295                 return log_error_errno(r, "Failed to get journal fields: %m");
 296
 297         if (!message) {
 298                 log_debug("Skipping message without MESSAGE= field.");
 299                 return 0;
 300         }
 301
 302         if (!(flags & OUTPUT_SHOW_ALL))
 303                 strip_tab_ansi(&message, &message_len);
 304
 305         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 306                 p = *priority - '0';
 307
 308         if (mode == OUTPUT_SHORT_MONOTONIC) {
 309                 uint64_t t;
 310                 sd_id128_t boot_id;
 311
 312                 r = -ENOENT;
 313
 314                 if (monotonic)
 315                         r = safe_atou64(monotonic, &t);
 316
 317                 if (r < 0)
 318                         r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 319
 320                 if (r < 0)
 321                         return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 322
 323                 fprintf(f, "[%5llu.%06llu]",
 324                         (unsigned long long) (t / USEC_PER_SEC),
 325                         (unsigned long long) (t % USEC_PER_SEC));
 326
 327                 n += 1 + 5 + 1 + 6 + 1;
 328
 329         } else {
 330                 char buf[64];
 331                 uint64_t x;
 332                 time_t t;
 333                 struct tm tm;
 334                 struct tm *(*gettime_r)(const time_t *, struct tm *);
 335
 336                 r = -ENOENT;
 337                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 338
 339                 if (realtime)
 340                         r = safe_atou64(realtime, &x);
 341
 342                 if (r < 0)
 343                         r = sd_journal_get_realtime_usec(j, &x);
 344
 345                 if (r < 0)
 346                         return log_error_errno(r, "Failed to get realtime timestamp: %m");
 347
 348                 t = (time_t) (x / USEC_PER_SEC);
 349
 350                 switch (mode) {
 351
 352                 case OUTPUT_SHORT_UNIX:
 353                         r = snprintf(buf, sizeof(buf), "%10llu.%06llu", (unsigned long long) t, (unsigned long long) (x % USEC_PER_SEC));
 354                         break;
 355
 356                 case OUTPUT_SHORT_ISO:
 357                         r = strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm));
 358                         break;
 359
 360                 case OUTPUT_SHORT_PRECISE:
 361                         r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm));
 362                         if (r > 0)
 363                                 snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), ".%06llu", (unsigned long long) (x % USEC_PER_SEC));
 364                         break;
 365
 366                 default:
 367                         r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm));
 368                 }
 369
 370                 if (r <= 0) {
 371                         log_error("Failed to format time.");
 372                         return -EINVAL;
 373                 }
 374
 375                 fputs(buf, f);
 376                 n += strlen(buf);
 377         }
 378
 379         if (hostname && (flags & OUTPUT_NO_HOSTNAME)) {
 380                 /* Suppress display of the hostname if this is requested. */
 381                 hostname = NULL;
 382                 hostname_len = 0;
 383         }
 384
 385         if (hostname && shall_print(hostname, hostname_len, flags)) {
 386                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 387                 n += hostname_len + 1;
 388         }
 389
 390         if (identifier && shall_print(identifier, identifier_len, flags)) {
 391                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 392                 n += identifier_len + 1;
 393         } else if (comm && shall_print(comm, comm_len, flags)) {
 394                 fprintf(f, " %.*s", (int) comm_len, comm);
 395                 n += comm_len + 1;
 396         } else
 397                 fputs(" unknown", f);
 398
 399         if (pid && shall_print(pid, pid_len, flags)) {
 400                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 401                 n += pid_len + 2;
 402         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 403                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 404                 n += fake_pid_len + 2;
 405         }
 406
 407         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 408                 char bytes[FORMAT_BYTES_MAX];
 409                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 410         } else {
 411                 fputs(": ", f);
 412                 ellipsized |=
 413                         print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
 414         }
 415
 416         if (flags & OUTPUT_CATALOG)
 417                 print_catalog(f, j);
 418
 419         return ellipsized;
 420 }
 421
 422 static int output_verbose(
 423                 FILE *f,
 424                 sd_journal *j,
 425                 OutputMode mode,
 426                 unsigned n_columns,
 427                 OutputFlags flags) {
 428
 429         const void *data;
 430         size_t length;
 431         _cleanup_free_ char *cursor = NULL;
 432         uint64_t realtime = 0;
 433         char ts[FORMAT_TIMESTAMP_MAX + 7];
 434         int r;
 435
 436         assert(f);
 437         assert(j);
 438
 439         sd_journal_set_data_threshold(j, 0);
 440
 441         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 442         if (r == -ENOENT)
 443                 log_debug("Source realtime timestamp not found");
 444         else if (r < 0)
 445                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 446         else {
 447                 _cleanup_free_ char *value = NULL;
 448
 449                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &value, NULL);
 450                 if (r < 0)
 451                         return r;
 452                 assert(r > 0);
 453
 454                 r = safe_atou64(value, &realtime);
 455                 if (r < 0)
 456                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 457         }
 458
 459         if (r < 0) {
 460                 r = sd_journal_get_realtime_usec(j, &realtime);
 461                 if (r < 0)
 462                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 463         }
 464
 465         r = sd_journal_get_cursor(j, &cursor);
 466         if (r < 0)
 467                 return log_error_errno(r, "Failed to get cursor: %m");
 468
 469         fprintf(f, "%s [%s]\n",
 470                 flags & OUTPUT_UTC ?
 471                 format_timestamp_us_utc(ts, sizeof(ts), realtime) :
 472                 format_timestamp_us(ts, sizeof(ts), realtime),
 473                 cursor);
 474
 475         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 476                 const char *c;
 477                 int fieldlen;
 478                 const char *on = "", *off = "";
 479
 480                 c = memchr(data, '=', length);
 481                 if (!c) {
 482                         log_error("Invalid field.");
 483                         return -EINVAL;
 484                 }
 485                 fieldlen = c - (const char*) data;
 486
 487                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 488                         on = ANSI_HIGHLIGHT;
 489                         off = ANSI_NORMAL;
 490                 }
 491
 492                 if ((flags & OUTPUT_SHOW_ALL) ||
 493                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 494                      && utf8_is_printable(data, length))) {
 495                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 496                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
 497                         fputs(off, f);
 498                 } else {
 499                         char bytes[FORMAT_BYTES_MAX];
 500
 501                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 502                                 on,
 503                                 (int) (c - (const char*) data),
 504                                 (const char*) data,
 505                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 506                                 off);
 507                 }
 508         }
 509
 510         if (r < 0)
 511                 return r;
 512
 513         if (flags & OUTPUT_CATALOG)
 514                 print_catalog(f, j);
 515
 516         return 0;
 517 }
 518
 519 static int output_export(
 520                 FILE *f,
 521                 sd_journal *j,
 522                 OutputMode mode,
 523                 unsigned n_columns,
 524                 OutputFlags flags) {
 525
 526         sd_id128_t boot_id;
 527         char sid[33];
 528         int r;
 529         usec_t realtime, monotonic;
 530         _cleanup_free_ char *cursor = NULL;
 531         const void *data;
 532         size_t length;
 533
 534         assert(j);
 535
 536         sd_journal_set_data_threshold(j, 0);
 537
 538         r = sd_journal_get_realtime_usec(j, &realtime);
 539         if (r < 0)
 540                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 541
 542         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 543         if (r < 0)
 544                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 545
 546         r = sd_journal_get_cursor(j, &cursor);
 547         if (r < 0)
 548                 return log_error_errno(r, "Failed to get cursor: %m");
 549
 550         fprintf(f,
 551                 "__CURSOR=%s\n"
 552                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 553                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 554                 "_BOOT_ID=%s\n",
 555                 cursor,
 556                 realtime,
 557                 monotonic,
 558                 sd_id128_to_string(boot_id, sid));
 559
 560         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 561
 562                 /* We already printed the boot id, from the data in
 563                  * the header, hence let's suppress it here */
 564                 if (length >= 9 &&
 565                     startswith(data, "_BOOT_ID="))
 566                         continue;
 567
 568                 if (utf8_is_printable_newline(data, length, false))
 569                         fwrite(data, length, 1, f);
 570                 else {
 571                         const char *c;
 572                         uint64_t le64;
 573
 574                         c = memchr(data, '=', length);
 575                         if (!c) {
 576                                 log_error("Invalid field.");
 577                                 return -EINVAL;
 578                         }
 579
 580                         fwrite(data, c - (const char*) data, 1, f);
 581                         fputc('\n', f);
 582                         le64 = htole64(length - (c - (const char*) data) - 1);
 583                         fwrite(&le64, sizeof(le64), 1, f);
 584                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 585                 }
 586
 587                 fputc('\n', f);
 588         }
 589
 590         if (r < 0)
 591                 return r;
 592
 593         fputc('\n', f);
 594
 595         return 0;
 596 }
 597
 598 void json_escape(
 599                 FILE *f,
 600                 const char* p,
 601                 size_t l,
 602                 OutputFlags flags) {
 603
 604         assert(f);
 605         assert(p);
 606
 607         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 608                 fputs("null", f);
 609
 610         else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
 611                 bool not_first = false;
 612
 613                 fputs("[ ", f);
 614
 615                 while (l > 0) {
 616                         if (not_first)
 617                                 fprintf(f, ", %u", (uint8_t) *p);
 618                         else {
 619                                 not_first = true;
 620                                 fprintf(f, "%u", (uint8_t) *p);
 621                         }
 622
 623                         p++;
 624                         l--;
 625                 }
 626
 627                 fputs(" ]", f);
 628         } else {
 629                 fputc('\"', f);
 630
 631                 while (l > 0) {
 632                         if (*p == '"' || *p == '\\') {
 633                                 fputc('\\', f);
 634                                 fputc(*p, f);
 635                         } else if (*p == '\n')
 636                                 fputs("\\n", f);
 637                         else if ((uint8_t) *p < ' ')
 638                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 639                         else
 640                                 fputc(*p, f);
 641
 642                         p++;
 643                         l--;
 644                 }
 645
 646                 fputc('\"', f);
 647         }
 648 }
 649
 650 static int output_json(
 651                 FILE *f,
 652                 sd_journal *j,
 653                 OutputMode mode,
 654                 unsigned n_columns,
 655                 OutputFlags flags) {
 656
 657         uint64_t realtime, monotonic;
 658         _cleanup_free_ char *cursor = NULL;
 659         const void *data;
 660         size_t length;
 661         sd_id128_t boot_id;
 662         char sid[33], *k;
 663         int r;
 664         Hashmap *h = NULL;
 665         bool done, separator;
 666
 667         assert(j);
 668
 669         sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 670
 671         r = sd_journal_get_realtime_usec(j, &realtime);
 672         if (r < 0)
 673                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 674
 675         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 676         if (r < 0)
 677                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 678
 679         r = sd_journal_get_cursor(j, &cursor);
 680         if (r < 0)
 681                 return log_error_errno(r, "Failed to get cursor: %m");
 682
 683         if (mode == OUTPUT_JSON_PRETTY)
 684                 fprintf(f,
 685                         "{\n"
 686                         "\t\"__CURSOR\" : \"%s\",\n"
 687                         "\t\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\",\n"
 688                         "\t\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\",\n"
 689                         "\t\"_BOOT_ID\" : \"%s\"",
 690                         cursor,
 691                         realtime,
 692                         monotonic,
 693                         sd_id128_to_string(boot_id, sid));
 694         else {
 695                 if (mode == OUTPUT_JSON_SSE)
 696                         fputs("data: ", f);
 697
 698                 fprintf(f,
 699                         "{ \"__CURSOR\" : \"%s\", "
 700                         "\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\", "
 701                         "\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\", "
 702                         "\"_BOOT_ID\" : \"%s\"",
 703                         cursor,
 704                         realtime,
 705                         monotonic,
 706                         sd_id128_to_string(boot_id, sid));
 707         }
 708
 709         h = hashmap_new(&string_hash_ops);
 710         if (!h)
 711                 return log_oom();
 712
 713         /* First round, iterate through the entry and count how often each field appears */
 714         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 715                 const char *eq;
 716                 char *n;
 717                 unsigned u;
 718
 719                 if (length >= 9 &&
 720                     memcmp(data, "_BOOT_ID=", 9) == 0)
 721                         continue;
 722
 723                 eq = memchr(data, '=', length);
 724                 if (!eq)
 725                         continue;
 726
 727                 n = strndup(data, eq - (const char*) data);
 728                 if (!n) {
 729                         r = log_oom();
 730                         goto finish;
 731                 }
 732
 733                 u = PTR_TO_UINT(hashmap_get(h, n));
 734                 if (u == 0) {
 735                         r = hashmap_put(h, n, UINT_TO_PTR(1));
 736                         if (r < 0) {
 737                                 free(n);
 738                                 log_oom();
 739                                 goto finish;
 740                         }
 741                 } else {
 742                         r = hashmap_update(h, n, UINT_TO_PTR(u + 1));
 743                         free(n);
 744                         if (r < 0) {
 745                                 log_oom();
 746                                 goto finish;
 747                         }
 748                 }
 749         }
 750
 751         if (r < 0)
 752                 return r;
 753
 754         separator = true;
 755         do {
 756                 done = true;
 757
 758                 SD_JOURNAL_FOREACH_DATA(j, data, length) {
 759                         const char *eq;
 760                         char *kk, *n;
 761                         size_t m;
 762                         unsigned u;
 763
 764                         /* We already printed the boot id, from the data in
 765                          * the header, hence let's suppress it here */
 766                         if (length >= 9 &&
 767                             memcmp(data, "_BOOT_ID=", 9) == 0)
 768                                 continue;
 769
 770                         eq = memchr(data, '=', length);
 771                         if (!eq)
 772                                 continue;
 773
 774                         if (separator) {
 775                                 if (mode == OUTPUT_JSON_PRETTY)
 776                                         fputs(",\n\t", f);
 777                                 else
 778                                         fputs(", ", f);
 779                         }
 780
 781                         m = eq - (const char*) data;
 782
 783                         n = strndup(data, m);
 784                         if (!n) {
 785                                 r = log_oom();
 786                                 goto finish;
 787                         }
 788
 789                         u = PTR_TO_UINT(hashmap_get2(h, n, (void**) &kk));
 790                         if (u == 0) {
 791                                 /* We already printed this, let's jump to the next */
 792                                 free(n);
 793                                 separator = false;
 794
 795                                 continue;
 796                         } else if (u == 1) {
 797                                 /* Field only appears once, output it directly */
 798
 799                                 json_escape(f, data, m, flags);
 800                                 fputs(" : ", f);
 801
 802                                 json_escape(f, eq + 1, length - m - 1, flags);
 803
 804                                 hashmap_remove(h, n);
 805                                 free(kk);
 806                                 free(n);
 807
 808                                 separator = true;
 809
 810                                 continue;
 811
 812                         } else {
 813                                 /* Field appears multiple times, output it as array */
 814                                 json_escape(f, data, m, flags);
 815                                 fputs(" : [ ", f);
 816                                 json_escape(f, eq + 1, length - m - 1, flags);
 817
 818                                 /* Iterate through the end of the list */
 819
 820                                 while (sd_journal_enumerate_data(j, &data, &length) > 0) {
 821                                         if (length < m + 1)
 822                                                 continue;
 823
 824                                         if (memcmp(data, n, m) != 0)
 825                                                 continue;
 826
 827                                         if (((const char*) data)[m] != '=')
 828                                                 continue;
 829
 830                                         fputs(", ", f);
 831                                         json_escape(f, (const char*) data + m + 1, length - m - 1, flags);
 832                                 }
 833
 834                                 fputs(" ]", f);
 835
 836                                 hashmap_remove(h, n);
 837                                 free(kk);
 838                                 free(n);
 839
 840                                 /* Iterate data fields form the beginning */
 841                                 done = false;
 842                                 separator = true;
 843
 844                                 break;
 845                         }
 846                 }
 847
 848         } while (!done);
 849
 850         if (mode == OUTPUT_JSON_PRETTY)
 851                 fputs("\n}\n", f);
 852         else if (mode == OUTPUT_JSON_SSE)
 853                 fputs("}\n\n", f);
 854         else
 855                 fputs(" }\n", f);
 856
 857         r = 0;
 858
 859 finish:
 860         while ((k = hashmap_steal_first_key(h)))
 861                 free(k);
 862
 863         hashmap_free(h);
 864
 865         return r;
 866 }
 867
 868 static int output_cat(
 869                 FILE *f,
 870                 sd_journal *j,
 871                 OutputMode mode,
 872                 unsigned n_columns,
 873                 OutputFlags flags) {
 874
 875         const void *data;
 876         size_t l;
 877         int r;
 878
 879         assert(j);
 880         assert(f);
 881
 882         sd_journal_set_data_threshold(j, 0);
 883
 884         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
 885         if (r < 0) {
 886                 /* An entry without MESSAGE=? */
 887                 if (r == -ENOENT)
 888                         return 0;
 889
 890                 return log_error_errno(r, "Failed to get data: %m");
 891         }
 892
 893         assert(l >= 8);
 894
 895         fwrite((const char*) data + 8, 1, l - 8, f);
 896         fputc('\n', f);
 897
 898         return 0;
 899 }
 900
 901 static int (*output_funcs[_OUTPUT_MODE_MAX])(
 902                 FILE *f,
 903                 sd_journal*j,
 904                 OutputMode mode,
 905                 unsigned n_columns,
 906                 OutputFlags flags) = {
 907
 908         [OUTPUT_SHORT] = output_short,
 909         [OUTPUT_SHORT_ISO] = output_short,
 910         [OUTPUT_SHORT_PRECISE] = output_short,
 911         [OUTPUT_SHORT_MONOTONIC] = output_short,
 912         [OUTPUT_SHORT_UNIX] = output_short,
 913         [OUTPUT_VERBOSE] = output_verbose,
 914         [OUTPUT_EXPORT] = output_export,
 915         [OUTPUT_JSON] = output_json,
 916         [OUTPUT_JSON_PRETTY] = output_json,
 917         [OUTPUT_JSON_SSE] = output_json,
 918         [OUTPUT_CAT] = output_cat
 919 };
 920
 921 int output_journal(
 922                 FILE *f,
 923                 sd_journal *j,
 924                 OutputMode mode,
 925                 unsigned n_columns,
 926                 OutputFlags flags,
 927                 bool *ellipsized) {
 928
 929         int ret;
 930         assert(mode >= 0);
 931         assert(mode < _OUTPUT_MODE_MAX);
 932
 933         if (n_columns <= 0)
 934                 n_columns = columns();
 935
 936         ret = output_funcs[mode](f, j, mode, n_columns, flags);
 937         fflush(stdout);
 938
 939         if (ellipsized && ret > 0)
 940                 *ellipsized = true;
 941
 942         return ret;
 943 }
 944
 945 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
 946         assert(f);
 947         assert(flags);
 948
 949         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
 950                 return 0;
 951
 952         /* Print a beginning new line if that's request, but only once
 953          * on the first line we print. */
 954
 955         fputc('\n', f);
 956         *flags &= ~OUTPUT_BEGIN_NEWLINE;
 957         return 0;
 958 }
 959
 960 static int show_journal(FILE *f,
 961                         sd_journal *j,
 962                         OutputMode mode,
 963                         unsigned n_columns,
 964                         usec_t not_before,
 965                         unsigned how_many,
 966                         OutputFlags flags,
 967                         bool *ellipsized) {
 968
 969         int r;
 970         unsigned line = 0;
 971         bool need_seek = false;
 972         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
 973
 974         assert(j);
 975         assert(mode >= 0);
 976         assert(mode < _OUTPUT_MODE_MAX);
 977
 978         /* Seek to end */
 979         r = sd_journal_seek_tail(j);
 980         if (r < 0)
 981                 return log_error_errno(r, "Failed to seek to tail: %m");
 982
 983         r = sd_journal_previous_skip(j, how_many);
 984         if (r < 0)
 985                 return log_error_errno(r, "Failed to skip previous: %m");
 986
 987         for (;;) {
 988                 for (;;) {
 989                         usec_t usec;
 990
 991                         if (need_seek) {
 992                                 r = sd_journal_next(j);
 993                                 if (r < 0)
 994                                         return log_error_errno(r, "Failed to iterate through journal: %m");
 995                         }
 996
 997                         if (r == 0)
 998                                 break;
 999
1000                         need_seek = true;
1001
1002                         if (not_before > 0) {
1003                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1004
1005                                 /* -ESTALE is returned if the
1006                                    timestamp is not from this boot */
1007                                 if (r == -ESTALE)
1008                                         continue;
1009                                 else if (r < 0)
1010                                         return log_error_errno(r, "Failed to get journal time: %m");
1011
1012                                 if (usec < not_before)
1013                                         continue;
1014                         }
1015
1016                         line++;
1017                         maybe_print_begin_newline(f, &flags);
1018
1019                         r = output_journal(f, j, mode, n_columns, flags, ellipsized);
1020                         if (r < 0)
1021                                 return r;
1022                 }
1023
1024                 if (warn_cutoff && line < how_many && not_before > 0) {
1025                         sd_id128_t boot_id;
1026                         usec_t cutoff = 0;
1027
1028                         /* Check whether the cutoff line is too early */
1029
1030                         r = sd_id128_get_boot(&boot_id);
1031                         if (r < 0)
1032                                 return log_error_errno(r, "Failed to get boot id: %m");
1033
1034                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1035                         if (r < 0)
1036                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1037
1038                         if (r > 0 && not_before < cutoff) {
1039                                 maybe_print_begin_newline(f, &flags);
1040                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1041                         }
1042
1043                         warn_cutoff = false;
1044                 }
1045
1046                 if (!(flags & OUTPUT_FOLLOW))
1047                         break;
1048
1049                 r = sd_journal_wait(j, USEC_INFINITY);
1050                 if (r < 0)
1051                         return log_error_errno(r, "Failed to wait for journal: %m");
1052
1053         }
1054
1055         return 0;
1056 }
1057
1058 int add_matches_for_unit(sd_journal *j, const char *unit) {
1059         const char *m1, *m2, *m3, *m4;
1060         int r;
1061
1062         assert(j);
1063         assert(unit);
1064
1065         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1066         m2 = strjoina("COREDUMP_UNIT=", unit);
1067         m3 = strjoina("UNIT=", unit);
1068         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1069
1070         (void)(
1071             /* Look for messages from the service itself */
1072             (r = sd_journal_add_match(j, m1, 0)) ||
1073
1074             /* Look for coredumps of the service */
1075             (r = sd_journal_add_disjunction(j)) ||
1076             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1077             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1078             (r = sd_journal_add_match(j, m2, 0)) ||
1079
1080              /* Look for messages from PID 1 about this service */
1081             (r = sd_journal_add_disjunction(j)) ||
1082             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1083             (r = sd_journal_add_match(j, m3, 0)) ||
1084
1085             /* Look for messages from authorized daemons about this service */
1086             (r = sd_journal_add_disjunction(j)) ||
1087             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1088             (r = sd_journal_add_match(j, m4, 0))
1089         );
1090
1091         if (r == 0 && endswith(unit, ".slice")) {
1092                 const char *m5;
1093
1094                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1095
1096                 /* Show all messages belonging to a slice */
1097                 (void)(
1098                         (r = sd_journal_add_disjunction(j)) ||
1099                         (r = sd_journal_add_match(j, m5, 0))
1100                         );
1101         }
1102
1103         return r;
1104 }
1105
1106 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1107         int r;
1108         char *m1, *m2, *m3, *m4;
1109         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1110
1111         assert(j);
1112         assert(unit);
1113
1114         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1115         m2 = strjoina("USER_UNIT=", unit);
1116         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1117         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1118         sprintf(muid, "_UID="UID_FMT, uid);
1119
1120         (void) (
1121                 /* Look for messages from the user service itself */
1122                 (r = sd_journal_add_match(j, m1, 0)) ||
1123                 (r = sd_journal_add_match(j, muid, 0)) ||
1124
1125                 /* Look for messages from systemd about this service */
1126                 (r = sd_journal_add_disjunction(j)) ||
1127                 (r = sd_journal_add_match(j, m2, 0)) ||
1128                 (r = sd_journal_add_match(j, muid, 0)) ||
1129
1130                 /* Look for coredumps of the service */
1131                 (r = sd_journal_add_disjunction(j)) ||
1132                 (r = sd_journal_add_match(j, m3, 0)) ||
1133                 (r = sd_journal_add_match(j, muid, 0)) ||
1134                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1135
1136                 /* Look for messages from authorized daemons about this service */
1137                 (r = sd_journal_add_disjunction(j)) ||
1138                 (r = sd_journal_add_match(j, m4, 0)) ||
1139                 (r = sd_journal_add_match(j, muid, 0)) ||
1140                 (r = sd_journal_add_match(j, "_UID=0", 0))
1141         );
1142
1143         if (r == 0 && endswith(unit, ".slice")) {
1144                 const char *m5;
1145
1146                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1147
1148                 /* Show all messages belonging to a slice */
1149                 (void)(
1150                         (r = sd_journal_add_disjunction(j)) ||
1151                         (r = sd_journal_add_match(j, m5, 0)) ||
1152                         (r = sd_journal_add_match(j, muid, 0))
1153                         );
1154         }
1155
1156         return r;
1157 }
1158
1159 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1160         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1161         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1162         pid_t pid, child;
1163         siginfo_t si;
1164         char buf[37];
1165         ssize_t k;
1166         int r;
1167
1168         assert(machine);
1169         assert(boot_id);
1170
1171         if (!machine_name_is_valid(machine))
1172                 return -EINVAL;
1173
1174         r = container_get_leader(machine, &pid);
1175         if (r < 0)
1176                 return r;
1177
1178         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1179         if (r < 0)
1180                 return r;
1181
1182         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1183                 return -errno;
1184
1185         child = fork();
1186         if (child < 0)
1187                 return -errno;
1188
1189         if (child == 0) {
1190                 int fd;
1191
1192                 pair[0] = safe_close(pair[0]);
1193
1194                 r = namespace_enter(pidnsfd, mntnsfd, -1, -1, rootfd);
1195                 if (r < 0)
1196                         _exit(EXIT_FAILURE);
1197
1198                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1199                 if (fd < 0)
1200                         _exit(EXIT_FAILURE);
1201
1202                 r = loop_read_exact(fd, buf, 36, false);
1203                 safe_close(fd);
1204                 if (r < 0)
1205                         _exit(EXIT_FAILURE);
1206
1207                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1208                 if (k != 36)
1209                         _exit(EXIT_FAILURE);
1210
1211                 _exit(EXIT_SUCCESS);
1212         }
1213
1214         pair[1] = safe_close(pair[1]);
1215
1216         r = wait_for_terminate(child, &si);
1217         if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS)
1218                 return r < 0 ? r : -EIO;
1219
1220         k = recv(pair[0], buf, 36, 0);
1221         if (k != 36)
1222                 return -EIO;
1223
1224         buf[36] = 0;
1225         r = sd_id128_from_string(buf, boot_id);
1226         if (r < 0)
1227                 return r;
1228
1229         return 0;
1230 }
1231
1232 int add_match_this_boot(sd_journal *j, const char *machine) {
1233         char match[9+32+1] = "_BOOT_ID=";
1234         sd_id128_t boot_id;
1235         int r;
1236
1237         assert(j);
1238
1239         if (machine) {
1240                 r = get_boot_id_for_machine(machine, &boot_id);
1241                 if (r < 0)
1242                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1243         } else {
1244                 r = sd_id128_get_boot(&boot_id);
1245                 if (r < 0)
1246                         return log_error_errno(r, "Failed to get boot id: %m");
1247         }
1248
1249         sd_id128_to_string(boot_id, match + 9);
1250         r = sd_journal_add_match(j, match, strlen(match));
1251         if (r < 0)
1252                 return log_error_errno(r, "Failed to add match: %m");
1253
1254         r = sd_journal_add_conjunction(j);
1255         if (r < 0)
1256                 return log_error_errno(r, "Failed to add conjunction: %m");
1257
1258         return 0;
1259 }
1260
1261 int show_journal_by_unit(
1262                 FILE *f,
1263                 const char *unit,
1264                 OutputMode mode,
1265                 unsigned n_columns,
1266                 usec_t not_before,
1267                 unsigned how_many,
1268                 uid_t uid,
1269                 OutputFlags flags,
1270                 int journal_open_flags,
1271                 bool system_unit,
1272                 bool *ellipsized) {
1273
1274         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1275         int r;
1276
1277         assert(mode >= 0);
1278         assert(mode < _OUTPUT_MODE_MAX);
1279         assert(unit);
1280
1281         if (how_many <= 0)
1282                 return 0;
1283
1284         r = sd_journal_open(&j, journal_open_flags);
1285         if (r < 0)
1286                 return log_error_errno(r, "Failed to open journal: %m");
1287
1288         r = add_match_this_boot(j, NULL);
1289         if (r < 0)
1290                 return r;
1291
1292         if (system_unit)
1293                 r = add_matches_for_unit(j, unit);
1294         else
1295                 r = add_matches_for_user_unit(j, unit, uid);
1296         if (r < 0)
1297                 return log_error_errno(r, "Failed to add unit matches: %m");
1298
1299         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1300                 _cleanup_free_ char *filter;
1301
1302                 filter = journal_make_match_string(j);
1303                 if (!filter)
1304                         return log_oom();
1305
1306                 log_debug("Journal filter: %s", filter);
1307         }
1308
1309         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1310 }