src/shared/logs-show.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <signal.h>
  23 #include <stdint.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <syslog.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32 #include "sd-journal.h"
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "format-util.h"
  37 #include "hashmap.h"
  38 #include "hostname-util.h"
  39 #include "io-util.h"
  40 #include "journal-internal.h"
  41 #include "log.h"
  42 #include "logs-show.h"
  43 #include "macro.h"
  44 #include "output-mode.h"
  45 #include "parse-util.h"
  46 #include "process-util.h"
  47 #include "sparse-endian.h"
  48 #include "stdio-util.h"
  49 #include "string-table.h"
  50 #include "string-util.h"
  51 #include "terminal-util.h"
  52 #include "time-util.h"
  53 #include "utf8.h"
  54 #include "util.h"
  55
  56 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  57 #define PRINT_LINE_THRESHOLD 3
  58 #define PRINT_CHAR_THRESHOLD 300
  59
  60 #define JSON_THRESHOLD 4096
  61
  62 static int print_catalog(FILE *f, sd_journal *j) {
  63         int r;
  64         _cleanup_free_ char *t = NULL, *z = NULL;
  65
  66
  67         r = sd_journal_get_catalog(j, &t);
  68         if (r < 0)
  69                 return r;
  70
  71         z = strreplace(strstrip(t), "\n", "\n-- ");
  72         if (!z)
  73                 return log_oom();
  74
  75         fputs("-- ", f);
  76         fputs(z, f);
  77         fputc('\n', f);
  78
  79         return 0;
  80 }
  81
  82 static int parse_field(const void *data, size_t length, const char *field, char **target, size_t *target_size) {
  83         size_t fl, nl;
  84         char *buf;
  85
  86         assert(data);
  87         assert(field);
  88         assert(target);
  89
  90         fl = strlen(field);
  91         if (length < fl)
  92                 return 0;
  93
  94         if (memcmp(data, field, fl))
  95                 return 0;
  96
  97         nl = length - fl;
  98         buf = new(char, nl+1);
  99         if (!buf)
 100                 return log_oom();
 101
 102         memcpy(buf, (const char*) data + fl, nl);
 103         buf[nl] = 0;
 104
 105         free(*target);
 106         *target = buf;
 107
 108         if (target_size)
 109                 *target_size = nl;
 110
 111         return 1;
 112 }
 113
 114 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 115         assert(p);
 116
 117         if (flags & OUTPUT_SHOW_ALL)
 118                 return true;
 119
 120         if (l >= PRINT_CHAR_THRESHOLD)
 121                 return false;
 122
 123         if (!utf8_is_printable(p, l))
 124                 return false;
 125
 126         return true;
 127 }
 128
 129 static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
 130         const char *color_on = "", *color_off = "";
 131         const char *pos, *end;
 132         bool ellipsized = false;
 133         int line = 0;
 134
 135         if (flags & OUTPUT_COLOR) {
 136                 if (priority <= LOG_ERR) {
 137                         color_on = ANSI_HIGHLIGHT_RED;
 138                         color_off = ANSI_NORMAL;
 139                 } else if (priority <= LOG_NOTICE) {
 140                         color_on = ANSI_HIGHLIGHT;
 141                         color_off = ANSI_NORMAL;
 142                 }
 143         }
 144
 145         /* A special case: make sure that we print a newline when
 146            the message is empty. */
 147         if (message_len == 0)
 148                 fputs("\n", f);
 149
 150         for (pos = message;
 151              pos < message + message_len;
 152              pos = end + 1, line++) {
 153                 bool continuation = line > 0;
 154                 bool tail_line;
 155                 int len;
 156                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 157                         ;
 158                 len = end - pos;
 159                 assert(len >= 0);
 160
 161                 /* We need to figure out when we are showing not-last line, *and*
 162                  * will skip subsequent lines. In that case, we will put the dots
 163                  * at the end of the line, instead of putting dots in the middle
 164                  * or not at all.
 165                  */
 166                 tail_line =
 167                         line + 1 == PRINT_LINE_THRESHOLD ||
 168                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 169
 170                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 171                     (prefix + len + 1 < n_columns && !tail_line)) {
 172                         fprintf(f, "%*s%s%.*s%s\n",
 173                                 continuation * prefix, "",
 174                                 color_on, len, pos, color_off);
 175                         continue;
 176                 }
 177
 178                 /* Beyond this point, ellipsization will happen. */
 179                 ellipsized = true;
 180
 181                 if (prefix < n_columns && n_columns - prefix >= 3) {
 182                         if (n_columns - prefix > (unsigned) len + 3)
 183                                 fprintf(f, "%*s%s%.*s...%s\n",
 184                                         continuation * prefix, "",
 185                                         color_on, len, pos, color_off);
 186                         else {
 187                                 _cleanup_free_ char *e;
 188
 189                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 190                                                   tail_line ? 100 : 90);
 191                                 if (!e)
 192                                         fprintf(f, "%*s%s%.*s%s\n",
 193                                                 continuation * prefix, "",
 194                                                 color_on, len, pos, color_off);
 195                                 else
 196                                         fprintf(f, "%*s%s%s%s\n",
 197                                                 continuation * prefix, "",
 198                                                 color_on, e, color_off);
 199                         }
 200                 } else
 201                         fputs("...\n", f);
 202
 203                 if (tail_line)
 204                         break;
 205         }
 206
 207         return ellipsized;
 208 }
 209
 210 static int output_timestamp_monotonic(FILE *f, sd_journal *j, const char *monotonic) {
 211         sd_id128_t boot_id;
 212         uint64_t t;
 213         int r;
 214
 215         assert(f);
 216         assert(j);
 217
 218         r = -ENXIO;
 219         if (monotonic)
 220                 r = safe_atou64(monotonic, &t);
 221         if (r < 0)
 222                 r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 223         if (r < 0)
 224                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 225
 226         fprintf(f, "[%5"PRI_USEC".%06"PRI_USEC"]", t / USEC_PER_SEC, t % USEC_PER_SEC);
 227         return 1 + 5 + 1 + 6 + 1;
 228 }
 229
 230 static int output_timestamp_realtime(FILE *f, sd_journal *j, OutputMode mode, OutputFlags flags, const char *realtime) {
 231         char buf[MAX(FORMAT_TIMESTAMP_MAX, 64)];
 232         struct tm *(*gettime_r)(const time_t *, struct tm *);
 233         struct tm tm;
 234         uint64_t x;
 235         time_t t;
 236         int r;
 237
 238         assert(f);
 239         assert(j);
 240
 241         r = -ENXIO;
 242         if (realtime)
 243                 r = safe_atou64(realtime, &x);
 244         if (r < 0)
 245                 r = sd_journal_get_realtime_usec(j, &x);
 246         if (r < 0)
 247                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 248
 249         if (x > USEC_TIMESTAMP_FORMATTABLE_MAX) {
 250                 log_error("Timestamp cannot be printed");
 251                 return -EINVAL;
 252         }
 253
 254         if (mode == OUTPUT_SHORT_FULL) {
 255                 const char *k;
 256
 257                 if (flags & OUTPUT_UTC)
 258                         k = format_timestamp_utc(buf, sizeof(buf), x);
 259                 else
 260                         k = format_timestamp(buf, sizeof(buf), x);
 261                 if (!k) {
 262                         log_error("Failed to format timestamp.");
 263                         return -EINVAL;
 264                 }
 265
 266         } else {
 267                 char usec[7];
 268
 269                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 270                 t = (time_t) (x / USEC_PER_SEC);
 271
 272                 switch (mode) {
 273
 274                 case OUTPUT_SHORT_UNIX:
 275                         xsprintf(buf, "%10"PRI_TIME".%06"PRIu64, t, x % USEC_PER_SEC);
 276                         break;
 277
 278                 case OUTPUT_SHORT_ISO:
 279                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm)) <= 0) {
 280                                 log_error("Failed to format ISO time");
 281                                 return -EINVAL;
 282                         }
 283                         break;
 284
 285                 case OUTPUT_SHORT_ISO_PRECISE:
 286                         /* No usec in strftime, so we leave space and copy over */
 287                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S.xxxxxx%z", gettime_r(&t, &tm)) <= 0) {
 288                                 log_error("Failed to format ISO-precise time");
 289                                 return -EINVAL;
 290                         }
 291                         xsprintf(usec, "%06"PRI_USEC, x % USEC_PER_SEC);
 292                         memcpy(buf + 20, usec, 6);
 293                         break;
 294
 295                 case OUTPUT_SHORT:
 296                 case OUTPUT_SHORT_PRECISE:
 297
 298                         if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm)) <= 0) {
 299                                 log_error("Failed to format syslog time");
 300                                 return -EINVAL;
 301                         }
 302
 303                         if (mode == OUTPUT_SHORT_PRECISE) {
 304                                 size_t k;
 305
 306                                 assert(sizeof(buf) > strlen(buf));
 307                                 k = sizeof(buf) - strlen(buf);
 308
 309                                 r = snprintf(buf + strlen(buf), k, ".%06"PRIu64, x % USEC_PER_SEC);
 310                                 if (r <= 0 || (size_t) r >= k) { /* too long? */
 311                                         log_error("Failed to format precise time");
 312                                         return -EINVAL;
 313                                 }
 314                         }
 315                         break;
 316
 317                 default:
 318                         assert_not_reached("Unknown time format");
 319                 }
 320         }
 321
 322         fputs(buf, f);
 323         return (int) strlen(buf);
 324 }
 325
 326 static int output_short(
 327                 FILE *f,
 328                 sd_journal *j,
 329                 OutputMode mode,
 330                 unsigned n_columns,
 331                 OutputFlags flags) {
 332
 333         int r;
 334         const void *data;
 335         size_t length;
 336         size_t n = 0;
 337         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
 338         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
 339         int p = LOG_INFO;
 340         bool ellipsized = false;
 341
 342         assert(f);
 343         assert(j);
 344
 345         /* Set the threshold to one bigger than the actual print
 346          * threshold, so that if the line is actually longer than what
 347          * we're willing to print, ellipsization will occur. This way
 348          * we won't output a misleading line without any indication of
 349          * truncation.
 350          */
 351         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 352
 353         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 354
 355                 r = parse_field(data, length, "PRIORITY=", &priority, &priority_len);
 356                 if (r < 0)
 357                         return r;
 358                 else if (r > 0)
 359                         continue;
 360
 361                 r = parse_field(data, length, "_HOSTNAME=", &hostname, &hostname_len);
 362                 if (r < 0)
 363                         return r;
 364                 else if (r > 0)
 365                         continue;
 366
 367                 r = parse_field(data, length, "SYSLOG_IDENTIFIER=", &identifier, &identifier_len);
 368                 if (r < 0)
 369                         return r;
 370                 else if (r > 0)
 371                         continue;
 372
 373                 r = parse_field(data, length, "_COMM=", &comm, &comm_len);
 374                 if (r < 0)
 375                         return r;
 376                 else if (r > 0)
 377                         continue;
 378
 379                 r = parse_field(data, length, "_PID=", &pid, &pid_len);
 380                 if (r < 0)
 381                         return r;
 382                 else if (r > 0)
 383                         continue;
 384
 385                 r = parse_field(data, length, "SYSLOG_PID=", &fake_pid, &fake_pid_len);
 386                 if (r < 0)
 387                         return r;
 388                 else if (r > 0)
 389                         continue;
 390
 391                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len);
 392                 if (r < 0)
 393                         return r;
 394                 else if (r > 0)
 395                         continue;
 396
 397                 r = parse_field(data, length, "_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len);
 398                 if (r < 0)
 399                         return r;
 400                 else if (r > 0)
 401                         continue;
 402
 403                 r = parse_field(data, length, "MESSAGE=", &message, &message_len);
 404                 if (r < 0)
 405                         return r;
 406         }
 407         if (r == -EBADMSG) {
 408                 log_debug_errno(r, "Skipping message we can't read: %m");
 409                 return 0;
 410         }
 411         if (r < 0)
 412                 return log_error_errno(r, "Failed to get journal fields: %m");
 413
 414         if (!message) {
 415                 log_debug("Skipping message without MESSAGE= field.");
 416                 return 0;
 417         }
 418
 419         if (!(flags & OUTPUT_SHOW_ALL))
 420                 strip_tab_ansi(&message, &message_len);
 421
 422         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 423                 p = *priority - '0';
 424
 425         if (mode == OUTPUT_SHORT_MONOTONIC)
 426                 r = output_timestamp_monotonic(f, j, monotonic);
 427         else
 428                 r = output_timestamp_realtime(f, j, mode, flags, realtime);
 429         if (r < 0)
 430                 return r;
 431         n += r;
 432
 433         if (flags & OUTPUT_NO_HOSTNAME) {
 434                 /* Suppress display of the hostname if this is requested. */
 435                 hostname = mfree(hostname);
 436                 hostname_len = 0;
 437         }
 438
 439         if (hostname && shall_print(hostname, hostname_len, flags)) {
 440                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 441                 n += hostname_len + 1;
 442         }
 443
 444         if (identifier && shall_print(identifier, identifier_len, flags)) {
 445                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 446                 n += identifier_len + 1;
 447         } else if (comm && shall_print(comm, comm_len, flags)) {
 448                 fprintf(f, " %.*s", (int) comm_len, comm);
 449                 n += comm_len + 1;
 450         } else
 451                 fputs(" unknown", f);
 452
 453         if (pid && shall_print(pid, pid_len, flags)) {
 454                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 455                 n += pid_len + 2;
 456         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 457                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 458                 n += fake_pid_len + 2;
 459         }
 460
 461         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 462                 char bytes[FORMAT_BYTES_MAX];
 463                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 464         } else {
 465                 fputs(": ", f);
 466                 ellipsized |=
 467                         print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
 468         }
 469
 470         if (flags & OUTPUT_CATALOG)
 471                 print_catalog(f, j);
 472
 473         return ellipsized;
 474 }
 475
 476 static int output_verbose(
 477                 FILE *f,
 478                 sd_journal *j,
 479                 OutputMode mode,
 480                 unsigned n_columns,
 481                 OutputFlags flags) {
 482
 483         const void *data;
 484         size_t length;
 485         _cleanup_free_ char *cursor = NULL;
 486         uint64_t realtime = 0;
 487         char ts[FORMAT_TIMESTAMP_MAX + 7];
 488         const char *timestamp;
 489         int r;
 490
 491         assert(f);
 492         assert(j);
 493
 494         sd_journal_set_data_threshold(j, 0);
 495
 496         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 497         if (r == -ENOENT)
 498                 log_debug("Source realtime timestamp not found");
 499         else if (r < 0)
 500                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 501         else {
 502                 _cleanup_free_ char *value = NULL;
 503
 504                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &value, NULL);
 505                 if (r < 0)
 506                         return r;
 507                 assert(r > 0);
 508
 509                 r = safe_atou64(value, &realtime);
 510                 if (r < 0)
 511                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 512         }
 513
 514         if (r < 0) {
 515                 r = sd_journal_get_realtime_usec(j, &realtime);
 516                 if (r < 0)
 517                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 518         }
 519
 520         r = sd_journal_get_cursor(j, &cursor);
 521         if (r < 0)
 522                 return log_error_errno(r, "Failed to get cursor: %m");
 523
 524         timestamp = flags & OUTPUT_UTC ? format_timestamp_us_utc(ts, sizeof ts, realtime)
 525                                        : format_timestamp_us(ts, sizeof ts, realtime);
 526         fprintf(f, "%s [%s]\n",
 527                 timestamp ?: "(no timestamp)",
 528                 cursor);
 529
 530         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 531                 const char *c;
 532                 int fieldlen;
 533                 const char *on = "", *off = "";
 534
 535                 c = memchr(data, '=', length);
 536                 if (!c) {
 537                         log_error("Invalid field.");
 538                         return -EINVAL;
 539                 }
 540                 fieldlen = c - (const char*) data;
 541
 542                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 543                         on = ANSI_HIGHLIGHT;
 544                         off = ANSI_NORMAL;
 545                 }
 546
 547                 if ((flags & OUTPUT_SHOW_ALL) ||
 548                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 549                      && utf8_is_printable(data, length))) {
 550                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 551                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
 552                         fputs(off, f);
 553                 } else {
 554                         char bytes[FORMAT_BYTES_MAX];
 555
 556                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 557                                 on,
 558                                 (int) (c - (const char*) data),
 559                                 (const char*) data,
 560                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 561                                 off);
 562                 }
 563         }
 564
 565         if (r < 0)
 566                 return r;
 567
 568         if (flags & OUTPUT_CATALOG)
 569                 print_catalog(f, j);
 570
 571         return 0;
 572 }
 573
 574 static int output_export(
 575                 FILE *f,
 576                 sd_journal *j,
 577                 OutputMode mode,
 578                 unsigned n_columns,
 579                 OutputFlags flags) {
 580
 581         sd_id128_t boot_id;
 582         char sid[33];
 583         int r;
 584         usec_t realtime, monotonic;
 585         _cleanup_free_ char *cursor = NULL;
 586         const void *data;
 587         size_t length;
 588
 589         assert(j);
 590
 591         sd_journal_set_data_threshold(j, 0);
 592
 593         r = sd_journal_get_realtime_usec(j, &realtime);
 594         if (r < 0)
 595                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 596
 597         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 598         if (r < 0)
 599                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 600
 601         r = sd_journal_get_cursor(j, &cursor);
 602         if (r < 0)
 603                 return log_error_errno(r, "Failed to get cursor: %m");
 604
 605         fprintf(f,
 606                 "__CURSOR=%s\n"
 607                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 608                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 609                 "_BOOT_ID=%s\n",
 610                 cursor,
 611                 realtime,
 612                 monotonic,
 613                 sd_id128_to_string(boot_id, sid));
 614
 615         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 616
 617                 /* We already printed the boot id, from the data in
 618                  * the header, hence let's suppress it here */
 619                 if (length >= 9 &&
 620                     startswith(data, "_BOOT_ID="))
 621                         continue;
 622
 623                 if (utf8_is_printable_newline(data, length, false))
 624                         fwrite(data, length, 1, f);
 625                 else {
 626                         const char *c;
 627                         uint64_t le64;
 628
 629                         c = memchr(data, '=', length);
 630                         if (!c) {
 631                                 log_error("Invalid field.");
 632                                 return -EINVAL;
 633                         }
 634
 635                         fwrite(data, c - (const char*) data, 1, f);
 636                         fputc('\n', f);
 637                         le64 = htole64(length - (c - (const char*) data) - 1);
 638                         fwrite(&le64, sizeof(le64), 1, f);
 639                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 640                 }
 641
 642                 fputc('\n', f);
 643         }
 644
 645         if (r < 0)
 646                 return r;
 647
 648         fputc('\n', f);
 649
 650         return 0;
 651 }
 652
 653 void json_escape(
 654                 FILE *f,
 655                 const char* p,
 656                 size_t l,
 657                 OutputFlags flags) {
 658
 659         assert(f);
 660         assert(p);
 661
 662         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 663                 fputs("null", f);
 664
 665         else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
 666                 bool not_first = false;
 667
 668                 fputs("[ ", f);
 669
 670                 while (l > 0) {
 671                         if (not_first)
 672                                 fprintf(f, ", %u", (uint8_t) *p);
 673                         else {
 674                                 not_first = true;
 675                                 fprintf(f, "%u", (uint8_t) *p);
 676                         }
 677
 678                         p++;
 679                         l--;
 680                 }
 681
 682                 fputs(" ]", f);
 683         } else {
 684                 fputc('\"', f);
 685
 686                 while (l > 0) {
 687                         if (*p == '"' || *p == '\\') {
 688                                 fputc('\\', f);
 689                                 fputc(*p, f);
 690                         } else if (*p == '\n')
 691                                 fputs("\\n", f);
 692                         else if ((uint8_t) *p < ' ')
 693                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 694                         else
 695                                 fputc(*p, f);
 696
 697                         p++;
 698                         l--;
 699                 }
 700
 701                 fputc('\"', f);
 702         }
 703 }
 704
 705 static int output_json(
 706                 FILE *f,
 707                 sd_journal *j,
 708                 OutputMode mode,
 709                 unsigned n_columns,
 710                 OutputFlags flags) {
 711
 712         uint64_t realtime, monotonic;
 713         _cleanup_free_ char *cursor = NULL;
 714         const void *data;
 715         size_t length;
 716         sd_id128_t boot_id;
 717         char sid[33], *k;
 718         int r;
 719         Hashmap *h = NULL;
 720         bool done, separator;
 721
 722         assert(j);
 723
 724         sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 725
 726         r = sd_journal_get_realtime_usec(j, &realtime);
 727         if (r < 0)
 728                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 729
 730         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 731         if (r < 0)
 732                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 733
 734         r = sd_journal_get_cursor(j, &cursor);
 735         if (r < 0)
 736                 return log_error_errno(r, "Failed to get cursor: %m");
 737
 738         if (mode == OUTPUT_JSON_PRETTY)
 739                 fprintf(f,
 740                         "{\n"
 741                         "\t\"__CURSOR\" : \"%s\",\n"
 742                         "\t\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\",\n"
 743                         "\t\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\",\n"
 744                         "\t\"_BOOT_ID\" : \"%s\"",
 745                         cursor,
 746                         realtime,
 747                         monotonic,
 748                         sd_id128_to_string(boot_id, sid));
 749         else {
 750                 if (mode == OUTPUT_JSON_SSE)
 751                         fputs("data: ", f);
 752
 753                 fprintf(f,
 754                         "{ \"__CURSOR\" : \"%s\", "
 755                         "\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\", "
 756                         "\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\", "
 757                         "\"_BOOT_ID\" : \"%s\"",
 758                         cursor,
 759                         realtime,
 760                         monotonic,
 761                         sd_id128_to_string(boot_id, sid));
 762         }
 763
 764         h = hashmap_new(&string_hash_ops);
 765         if (!h)
 766                 return log_oom();
 767
 768         /* First round, iterate through the entry and count how often each field appears */
 769         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 770                 const char *eq;
 771                 char *n;
 772                 unsigned u;
 773
 774                 if (length >= 9 &&
 775                     memcmp(data, "_BOOT_ID=", 9) == 0)
 776                         continue;
 777
 778                 eq = memchr(data, '=', length);
 779                 if (!eq)
 780                         continue;
 781
 782                 n = strndup(data, eq - (const char*) data);
 783                 if (!n) {
 784                         r = log_oom();
 785                         goto finish;
 786                 }
 787
 788                 u = PTR_TO_UINT(hashmap_get(h, n));
 789                 if (u == 0) {
 790                         r = hashmap_put(h, n, UINT_TO_PTR(1));
 791                         if (r < 0) {
 792                                 free(n);
 793                                 log_oom();
 794                                 goto finish;
 795                         }
 796                 } else {
 797                         r = hashmap_update(h, n, UINT_TO_PTR(u + 1));
 798                         free(n);
 799                         if (r < 0) {
 800                                 log_oom();
 801                                 goto finish;
 802                         }
 803                 }
 804         }
 805
 806         if (r < 0)
 807                 return r;
 808
 809         separator = true;
 810         do {
 811                 done = true;
 812
 813                 SD_JOURNAL_FOREACH_DATA(j, data, length) {
 814                         const char *eq;
 815                         char *kk, *n;
 816                         size_t m;
 817                         unsigned u;
 818
 819                         /* We already printed the boot id, from the data in
 820                          * the header, hence let's suppress it here */
 821                         if (length >= 9 &&
 822                             memcmp(data, "_BOOT_ID=", 9) == 0)
 823                                 continue;
 824
 825                         eq = memchr(data, '=', length);
 826                         if (!eq)
 827                                 continue;
 828
 829                         if (separator) {
 830                                 if (mode == OUTPUT_JSON_PRETTY)
 831                                         fputs(",\n\t", f);
 832                                 else
 833                                         fputs(", ", f);
 834                         }
 835
 836                         m = eq - (const char*) data;
 837
 838                         n = strndup(data, m);
 839                         if (!n) {
 840                                 r = log_oom();
 841                                 goto finish;
 842                         }
 843
 844                         u = PTR_TO_UINT(hashmap_get2(h, n, (void**) &kk));
 845                         if (u == 0) {
 846                                 /* We already printed this, let's jump to the next */
 847                                 free(n);
 848                                 separator = false;
 849
 850                                 continue;
 851                         } else if (u == 1) {
 852                                 /* Field only appears once, output it directly */
 853
 854                                 json_escape(f, data, m, flags);
 855                                 fputs(" : ", f);
 856
 857                                 json_escape(f, eq + 1, length - m - 1, flags);
 858
 859                                 hashmap_remove(h, n);
 860                                 free(kk);
 861                                 free(n);
 862
 863                                 separator = true;
 864
 865                                 continue;
 866
 867                         } else {
 868                                 /* Field appears multiple times, output it as array */
 869                                 json_escape(f, data, m, flags);
 870                                 fputs(" : [ ", f);
 871                                 json_escape(f, eq + 1, length - m - 1, flags);
 872
 873                                 /* Iterate through the end of the list */
 874
 875                                 while (sd_journal_enumerate_data(j, &data, &length) > 0) {
 876                                         if (length < m + 1)
 877                                                 continue;
 878
 879                                         if (memcmp(data, n, m) != 0)
 880                                                 continue;
 881
 882                                         if (((const char*) data)[m] != '=')
 883                                                 continue;
 884
 885                                         fputs(", ", f);
 886                                         json_escape(f, (const char*) data + m + 1, length - m - 1, flags);
 887                                 }
 888
 889                                 fputs(" ]", f);
 890
 891                                 hashmap_remove(h, n);
 892                                 free(kk);
 893                                 free(n);
 894
 895                                 /* Iterate data fields form the beginning */
 896                                 done = false;
 897                                 separator = true;
 898
 899                                 break;
 900                         }
 901                 }
 902
 903         } while (!done);
 904
 905         if (mode == OUTPUT_JSON_PRETTY)
 906                 fputs("\n}\n", f);
 907         else if (mode == OUTPUT_JSON_SSE)
 908                 fputs("}\n\n", f);
 909         else
 910                 fputs(" }\n", f);
 911
 912         r = 0;
 913
 914 finish:
 915         while ((k = hashmap_steal_first_key(h)))
 916                 free(k);
 917
 918         hashmap_free(h);
 919
 920         return r;
 921 }
 922
 923 static int output_cat(
 924                 FILE *f,
 925                 sd_journal *j,
 926                 OutputMode mode,
 927                 unsigned n_columns,
 928                 OutputFlags flags) {
 929
 930         const void *data;
 931         size_t l;
 932         int r;
 933
 934         assert(j);
 935         assert(f);
 936
 937         sd_journal_set_data_threshold(j, 0);
 938
 939         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
 940         if (r < 0) {
 941                 /* An entry without MESSAGE=? */
 942                 if (r == -ENOENT)
 943                         return 0;
 944
 945                 return log_error_errno(r, "Failed to get data: %m");
 946         }
 947
 948         assert(l >= 8);
 949
 950         fwrite((const char*) data + 8, 1, l - 8, f);
 951         fputc('\n', f);
 952
 953         return 0;
 954 }
 955
 956 static int (*output_funcs[_OUTPUT_MODE_MAX])(
 957                 FILE *f,
 958                 sd_journal*j,
 959                 OutputMode mode,
 960                 unsigned n_columns,
 961                 OutputFlags flags) = {
 962
 963         [OUTPUT_SHORT] = output_short,
 964         [OUTPUT_SHORT_ISO] = output_short,
 965         [OUTPUT_SHORT_ISO_PRECISE] = output_short,
 966         [OUTPUT_SHORT_PRECISE] = output_short,
 967         [OUTPUT_SHORT_MONOTONIC] = output_short,
 968         [OUTPUT_SHORT_UNIX] = output_short,
 969         [OUTPUT_SHORT_FULL] = output_short,
 970         [OUTPUT_VERBOSE] = output_verbose,
 971         [OUTPUT_EXPORT] = output_export,
 972         [OUTPUT_JSON] = output_json,
 973         [OUTPUT_JSON_PRETTY] = output_json,
 974         [OUTPUT_JSON_SSE] = output_json,
 975         [OUTPUT_CAT] = output_cat
 976 };
 977
 978 int output_journal(
 979                 FILE *f,
 980                 sd_journal *j,
 981                 OutputMode mode,
 982                 unsigned n_columns,
 983                 OutputFlags flags,
 984                 bool *ellipsized) {
 985
 986         int ret;
 987         assert(mode >= 0);
 988         assert(mode < _OUTPUT_MODE_MAX);
 989
 990         if (n_columns <= 0)
 991                 n_columns = columns();
 992
 993         ret = output_funcs[mode](f, j, mode, n_columns, flags);
 994         fflush(stdout);
 995
 996         if (ellipsized && ret > 0)
 997                 *ellipsized = true;
 998
 999         return ret;
1000 }
1001
1002 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
1003         assert(f);
1004         assert(flags);
1005
1006         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
1007                 return 0;
1008
1009         /* Print a beginning new line if that's request, but only once
1010          * on the first line we print. */
1011
1012         fputc('\n', f);
1013         *flags &= ~OUTPUT_BEGIN_NEWLINE;
1014         return 0;
1015 }
1016
1017 static int show_journal(FILE *f,
1018                         sd_journal *j,
1019                         OutputMode mode,
1020                         unsigned n_columns,
1021                         usec_t not_before,
1022                         unsigned how_many,
1023                         OutputFlags flags,
1024                         bool *ellipsized) {
1025
1026         int r;
1027         unsigned line = 0;
1028         bool need_seek = false;
1029         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
1030
1031         assert(j);
1032         assert(mode >= 0);
1033         assert(mode < _OUTPUT_MODE_MAX);
1034
1035         /* Seek to end */
1036         r = sd_journal_seek_tail(j);
1037         if (r < 0)
1038                 return log_error_errno(r, "Failed to seek to tail: %m");
1039
1040         r = sd_journal_previous_skip(j, how_many);
1041         if (r < 0)
1042                 return log_error_errno(r, "Failed to skip previous: %m");
1043
1044         for (;;) {
1045                 for (;;) {
1046                         usec_t usec;
1047
1048                         if (need_seek) {
1049                                 r = sd_journal_next(j);
1050                                 if (r < 0)
1051                                         return log_error_errno(r, "Failed to iterate through journal: %m");
1052                         }
1053
1054                         if (r == 0)
1055                                 break;
1056
1057                         need_seek = true;
1058
1059                         if (not_before > 0) {
1060                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1061
1062                                 /* -ESTALE is returned if the
1063                                    timestamp is not from this boot */
1064                                 if (r == -ESTALE)
1065                                         continue;
1066                                 else if (r < 0)
1067                                         return log_error_errno(r, "Failed to get journal time: %m");
1068
1069                                 if (usec < not_before)
1070                                         continue;
1071                         }
1072
1073                         line++;
1074                         maybe_print_begin_newline(f, &flags);
1075
1076                         r = output_journal(f, j, mode, n_columns, flags, ellipsized);
1077                         if (r < 0)
1078                                 return r;
1079                 }
1080
1081                 if (warn_cutoff && line < how_many && not_before > 0) {
1082                         sd_id128_t boot_id;
1083                         usec_t cutoff = 0;
1084
1085                         /* Check whether the cutoff line is too early */
1086
1087                         r = sd_id128_get_boot(&boot_id);
1088                         if (r < 0)
1089                                 return log_error_errno(r, "Failed to get boot id: %m");
1090
1091                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1092                         if (r < 0)
1093                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1094
1095                         if (r > 0 && not_before < cutoff) {
1096                                 maybe_print_begin_newline(f, &flags);
1097                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1098                         }
1099
1100                         warn_cutoff = false;
1101                 }
1102
1103                 if (!(flags & OUTPUT_FOLLOW))
1104                         break;
1105
1106                 r = sd_journal_wait(j, USEC_INFINITY);
1107                 if (r < 0)
1108                         return log_error_errno(r, "Failed to wait for journal: %m");
1109
1110         }
1111
1112         return 0;
1113 }
1114
1115 int add_matches_for_unit(sd_journal *j, const char *unit) {
1116         const char *m1, *m2, *m3, *m4;
1117         int r;
1118
1119         assert(j);
1120         assert(unit);
1121
1122         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1123         m2 = strjoina("COREDUMP_UNIT=", unit);
1124         m3 = strjoina("UNIT=", unit);
1125         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1126
1127         (void)(
1128             /* Look for messages from the service itself */
1129             (r = sd_journal_add_match(j, m1, 0)) ||
1130
1131             /* Look for coredumps of the service */
1132             (r = sd_journal_add_disjunction(j)) ||
1133             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1134             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1135             (r = sd_journal_add_match(j, m2, 0)) ||
1136
1137              /* Look for messages from PID 1 about this service */
1138             (r = sd_journal_add_disjunction(j)) ||
1139             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1140             (r = sd_journal_add_match(j, m3, 0)) ||
1141
1142             /* Look for messages from authorized daemons about this service */
1143             (r = sd_journal_add_disjunction(j)) ||
1144             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1145             (r = sd_journal_add_match(j, m4, 0))
1146         );
1147
1148         if (r == 0 && endswith(unit, ".slice")) {
1149                 const char *m5;
1150
1151                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1152
1153                 /* Show all messages belonging to a slice */
1154                 (void)(
1155                         (r = sd_journal_add_disjunction(j)) ||
1156                         (r = sd_journal_add_match(j, m5, 0))
1157                         );
1158         }
1159
1160         return r;
1161 }
1162
1163 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1164         int r;
1165         char *m1, *m2, *m3, *m4;
1166         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1167
1168         assert(j);
1169         assert(unit);
1170
1171         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1172         m2 = strjoina("USER_UNIT=", unit);
1173         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1174         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1175         sprintf(muid, "_UID="UID_FMT, uid);
1176
1177         (void) (
1178                 /* Look for messages from the user service itself */
1179                 (r = sd_journal_add_match(j, m1, 0)) ||
1180                 (r = sd_journal_add_match(j, muid, 0)) ||
1181
1182                 /* Look for messages from systemd about this service */
1183                 (r = sd_journal_add_disjunction(j)) ||
1184                 (r = sd_journal_add_match(j, m2, 0)) ||
1185                 (r = sd_journal_add_match(j, muid, 0)) ||
1186
1187                 /* Look for coredumps of the service */
1188                 (r = sd_journal_add_disjunction(j)) ||
1189                 (r = sd_journal_add_match(j, m3, 0)) ||
1190                 (r = sd_journal_add_match(j, muid, 0)) ||
1191                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1192
1193                 /* Look for messages from authorized daemons about this service */
1194                 (r = sd_journal_add_disjunction(j)) ||
1195                 (r = sd_journal_add_match(j, m4, 0)) ||
1196                 (r = sd_journal_add_match(j, muid, 0)) ||
1197                 (r = sd_journal_add_match(j, "_UID=0", 0))
1198         );
1199
1200         if (r == 0 && endswith(unit, ".slice")) {
1201                 const char *m5;
1202
1203                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1204
1205                 /* Show all messages belonging to a slice */
1206                 (void)(
1207                         (r = sd_journal_add_disjunction(j)) ||
1208                         (r = sd_journal_add_match(j, m5, 0)) ||
1209                         (r = sd_journal_add_match(j, muid, 0))
1210                         );
1211         }
1212
1213         return r;
1214 }
1215
1216 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1217         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1218         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1219         pid_t pid, child;
1220         siginfo_t si;
1221         char buf[37];
1222         ssize_t k;
1223         int r;
1224
1225         assert(machine);
1226         assert(boot_id);
1227
1228         if (!machine_name_is_valid(machine))
1229                 return -EINVAL;
1230
1231         r = container_get_leader(machine, &pid);
1232         if (r < 0)
1233                 return r;
1234
1235         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1236         if (r < 0)
1237                 return r;
1238
1239         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1240                 return -errno;
1241
1242         child = fork();
1243         if (child < 0)
1244                 return -errno;
1245
1246         if (child == 0) {
1247                 int fd;
1248
1249                 pair[0] = safe_close(pair[0]);
1250
1251                 r = namespace_enter(pidnsfd, mntnsfd, -1, -1, rootfd);
1252                 if (r < 0)
1253                         _exit(EXIT_FAILURE);
1254
1255                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1256                 if (fd < 0)
1257                         _exit(EXIT_FAILURE);
1258
1259                 r = loop_read_exact(fd, buf, 36, false);
1260                 safe_close(fd);
1261                 if (r < 0)
1262                         _exit(EXIT_FAILURE);
1263
1264                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1265                 if (k != 36)
1266                         _exit(EXIT_FAILURE);
1267
1268                 _exit(EXIT_SUCCESS);
1269         }
1270
1271         pair[1] = safe_close(pair[1]);
1272
1273         r = wait_for_terminate(child, &si);
1274         if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS)
1275                 return r < 0 ? r : -EIO;
1276
1277         k = recv(pair[0], buf, 36, 0);
1278         if (k != 36)
1279                 return -EIO;
1280
1281         buf[36] = 0;
1282         r = sd_id128_from_string(buf, boot_id);
1283         if (r < 0)
1284                 return r;
1285
1286         return 0;
1287 }
1288
1289 int add_match_this_boot(sd_journal *j, const char *machine) {
1290         char match[9+32+1] = "_BOOT_ID=";
1291         sd_id128_t boot_id;
1292         int r;
1293
1294         assert(j);
1295
1296         if (machine) {
1297                 r = get_boot_id_for_machine(machine, &boot_id);
1298                 if (r < 0)
1299                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1300         } else {
1301                 r = sd_id128_get_boot(&boot_id);
1302                 if (r < 0)
1303                         return log_error_errno(r, "Failed to get boot id: %m");
1304         }
1305
1306         sd_id128_to_string(boot_id, match + 9);
1307         r = sd_journal_add_match(j, match, strlen(match));
1308         if (r < 0)
1309                 return log_error_errno(r, "Failed to add match: %m");
1310
1311         r = sd_journal_add_conjunction(j);
1312         if (r < 0)
1313                 return log_error_errno(r, "Failed to add conjunction: %m");
1314
1315         return 0;
1316 }
1317
1318 int show_journal_by_unit(
1319                 FILE *f,
1320                 const char *unit,
1321                 OutputMode mode,
1322                 unsigned n_columns,
1323                 usec_t not_before,
1324                 unsigned how_many,
1325                 uid_t uid,
1326                 OutputFlags flags,
1327                 int journal_open_flags,
1328                 bool system_unit,
1329                 bool *ellipsized) {
1330
1331         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1332         int r;
1333
1334         assert(mode >= 0);
1335         assert(mode < _OUTPUT_MODE_MAX);
1336         assert(unit);
1337
1338         if (how_many <= 0)
1339                 return 0;
1340
1341         r = sd_journal_open(&j, journal_open_flags);
1342         if (r < 0)
1343                 return log_error_errno(r, "Failed to open journal: %m");
1344
1345         r = add_match_this_boot(j, NULL);
1346         if (r < 0)
1347                 return r;
1348
1349         if (system_unit)
1350                 r = add_matches_for_unit(j, unit);
1351         else
1352                 r = add_matches_for_user_unit(j, unit, uid);
1353         if (r < 0)
1354                 return log_error_errno(r, "Failed to add unit matches: %m");
1355
1356         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1357                 _cleanup_free_ char *filter;
1358
1359                 filter = journal_make_match_string(j);
1360                 if (!filter)
1361                         return log_oom();
1362
1363                 log_debug("Journal filter: %s", filter);
1364         }
1365
1366         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1367 }