src/shared/logs-show.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <signal.h>
  23 #include <stdint.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <syslog.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32 #include "sd-journal.h"
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "format-util.h"
  37 #include "hashmap.h"
  38 #include "hostname-util.h"
  39 #include "io-util.h"
  40 #include "journal-internal.h"
  41 #include "log.h"
  42 #include "logs-show.h"
  43 #include "macro.h"
  44 #include "output-mode.h"
  45 #include "parse-util.h"
  46 #include "process-util.h"
  47 #include "sparse-endian.h"
  48 #include "stdio-util.h"
  49 #include "string-table.h"
  50 #include "string-util.h"
  51 #include "strv.h"
  52 #include "terminal-util.h"
  53 #include "time-util.h"
  54 #include "utf8.h"
  55 #include "util.h"
  56
  57 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  58 #define PRINT_LINE_THRESHOLD 3
  59 #define PRINT_CHAR_THRESHOLD 300
  60
  61 #define JSON_THRESHOLD 4096
  62
  63 static int print_catalog(FILE *f, sd_journal *j) {
  64         int r;
  65         _cleanup_free_ char *t = NULL, *z = NULL;
  66
  67
  68         r = sd_journal_get_catalog(j, &t);
  69         if (r < 0)
  70                 return r;
  71
  72         z = strreplace(strstrip(t), "\n", "\n-- ");
  73         if (!z)
  74                 return log_oom();
  75
  76         fputs("-- ", f);
  77         fputs(z, f);
  78         fputc('\n', f);
  79
  80         return 0;
  81 }
  82
  83 static int parse_field(const void *data, size_t length, const char *field, size_t field_len, char **target, size_t *target_len) {
  84         size_t nl;
  85         char *buf;
  86
  87         assert(data);
  88         assert(field);
  89         assert(target);
  90
  91         if (length < field_len)
  92                 return 0;
  93
  94         if (memcmp(data, field, field_len))
  95                 return 0;
  96
  97         nl = length - field_len;
  98
  99
 100         buf = newdup_suffix0(char, (const char*) data + field_len, nl);
 101         if (!buf)
 102                 return log_oom();
 103
 104         free(*target);
 105         *target = buf;
 106
 107         if (target_len)
 108                 *target_len = nl;
 109
 110         return 1;
 111 }
 112
 113 typedef struct ParseFieldVec {
 114         const char *field;
 115         size_t field_len;
 116         char **target;
 117         size_t *target_len;
 118 } ParseFieldVec;
 119
 120 #define PARSE_FIELD_VEC_ENTRY(_field, _target, _target_len) \
 121         { .field = _field, .field_len = strlen(_field), .target = _target, .target_len = _target_len }
 122
 123 static int parse_fieldv(const void *data, size_t length, const ParseFieldVec *fields, unsigned n_fields) {
 124         unsigned i;
 125
 126         for (i = 0; i < n_fields; i++) {
 127                 const ParseFieldVec *f = &fields[i];
 128                 int r;
 129
 130                 r = parse_field(data, length, f->field, f->field_len, f->target, f->target_len);
 131                 if (r < 0)
 132                         return r;
 133                 else if (r > 0)
 134                         break;
 135         }
 136
 137         return 0;
 138 }
 139
 140 static int field_set_test(Set *fields, const char *name, size_t n) {
 141         char *s = NULL;
 142
 143         if (!fields)
 144                 return 1;
 145
 146         s = strndupa(name, n);
 147         if (!s)
 148                 return log_oom();
 149
 150         return set_get(fields, s) ? 1 : 0;
 151 }
 152
 153 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 154         assert(p);
 155
 156         if (flags & OUTPUT_SHOW_ALL)
 157                 return true;
 158
 159         if (l >= PRINT_CHAR_THRESHOLD)
 160                 return false;
 161
 162         if (!utf8_is_printable(p, l))
 163                 return false;
 164
 165         return true;
 166 }
 167
 168 static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
 169         const char *color_on = "", *color_off = "";
 170         const char *pos, *end;
 171         bool ellipsized = false;
 172         int line = 0;
 173
 174         if (flags & OUTPUT_COLOR) {
 175                 if (priority <= LOG_ERR) {
 176                         color_on = ANSI_HIGHLIGHT_RED;
 177                         color_off = ANSI_NORMAL;
 178                 } else if (priority <= LOG_NOTICE) {
 179                         color_on = ANSI_HIGHLIGHT;
 180                         color_off = ANSI_NORMAL;
 181                 }
 182         }
 183
 184         /* A special case: make sure that we print a newline when
 185            the message is empty. */
 186         if (message_len == 0)
 187                 fputs("\n", f);
 188
 189         for (pos = message;
 190              pos < message + message_len;
 191              pos = end + 1, line++) {
 192                 bool continuation = line > 0;
 193                 bool tail_line;
 194                 int len;
 195                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 196                         ;
 197                 len = end - pos;
 198                 assert(len >= 0);
 199
 200                 /* We need to figure out when we are showing not-last line, *and*
 201                  * will skip subsequent lines. In that case, we will put the dots
 202                  * at the end of the line, instead of putting dots in the middle
 203                  * or not at all.
 204                  */
 205                 tail_line =
 206                         line + 1 == PRINT_LINE_THRESHOLD ||
 207                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 208
 209                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 210                     (prefix + len + 1 < n_columns && !tail_line)) {
 211                         fprintf(f, "%*s%s%.*s%s\n",
 212                                 continuation * prefix, "",
 213                                 color_on, len, pos, color_off);
 214                         continue;
 215                 }
 216
 217                 /* Beyond this point, ellipsization will happen. */
 218                 ellipsized = true;
 219
 220                 if (prefix < n_columns && n_columns - prefix >= 3) {
 221                         if (n_columns - prefix > (unsigned) len + 3)
 222                                 fprintf(f, "%*s%s%.*s...%s\n",
 223                                         continuation * prefix, "",
 224                                         color_on, len, pos, color_off);
 225                         else {
 226                                 _cleanup_free_ char *e;
 227
 228                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 229                                                   tail_line ? 100 : 90);
 230                                 if (!e)
 231                                         fprintf(f, "%*s%s%.*s%s\n",
 232                                                 continuation * prefix, "",
 233                                                 color_on, len, pos, color_off);
 234                                 else
 235                                         fprintf(f, "%*s%s%s%s\n",
 236                                                 continuation * prefix, "",
 237                                                 color_on, e, color_off);
 238                         }
 239                 } else
 240                         fputs("...\n", f);
 241
 242                 if (tail_line)
 243                         break;
 244         }
 245
 246         return ellipsized;
 247 }
 248
 249 static int output_timestamp_monotonic(FILE *f, sd_journal *j, const char *monotonic) {
 250         sd_id128_t boot_id;
 251         uint64_t t;
 252         int r;
 253
 254         assert(f);
 255         assert(j);
 256
 257         r = -ENXIO;
 258         if (monotonic)
 259                 r = safe_atou64(monotonic, &t);
 260         if (r < 0)
 261                 r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 262         if (r < 0)
 263                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 264
 265         fprintf(f, "[%5"PRI_USEC".%06"PRI_USEC"]", t / USEC_PER_SEC, t % USEC_PER_SEC);
 266         return 1 + 5 + 1 + 6 + 1;
 267 }
 268
 269 static int output_timestamp_realtime(FILE *f, sd_journal *j, OutputMode mode, OutputFlags flags, const char *realtime) {
 270         char buf[MAX(FORMAT_TIMESTAMP_MAX, 64)];
 271         struct tm *(*gettime_r)(const time_t *, struct tm *);
 272         struct tm tm;
 273         uint64_t x;
 274         time_t t;
 275         int r;
 276
 277         assert(f);
 278         assert(j);
 279
 280         r = -ENXIO;
 281         if (realtime)
 282                 r = safe_atou64(realtime, &x);
 283         if (r < 0)
 284                 r = sd_journal_get_realtime_usec(j, &x);
 285         if (r < 0)
 286                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 287
 288         if (x > USEC_TIMESTAMP_FORMATTABLE_MAX) {
 289                 log_error("Timestamp cannot be printed");
 290                 return -EINVAL;
 291         }
 292
 293         if (mode == OUTPUT_SHORT_FULL) {
 294                 const char *k;
 295
 296                 if (flags & OUTPUT_UTC)
 297                         k = format_timestamp_utc(buf, sizeof(buf), x);
 298                 else
 299                         k = format_timestamp(buf, sizeof(buf), x);
 300                 if (!k) {
 301                         log_error("Failed to format timestamp.");
 302                         return -EINVAL;
 303                 }
 304
 305         } else {
 306                 char usec[7];
 307
 308                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 309                 t = (time_t) (x / USEC_PER_SEC);
 310
 311                 switch (mode) {
 312
 313                 case OUTPUT_SHORT_UNIX:
 314                         xsprintf(buf, "%10"PRI_TIME".%06"PRIu64, t, x % USEC_PER_SEC);
 315                         break;
 316
 317                 case OUTPUT_SHORT_ISO:
 318                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm)) <= 0) {
 319                                 log_error("Failed to format ISO time");
 320                                 return -EINVAL;
 321                         }
 322                         break;
 323
 324                 case OUTPUT_SHORT_ISO_PRECISE:
 325                         /* No usec in strftime, so we leave space and copy over */
 326                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S.xxxxxx%z", gettime_r(&t, &tm)) <= 0) {
 327                                 log_error("Failed to format ISO-precise time");
 328                                 return -EINVAL;
 329                         }
 330                         xsprintf(usec, "%06"PRI_USEC, x % USEC_PER_SEC);
 331                         memcpy(buf + 20, usec, 6);
 332                         break;
 333
 334                 case OUTPUT_SHORT:
 335                 case OUTPUT_SHORT_PRECISE:
 336
 337                         if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm)) <= 0) {
 338                                 log_error("Failed to format syslog time");
 339                                 return -EINVAL;
 340                         }
 341
 342                         if (mode == OUTPUT_SHORT_PRECISE) {
 343                                 size_t k;
 344
 345                                 assert(sizeof(buf) > strlen(buf));
 346                                 k = sizeof(buf) - strlen(buf);
 347
 348                                 r = snprintf(buf + strlen(buf), k, ".%06"PRIu64, x % USEC_PER_SEC);
 349                                 if (r <= 0 || (size_t) r >= k) { /* too long? */
 350                                         log_error("Failed to format precise time");
 351                                         return -EINVAL;
 352                                 }
 353                         }
 354                         break;
 355
 356                 default:
 357                         assert_not_reached("Unknown time format");
 358                 }
 359         }
 360
 361         fputs(buf, f);
 362         return (int) strlen(buf);
 363 }
 364
 365 static int output_short(
 366                 FILE *f,
 367                 sd_journal *j,
 368                 OutputMode mode,
 369                 unsigned n_columns,
 370                 OutputFlags flags,
 371                 Set *output_fields) {
 372
 373         int r;
 374         const void *data;
 375         size_t length;
 376         size_t n = 0;
 377         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
 378         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
 379         int p = LOG_INFO;
 380         bool ellipsized = false;
 381         const ParseFieldVec fields[] = {
 382                 PARSE_FIELD_VEC_ENTRY("_PID=", &pid, &pid_len),
 383                 PARSE_FIELD_VEC_ENTRY("_COMM=", &comm, &comm_len),
 384                 PARSE_FIELD_VEC_ENTRY("MESSAGE=", &message, &message_len),
 385                 PARSE_FIELD_VEC_ENTRY("PRIORITY=", &priority, &priority_len),
 386                 PARSE_FIELD_VEC_ENTRY("_HOSTNAME=", &hostname, &hostname_len),
 387                 PARSE_FIELD_VEC_ENTRY("SYSLOG_PID=", &fake_pid, &fake_pid_len),
 388                 PARSE_FIELD_VEC_ENTRY("SYSLOG_IDENTIFIER=", &identifier, &identifier_len),
 389                 PARSE_FIELD_VEC_ENTRY("_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len),
 390                 PARSE_FIELD_VEC_ENTRY("_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len),
 391         };
 392
 393         assert(f);
 394         assert(j);
 395
 396         /* Set the threshold to one bigger than the actual print
 397          * threshold, so that if the line is actually longer than what
 398          * we're willing to print, ellipsization will occur. This way
 399          * we won't output a misleading line without any indication of
 400          * truncation.
 401          */
 402         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 403
 404         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 405
 406                 r = parse_fieldv(data, length, fields, ELEMENTSOF(fields));
 407                 if (r < 0)
 408                         return r;
 409         }
 410         if (r == -EBADMSG) {
 411                 log_debug_errno(r, "Skipping message we can't read: %m");
 412                 return 0;
 413         }
 414         if (r < 0)
 415                 return log_error_errno(r, "Failed to get journal fields: %m");
 416
 417         if (!message) {
 418                 log_debug("Skipping message without MESSAGE= field.");
 419                 return 0;
 420         }
 421
 422         if (!(flags & OUTPUT_SHOW_ALL))
 423                 strip_tab_ansi(&message, &message_len);
 424
 425         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 426                 p = *priority - '0';
 427
 428         if (mode == OUTPUT_SHORT_MONOTONIC)
 429                 r = output_timestamp_monotonic(f, j, monotonic);
 430         else
 431                 r = output_timestamp_realtime(f, j, mode, flags, realtime);
 432         if (r < 0)
 433                 return r;
 434         n += r;
 435
 436         if (flags & OUTPUT_NO_HOSTNAME) {
 437                 /* Suppress display of the hostname if this is requested. */
 438                 hostname = mfree(hostname);
 439                 hostname_len = 0;
 440         }
 441
 442         if (hostname && shall_print(hostname, hostname_len, flags)) {
 443                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 444                 n += hostname_len + 1;
 445         }
 446
 447         if (identifier && shall_print(identifier, identifier_len, flags)) {
 448                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 449                 n += identifier_len + 1;
 450         } else if (comm && shall_print(comm, comm_len, flags)) {
 451                 fprintf(f, " %.*s", (int) comm_len, comm);
 452                 n += comm_len + 1;
 453         } else
 454                 fputs(" unknown", f);
 455
 456         if (pid && shall_print(pid, pid_len, flags)) {
 457                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 458                 n += pid_len + 2;
 459         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 460                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 461                 n += fake_pid_len + 2;
 462         }
 463
 464         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 465                 char bytes[FORMAT_BYTES_MAX];
 466                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 467         } else {
 468                 fputs(": ", f);
 469                 ellipsized |=
 470                         print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
 471         }
 472
 473         if (flags & OUTPUT_CATALOG)
 474                 print_catalog(f, j);
 475
 476         return ellipsized;
 477 }
 478
 479 static int output_verbose(
 480                 FILE *f,
 481                 sd_journal *j,
 482                 OutputMode mode,
 483                 unsigned n_columns,
 484                 OutputFlags flags,
 485                 Set *output_fields) {
 486
 487         const void *data;
 488         size_t length;
 489         _cleanup_free_ char *cursor = NULL;
 490         uint64_t realtime = 0;
 491         char ts[FORMAT_TIMESTAMP_MAX + 7];
 492         const char *timestamp;
 493         int r;
 494
 495         assert(f);
 496         assert(j);
 497
 498         sd_journal_set_data_threshold(j, 0);
 499
 500         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 501         if (r == -ENOENT)
 502                 log_debug("Source realtime timestamp not found");
 503         else if (r < 0)
 504                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 505         else {
 506                 _cleanup_free_ char *value = NULL;
 507
 508                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", strlen("_SOURCE_REALTIME_TIMESTAMP="), &value, NULL);
 509                 if (r < 0)
 510                         return r;
 511                 assert(r > 0);
 512
 513                 r = safe_atou64(value, &realtime);
 514                 if (r < 0)
 515                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 516         }
 517
 518         if (r < 0) {
 519                 r = sd_journal_get_realtime_usec(j, &realtime);
 520                 if (r < 0)
 521                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 522         }
 523
 524         r = sd_journal_get_cursor(j, &cursor);
 525         if (r < 0)
 526                 return log_error_errno(r, "Failed to get cursor: %m");
 527
 528         timestamp = flags & OUTPUT_UTC ? format_timestamp_us_utc(ts, sizeof ts, realtime)
 529                                        : format_timestamp_us(ts, sizeof ts, realtime);
 530         fprintf(f, "%s [%s]\n",
 531                 timestamp ?: "(no timestamp)",
 532                 cursor);
 533
 534         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 535                 const char *c;
 536                 int fieldlen;
 537                 const char *on = "", *off = "";
 538
 539                 c = memchr(data, '=', length);
 540                 if (!c) {
 541                         log_error("Invalid field.");
 542                         return -EINVAL;
 543                 }
 544                 fieldlen = c - (const char*) data;
 545
 546                 r = field_set_test(output_fields, data, fieldlen);
 547                 if (r < 0)
 548                         return r;
 549                 if (!r)
 550                         continue;
 551
 552                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 553                         on = ANSI_HIGHLIGHT;
 554                         off = ANSI_NORMAL;
 555                 }
 556
 557                 if ((flags & OUTPUT_SHOW_ALL) ||
 558                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 559                      && utf8_is_printable(data, length))) {
 560                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 561                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
 562                         fputs(off, f);
 563                 } else {
 564                         char bytes[FORMAT_BYTES_MAX];
 565
 566                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 567                                 on,
 568                                 (int) (c - (const char*) data),
 569                                 (const char*) data,
 570                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 571                                 off);
 572                 }
 573         }
 574
 575         if (r < 0)
 576                 return r;
 577
 578         if (flags & OUTPUT_CATALOG)
 579                 print_catalog(f, j);
 580
 581         return 0;
 582 }
 583
 584 static int output_export(
 585                 FILE *f,
 586                 sd_journal *j,
 587                 OutputMode mode,
 588                 unsigned n_columns,
 589                 OutputFlags flags,
 590                 Set *output_fields) {
 591
 592         sd_id128_t boot_id;
 593         char sid[33];
 594         int r;
 595         usec_t realtime, monotonic;
 596         _cleanup_free_ char *cursor = NULL;
 597         const void *data;
 598         size_t length;
 599
 600         assert(j);
 601
 602         sd_journal_set_data_threshold(j, 0);
 603
 604         r = sd_journal_get_realtime_usec(j, &realtime);
 605         if (r < 0)
 606                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 607
 608         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 609         if (r < 0)
 610                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 611
 612         r = sd_journal_get_cursor(j, &cursor);
 613         if (r < 0)
 614                 return log_error_errno(r, "Failed to get cursor: %m");
 615
 616         fprintf(f,
 617                 "__CURSOR=%s\n"
 618                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 619                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 620                 "_BOOT_ID=%s\n",
 621                 cursor,
 622                 realtime,
 623                 monotonic,
 624                 sd_id128_to_string(boot_id, sid));
 625
 626         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 627                 const char *c;
 628
 629                 /* We already printed the boot id, from the data in
 630                  * the header, hence let's suppress it here */
 631                 if (length >= 9 &&
 632                     startswith(data, "_BOOT_ID="))
 633                         continue;
 634
 635                 c = memchr(data, '=', length);
 636                 if (!c) {
 637                         log_error("Invalid field.");
 638                         return -EINVAL;
 639                 }
 640
 641                 r = field_set_test(output_fields, data, c - (const char *) data);
 642                 if (r < 0)
 643                         return r;
 644                 if (!r)
 645                         continue;
 646
 647                 if (utf8_is_printable_newline(data, length, false))
 648                         fwrite(data, length, 1, f);
 649                 else {
 650                         uint64_t le64;
 651
 652                         fwrite(data, c - (const char*) data, 1, f);
 653                         fputc('\n', f);
 654                         le64 = htole64(length - (c - (const char*) data) - 1);
 655                         fwrite(&le64, sizeof(le64), 1, f);
 656                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 657                 }
 658
 659                 fputc('\n', f);
 660         }
 661
 662         if (r < 0)
 663                 return r;
 664
 665         fputc('\n', f);
 666
 667         return 0;
 668 }
 669
 670 void json_escape(
 671                 FILE *f,
 672                 const char* p,
 673                 size_t l,
 674                 OutputFlags flags) {
 675
 676         assert(f);
 677         assert(p);
 678
 679         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 680                 fputs("null", f);
 681
 682         else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
 683                 bool not_first = false;
 684
 685                 fputs("[ ", f);
 686
 687                 while (l > 0) {
 688                         if (not_first)
 689                                 fprintf(f, ", %u", (uint8_t) *p);
 690                         else {
 691                                 not_first = true;
 692                                 fprintf(f, "%u", (uint8_t) *p);
 693                         }
 694
 695                         p++;
 696                         l--;
 697                 }
 698
 699                 fputs(" ]", f);
 700         } else {
 701                 fputc('\"', f);
 702
 703                 while (l > 0) {
 704                         if (IN_SET(*p, '"', '\\')) {
 705                                 fputc('\\', f);
 706                                 fputc(*p, f);
 707                         } else if (*p == '\n')
 708                                 fputs("\\n", f);
 709                         else if ((uint8_t) *p < ' ')
 710                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 711                         else
 712                                 fputc(*p, f);
 713
 714                         p++;
 715                         l--;
 716                 }
 717
 718                 fputc('\"', f);
 719         }
 720 }
 721
 722 static int output_json(
 723                 FILE *f,
 724                 sd_journal *j,
 725                 OutputMode mode,
 726                 unsigned n_columns,
 727                 OutputFlags flags,
 728                 Set *output_fields) {
 729
 730         uint64_t realtime, monotonic;
 731         _cleanup_free_ char *cursor = NULL;
 732         const void *data;
 733         size_t length;
 734         sd_id128_t boot_id;
 735         char sid[33], *k;
 736         int r;
 737         Hashmap *h = NULL;
 738         bool done, separator;
 739
 740         assert(j);
 741
 742         sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 743
 744         r = sd_journal_get_realtime_usec(j, &realtime);
 745         if (r < 0)
 746                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 747
 748         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 749         if (r < 0)
 750                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 751
 752         r = sd_journal_get_cursor(j, &cursor);
 753         if (r < 0)
 754                 return log_error_errno(r, "Failed to get cursor: %m");
 755
 756         if (mode == OUTPUT_JSON_PRETTY)
 757                 fprintf(f,
 758                         "{\n"
 759                         "\t\"__CURSOR\" : \"%s\",\n"
 760                         "\t\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\",\n"
 761                         "\t\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\",\n"
 762                         "\t\"_BOOT_ID\" : \"%s\"",
 763                         cursor,
 764                         realtime,
 765                         monotonic,
 766                         sd_id128_to_string(boot_id, sid));
 767         else {
 768                 if (mode == OUTPUT_JSON_SSE)
 769                         fputs("data: ", f);
 770
 771                 fprintf(f,
 772                         "{ \"__CURSOR\" : \"%s\", "
 773                         "\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\", "
 774                         "\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\", "
 775                         "\"_BOOT_ID\" : \"%s\"",
 776                         cursor,
 777                         realtime,
 778                         monotonic,
 779                         sd_id128_to_string(boot_id, sid));
 780         }
 781
 782         h = hashmap_new(&string_hash_ops);
 783         if (!h)
 784                 return log_oom();
 785
 786         /* First round, iterate through the entry and count how often each field appears */
 787         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 788                 const char *eq;
 789                 char *n;
 790                 unsigned u;
 791
 792                 if (length >= 9 &&
 793                     memcmp(data, "_BOOT_ID=", 9) == 0)
 794                         continue;
 795
 796                 eq = memchr(data, '=', length);
 797                 if (!eq)
 798                         continue;
 799
 800                 n = strndup(data, eq - (const char*) data);
 801                 if (!n) {
 802                         r = log_oom();
 803                         goto finish;
 804                 }
 805
 806                 u = PTR_TO_UINT(hashmap_get(h, n));
 807                 if (u == 0) {
 808                         r = hashmap_put(h, n, UINT_TO_PTR(1));
 809                         if (r < 0) {
 810                                 free(n);
 811                                 log_oom();
 812                                 goto finish;
 813                         }
 814                 } else {
 815                         r = hashmap_update(h, n, UINT_TO_PTR(u + 1));
 816                         free(n);
 817                         if (r < 0) {
 818                                 log_oom();
 819                                 goto finish;
 820                         }
 821                 }
 822         }
 823
 824         if (r < 0)
 825                 return r;
 826
 827         separator = true;
 828         do {
 829                 done = true;
 830
 831                 SD_JOURNAL_FOREACH_DATA(j, data, length) {
 832                         const char *eq;
 833                         char *kk, *n;
 834                         size_t m;
 835                         unsigned u;
 836
 837                         /* We already printed the boot id, from the data in
 838                          * the header, hence let's suppress it here */
 839                         if (length >= 9 &&
 840                             memcmp(data, "_BOOT_ID=", 9) == 0)
 841                                 continue;
 842
 843                         eq = memchr(data, '=', length);
 844                         if (!eq)
 845                                 continue;
 846
 847                         m = eq - (const char*) data;
 848
 849                         n = strndup(data, m);
 850                         if (!n) {
 851                                 r = log_oom();
 852                                 goto finish;
 853                         }
 854
 855                         if (output_fields && !set_get(output_fields, n)) {
 856                                 free(n);
 857                                 continue;
 858                         }
 859
 860                         if (separator) {
 861                                 if (mode == OUTPUT_JSON_PRETTY)
 862                                         fputs(",\n\t", f);
 863                                 else
 864                                         fputs(", ", f);
 865                         }
 866
 867                         u = PTR_TO_UINT(hashmap_get2(h, n, (void**) &kk));
 868                         if (u == 0) {
 869                                 /* We already printed this, let's jump to the next */
 870                                 free(n);
 871                                 separator = false;
 872
 873                                 continue;
 874                         } else if (u == 1) {
 875                                 /* Field only appears once, output it directly */
 876
 877                                 json_escape(f, data, m, flags);
 878                                 fputs(" : ", f);
 879
 880                                 json_escape(f, eq + 1, length - m - 1, flags);
 881
 882                                 hashmap_remove(h, n);
 883                                 free(kk);
 884                                 free(n);
 885
 886                                 separator = true;
 887
 888                                 continue;
 889
 890                         } else {
 891                                 /* Field appears multiple times, output it as array */
 892                                 json_escape(f, data, m, flags);
 893                                 fputs(" : [ ", f);
 894                                 json_escape(f, eq + 1, length - m - 1, flags);
 895
 896                                 /* Iterate through the end of the list */
 897
 898                                 while (sd_journal_enumerate_data(j, &data, &length) > 0) {
 899                                         if (length < m + 1)
 900                                                 continue;
 901
 902                                         if (memcmp(data, n, m) != 0)
 903                                                 continue;
 904
 905                                         if (((const char*) data)[m] != '=')
 906                                                 continue;
 907
 908                                         fputs(", ", f);
 909                                         json_escape(f, (const char*) data + m + 1, length - m - 1, flags);
 910                                 }
 911
 912                                 fputs(" ]", f);
 913
 914                                 hashmap_remove(h, n);
 915                                 free(kk);
 916                                 free(n);
 917
 918                                 /* Iterate data fields form the beginning */
 919                                 done = false;
 920                                 separator = true;
 921
 922                                 break;
 923                         }
 924                 }
 925
 926         } while (!done);
 927
 928         if (mode == OUTPUT_JSON_PRETTY)
 929                 fputs("\n}\n", f);
 930         else if (mode == OUTPUT_JSON_SSE)
 931                 fputs("}\n\n", f);
 932         else
 933                 fputs(" }\n", f);
 934
 935         r = 0;
 936
 937 finish:
 938         while ((k = hashmap_steal_first_key(h)))
 939                 free(k);
 940
 941         hashmap_free(h);
 942
 943         return r;
 944 }
 945
 946 static int output_cat(
 947                 FILE *f,
 948                 sd_journal *j,
 949                 OutputMode mode,
 950                 unsigned n_columns,
 951                 OutputFlags flags,
 952                 Set *output_fields) {
 953
 954         const void *data;
 955         size_t l;
 956         int r;
 957
 958         assert(j);
 959         assert(f);
 960
 961         sd_journal_set_data_threshold(j, 0);
 962
 963         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
 964         if (r < 0) {
 965                 /* An entry without MESSAGE=? */
 966                 if (r == -ENOENT)
 967                         return 0;
 968
 969                 return log_error_errno(r, "Failed to get data: %m");
 970         }
 971
 972         assert(l >= 8);
 973
 974         fwrite((const char*) data + 8, 1, l - 8, f);
 975         fputc('\n', f);
 976
 977         return 0;
 978 }
 979
 980 static int (*output_funcs[_OUTPUT_MODE_MAX])(
 981                 FILE *f,
 982                 sd_journal*j,
 983                 OutputMode mode,
 984                 unsigned n_columns,
 985                 OutputFlags flags,
 986                 Set *output_fields) = {
 987
 988         [OUTPUT_SHORT] = output_short,
 989         [OUTPUT_SHORT_ISO] = output_short,
 990         [OUTPUT_SHORT_ISO_PRECISE] = output_short,
 991         [OUTPUT_SHORT_PRECISE] = output_short,
 992         [OUTPUT_SHORT_MONOTONIC] = output_short,
 993         [OUTPUT_SHORT_UNIX] = output_short,
 994         [OUTPUT_SHORT_FULL] = output_short,
 995         [OUTPUT_VERBOSE] = output_verbose,
 996         [OUTPUT_EXPORT] = output_export,
 997         [OUTPUT_JSON] = output_json,
 998         [OUTPUT_JSON_PRETTY] = output_json,
 999         [OUTPUT_JSON_SSE] = output_json,
1000         [OUTPUT_CAT] = output_cat
1001 };
1002
1003 int output_journal(
1004                 FILE *f,
1005                 sd_journal *j,
1006                 OutputMode mode,
1007                 unsigned n_columns,
1008                 OutputFlags flags,
1009                 char **output_fields,
1010                 bool *ellipsized) {
1011
1012         int ret;
1013         _cleanup_set_free_free_ Set *fields = NULL;
1014         assert(mode >= 0);
1015         assert(mode < _OUTPUT_MODE_MAX);
1016
1017         if (n_columns <= 0)
1018                 n_columns = columns();
1019
1020         if (output_fields) {
1021                 fields = set_new(&string_hash_ops);
1022                 if (!fields)
1023                         return log_oom();
1024
1025                 ret = set_put_strdupv(fields, output_fields);
1026                 if (ret < 0)
1027                         return ret;
1028         }
1029
1030         ret = output_funcs[mode](f, j, mode, n_columns, flags, fields);
1031
1032         if (ellipsized && ret > 0)
1033                 *ellipsized = true;
1034
1035         return ret;
1036 }
1037
1038 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
1039         assert(f);
1040         assert(flags);
1041
1042         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
1043                 return 0;
1044
1045         /* Print a beginning new line if that's request, but only once
1046          * on the first line we print. */
1047
1048         fputc('\n', f);
1049         *flags &= ~OUTPUT_BEGIN_NEWLINE;
1050         return 0;
1051 }
1052
1053 static int show_journal(FILE *f,
1054                         sd_journal *j,
1055                         OutputMode mode,
1056                         unsigned n_columns,
1057                         usec_t not_before,
1058                         unsigned how_many,
1059                         OutputFlags flags,
1060                         bool *ellipsized) {
1061
1062         int r;
1063         unsigned line = 0;
1064         bool need_seek = false;
1065         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
1066
1067         assert(j);
1068         assert(mode >= 0);
1069         assert(mode < _OUTPUT_MODE_MAX);
1070
1071         /* Seek to end */
1072         r = sd_journal_seek_tail(j);
1073         if (r < 0)
1074                 return log_error_errno(r, "Failed to seek to tail: %m");
1075
1076         r = sd_journal_previous_skip(j, how_many);
1077         if (r < 0)
1078                 return log_error_errno(r, "Failed to skip previous: %m");
1079
1080         for (;;) {
1081                 for (;;) {
1082                         usec_t usec;
1083
1084                         if (need_seek) {
1085                                 r = sd_journal_next(j);
1086                                 if (r < 0)
1087                                         return log_error_errno(r, "Failed to iterate through journal: %m");
1088                         }
1089
1090                         if (r == 0)
1091                                 break;
1092
1093                         need_seek = true;
1094
1095                         if (not_before > 0) {
1096                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1097
1098                                 /* -ESTALE is returned if the
1099                                    timestamp is not from this boot */
1100                                 if (r == -ESTALE)
1101                                         continue;
1102                                 else if (r < 0)
1103                                         return log_error_errno(r, "Failed to get journal time: %m");
1104
1105                                 if (usec < not_before)
1106                                         continue;
1107                         }
1108
1109                         line++;
1110                         maybe_print_begin_newline(f, &flags);
1111
1112                         r = output_journal(f, j, mode, n_columns, flags, NULL, ellipsized);
1113                         if (r < 0)
1114                                 return r;
1115                 }
1116
1117                 if (warn_cutoff && line < how_many && not_before > 0) {
1118                         sd_id128_t boot_id;
1119                         usec_t cutoff = 0;
1120
1121                         /* Check whether the cutoff line is too early */
1122
1123                         r = sd_id128_get_boot(&boot_id);
1124                         if (r < 0)
1125                                 return log_error_errno(r, "Failed to get boot id: %m");
1126
1127                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1128                         if (r < 0)
1129                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1130
1131                         if (r > 0 && not_before < cutoff) {
1132                                 maybe_print_begin_newline(f, &flags);
1133                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1134                         }
1135
1136                         warn_cutoff = false;
1137                 }
1138
1139                 if (!(flags & OUTPUT_FOLLOW))
1140                         break;
1141
1142                 r = sd_journal_wait(j, USEC_INFINITY);
1143                 if (r < 0)
1144                         return log_error_errno(r, "Failed to wait for journal: %m");
1145
1146         }
1147
1148         return 0;
1149 }
1150
1151 int add_matches_for_unit(sd_journal *j, const char *unit) {
1152         const char *m1, *m2, *m3, *m4;
1153         int r;
1154
1155         assert(j);
1156         assert(unit);
1157
1158         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1159         m2 = strjoina("COREDUMP_UNIT=", unit);
1160         m3 = strjoina("UNIT=", unit);
1161         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1162
1163         (void)(
1164             /* Look for messages from the service itself */
1165             (r = sd_journal_add_match(j, m1, 0)) ||
1166
1167             /* Look for coredumps of the service */
1168             (r = sd_journal_add_disjunction(j)) ||
1169             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1170             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1171             (r = sd_journal_add_match(j, m2, 0)) ||
1172
1173              /* Look for messages from PID 1 about this service */
1174             (r = sd_journal_add_disjunction(j)) ||
1175             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1176             (r = sd_journal_add_match(j, m3, 0)) ||
1177
1178             /* Look for messages from authorized daemons about this service */
1179             (r = sd_journal_add_disjunction(j)) ||
1180             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1181             (r = sd_journal_add_match(j, m4, 0))
1182         );
1183
1184         if (r == 0 && endswith(unit, ".slice")) {
1185                 const char *m5;
1186
1187                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1188
1189                 /* Show all messages belonging to a slice */
1190                 (void)(
1191                         (r = sd_journal_add_disjunction(j)) ||
1192                         (r = sd_journal_add_match(j, m5, 0))
1193                         );
1194         }
1195
1196         return r;
1197 }
1198
1199 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1200         int r;
1201         char *m1, *m2, *m3, *m4;
1202         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1203
1204         assert(j);
1205         assert(unit);
1206
1207         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1208         m2 = strjoina("USER_UNIT=", unit);
1209         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1210         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1211         sprintf(muid, "_UID="UID_FMT, uid);
1212
1213         (void) (
1214                 /* Look for messages from the user service itself */
1215                 (r = sd_journal_add_match(j, m1, 0)) ||
1216                 (r = sd_journal_add_match(j, muid, 0)) ||
1217
1218                 /* Look for messages from systemd about this service */
1219                 (r = sd_journal_add_disjunction(j)) ||
1220                 (r = sd_journal_add_match(j, m2, 0)) ||
1221                 (r = sd_journal_add_match(j, muid, 0)) ||
1222
1223                 /* Look for coredumps of the service */
1224                 (r = sd_journal_add_disjunction(j)) ||
1225                 (r = sd_journal_add_match(j, m3, 0)) ||
1226                 (r = sd_journal_add_match(j, muid, 0)) ||
1227                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1228
1229                 /* Look for messages from authorized daemons about this service */
1230                 (r = sd_journal_add_disjunction(j)) ||
1231                 (r = sd_journal_add_match(j, m4, 0)) ||
1232                 (r = sd_journal_add_match(j, muid, 0)) ||
1233                 (r = sd_journal_add_match(j, "_UID=0", 0))
1234         );
1235
1236         if (r == 0 && endswith(unit, ".slice")) {
1237                 const char *m5;
1238
1239                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1240
1241                 /* Show all messages belonging to a slice */
1242                 (void)(
1243                         (r = sd_journal_add_disjunction(j)) ||
1244                         (r = sd_journal_add_match(j, m5, 0)) ||
1245                         (r = sd_journal_add_match(j, muid, 0))
1246                         );
1247         }
1248
1249         return r;
1250 }
1251
1252 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1253         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1254         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1255         pid_t pid, child;
1256         siginfo_t si;
1257         char buf[37];
1258         ssize_t k;
1259         int r;
1260
1261         assert(machine);
1262         assert(boot_id);
1263
1264         if (!machine_name_is_valid(machine))
1265                 return -EINVAL;
1266
1267         r = container_get_leader(machine, &pid);
1268         if (r < 0)
1269                 return r;
1270
1271         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1272         if (r < 0)
1273                 return r;
1274
1275         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1276                 return -errno;
1277
1278         child = fork();
1279         if (child < 0)
1280                 return -errno;
1281
1282         if (child == 0) {
1283                 int fd;
1284
1285                 pair[0] = safe_close(pair[0]);
1286
1287                 r = namespace_enter(pidnsfd, mntnsfd, -1, -1, rootfd);
1288                 if (r < 0)
1289                         _exit(EXIT_FAILURE);
1290
1291                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1292                 if (fd < 0)
1293                         _exit(EXIT_FAILURE);
1294
1295                 r = loop_read_exact(fd, buf, 36, false);
1296                 safe_close(fd);
1297                 if (r < 0)
1298                         _exit(EXIT_FAILURE);
1299
1300                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1301                 if (k != 36)
1302                         _exit(EXIT_FAILURE);
1303
1304                 _exit(EXIT_SUCCESS);
1305         }
1306
1307         pair[1] = safe_close(pair[1]);
1308
1309         r = wait_for_terminate(child, &si);
1310         if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS)
1311                 return r < 0 ? r : -EIO;
1312
1313         k = recv(pair[0], buf, 36, 0);
1314         if (k != 36)
1315                 return -EIO;
1316
1317         buf[36] = 0;
1318         r = sd_id128_from_string(buf, boot_id);
1319         if (r < 0)
1320                 return r;
1321
1322         return 0;
1323 }
1324
1325 int add_match_this_boot(sd_journal *j, const char *machine) {
1326         char match[9+32+1] = "_BOOT_ID=";
1327         sd_id128_t boot_id;
1328         int r;
1329
1330         assert(j);
1331
1332         if (machine) {
1333                 r = get_boot_id_for_machine(machine, &boot_id);
1334                 if (r < 0)
1335                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1336         } else {
1337                 r = sd_id128_get_boot(&boot_id);
1338                 if (r < 0)
1339                         return log_error_errno(r, "Failed to get boot id: %m");
1340         }
1341
1342         sd_id128_to_string(boot_id, match + 9);
1343         r = sd_journal_add_match(j, match, strlen(match));
1344         if (r < 0)
1345                 return log_error_errno(r, "Failed to add match: %m");
1346
1347         r = sd_journal_add_conjunction(j);
1348         if (r < 0)
1349                 return log_error_errno(r, "Failed to add conjunction: %m");
1350
1351         return 0;
1352 }
1353
1354 int show_journal_by_unit(
1355                 FILE *f,
1356                 const char *unit,
1357                 OutputMode mode,
1358                 unsigned n_columns,
1359                 usec_t not_before,
1360                 unsigned how_many,
1361                 uid_t uid,
1362                 OutputFlags flags,
1363                 int journal_open_flags,
1364                 bool system_unit,
1365                 bool *ellipsized) {
1366
1367         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1368         int r;
1369
1370         assert(mode >= 0);
1371         assert(mode < _OUTPUT_MODE_MAX);
1372         assert(unit);
1373
1374         if (how_many <= 0)
1375                 return 0;
1376
1377         r = sd_journal_open(&j, journal_open_flags);
1378         if (r < 0)
1379                 return log_error_errno(r, "Failed to open journal: %m");
1380
1381         r = add_match_this_boot(j, NULL);
1382         if (r < 0)
1383                 return r;
1384
1385         if (system_unit)
1386                 r = add_matches_for_unit(j, unit);
1387         else
1388                 r = add_matches_for_user_unit(j, unit, uid);
1389         if (r < 0)
1390                 return log_error_errno(r, "Failed to add unit matches: %m");
1391
1392         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1393                 _cleanup_free_ char *filter;
1394
1395                 filter = journal_make_match_string(j);
1396                 if (!filter)
1397                         return log_oom();
1398
1399                 log_debug("Journal filter: %s", filter);
1400         }
1401
1402         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1403 }