src/shared/logs-show.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <signal.h>
  23 #include <stdint.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <syslog.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32 #include "sd-journal.h"
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "formats-util.h"
  37 #include "hashmap.h"
  38 #include "hostname-util.h"
  39 #include "io-util.h"
  40 #include "journal-internal.h"
  41 #include "log.h"
  42 #include "logs-show.h"
  43 #include "macro.h"
  44 #include "output-mode.h"
  45 #include "parse-util.h"
  46 #include "process-util.h"
  47 #include "sparse-endian.h"
  48 #include "string-table.h"
  49 #include "string-util.h"
  50 #include "terminal-util.h"
  51 #include "time-util.h"
  52 #include "utf8.h"
  53 #include "util.h"
  54
  55 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  56 #define PRINT_LINE_THRESHOLD 3
  57 #define PRINT_CHAR_THRESHOLD 300
  58
  59 #define JSON_THRESHOLD 4096
  60
  61 static int print_catalog(FILE *f, sd_journal *j) {
  62         int r;
  63         _cleanup_free_ char *t = NULL, *z = NULL;
  64
  65
  66         r = sd_journal_get_catalog(j, &t);
  67         if (r < 0)
  68                 return r;
  69
  70         z = strreplace(strstrip(t), "\n", "\n-- ");
  71         if (!z)
  72                 return log_oom();
  73
  74         fputs("-- ", f);
  75         fputs(z, f);
  76         fputc('\n', f);
  77
  78         return 0;
  79 }
  80
  81 static int parse_field(const void *data, size_t length, const char *field, char **target, size_t *target_size) {
  82         size_t fl, nl;
  83         char *buf;
  84
  85         assert(data);
  86         assert(field);
  87         assert(target);
  88
  89         fl = strlen(field);
  90         if (length < fl)
  91                 return 0;
  92
  93         if (memcmp(data, field, fl))
  94                 return 0;
  95
  96         nl = length - fl;
  97         buf = new(char, nl+1);
  98         if (!buf)
  99                 return log_oom();
 100
 101         memcpy(buf, (const char*) data + fl, nl);
 102         buf[nl] = 0;
 103
 104         free(*target);
 105         *target = buf;
 106
 107         if (target_size)
 108                 *target_size = nl;
 109
 110         return 1;
 111 }
 112
 113 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 114         assert(p);
 115
 116         if (flags & OUTPUT_SHOW_ALL)
 117                 return true;
 118
 119         if (l >= PRINT_CHAR_THRESHOLD)
 120                 return false;
 121
 122         if (!utf8_is_printable(p, l))
 123                 return false;
 124
 125         return true;
 126 }
 127
 128 static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
 129         const char *color_on = "", *color_off = "";
 130         const char *pos, *end;
 131         bool ellipsized = false;
 132         int line = 0;
 133
 134         if (flags & OUTPUT_COLOR) {
 135                 if (priority <= LOG_ERR) {
 136                         color_on = ANSI_HIGHLIGHT_RED;
 137                         color_off = ANSI_NORMAL;
 138                 } else if (priority <= LOG_NOTICE) {
 139                         color_on = ANSI_HIGHLIGHT;
 140                         color_off = ANSI_NORMAL;
 141                 }
 142         }
 143
 144         /* A special case: make sure that we print a newline when
 145            the message is empty. */
 146         if (message_len == 0)
 147                 fputs("\n", f);
 148
 149         for (pos = message;
 150              pos < message + message_len;
 151              pos = end + 1, line++) {
 152                 bool continuation = line > 0;
 153                 bool tail_line;
 154                 int len;
 155                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 156                         ;
 157                 len = end - pos;
 158                 assert(len >= 0);
 159
 160                 /* We need to figure out when we are showing not-last line, *and*
 161                  * will skip subsequent lines. In that case, we will put the dots
 162                  * at the end of the line, instead of putting dots in the middle
 163                  * or not at all.
 164                  */
 165                 tail_line =
 166                         line + 1 == PRINT_LINE_THRESHOLD ||
 167                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 168
 169                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 170                     (prefix + len + 1 < n_columns && !tail_line)) {
 171                         fprintf(f, "%*s%s%.*s%s\n",
 172                                 continuation * prefix, "",
 173                                 color_on, len, pos, color_off);
 174                         continue;
 175                 }
 176
 177                 /* Beyond this point, ellipsization will happen. */
 178                 ellipsized = true;
 179
 180                 if (prefix < n_columns && n_columns - prefix >= 3) {
 181                         if (n_columns - prefix > (unsigned) len + 3)
 182                                 fprintf(f, "%*s%s%.*s...%s\n",
 183                                         continuation * prefix, "",
 184                                         color_on, len, pos, color_off);
 185                         else {
 186                                 _cleanup_free_ char *e;
 187
 188                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 189                                                   tail_line ? 100 : 90);
 190                                 if (!e)
 191                                         fprintf(f, "%*s%s%.*s%s\n",
 192                                                 continuation * prefix, "",
 193                                                 color_on, len, pos, color_off);
 194                                 else
 195                                         fprintf(f, "%*s%s%s%s\n",
 196                                                 continuation * prefix, "",
 197                                                 color_on, e, color_off);
 198                         }
 199                 } else
 200                         fputs("...\n", f);
 201
 202                 if (tail_line)
 203                         break;
 204         }
 205
 206         return ellipsized;
 207 }
 208
 209 static int output_short(
 210                 FILE *f,
 211                 sd_journal *j,
 212                 OutputMode mode,
 213                 unsigned n_columns,
 214                 OutputFlags flags) {
 215
 216         int r;
 217         const void *data;
 218         size_t length;
 219         size_t n = 0;
 220         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
 221         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
 222         int p = LOG_INFO;
 223         bool ellipsized = false;
 224
 225         assert(f);
 226         assert(j);
 227
 228         /* Set the threshold to one bigger than the actual print
 229          * threshold, so that if the line is actually longer than what
 230          * we're willing to print, ellipsization will occur. This way
 231          * we won't output a misleading line without any indication of
 232          * truncation.
 233          */
 234         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 235
 236         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 237
 238                 r = parse_field(data, length, "PRIORITY=", &priority, &priority_len);
 239                 if (r < 0)
 240                         return r;
 241                 else if (r > 0)
 242                         continue;
 243
 244                 r = parse_field(data, length, "_HOSTNAME=", &hostname, &hostname_len);
 245                 if (r < 0)
 246                         return r;
 247                 else if (r > 0)
 248                         continue;
 249
 250                 r = parse_field(data, length, "SYSLOG_IDENTIFIER=", &identifier, &identifier_len);
 251                 if (r < 0)
 252                         return r;
 253                 else if (r > 0)
 254                         continue;
 255
 256                 r = parse_field(data, length, "_COMM=", &comm, &comm_len);
 257                 if (r < 0)
 258                         return r;
 259                 else if (r > 0)
 260                         continue;
 261
 262                 r = parse_field(data, length, "_PID=", &pid, &pid_len);
 263                 if (r < 0)
 264                         return r;
 265                 else if (r > 0)
 266                         continue;
 267
 268                 r = parse_field(data, length, "SYSLOG_PID=", &fake_pid, &fake_pid_len);
 269                 if (r < 0)
 270                         return r;
 271                 else if (r > 0)
 272                         continue;
 273
 274                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len);
 275                 if (r < 0)
 276                         return r;
 277                 else if (r > 0)
 278                         continue;
 279
 280                 r = parse_field(data, length, "_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len);
 281                 if (r < 0)
 282                         return r;
 283                 else if (r > 0)
 284                         continue;
 285
 286                 r = parse_field(data, length, "MESSAGE=", &message, &message_len);
 287                 if (r < 0)
 288                         return r;
 289         }
 290
 291         if (r < 0)
 292                 return log_error_errno(r, "Failed to get journal fields: %m");
 293
 294         if (!message) {
 295                 log_debug("Skipping message without MESSAGE= field.");
 296                 return 0;
 297         }
 298
 299         if (!(flags & OUTPUT_SHOW_ALL))
 300                 strip_tab_ansi(&message, &message_len);
 301
 302         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 303                 p = *priority - '0';
 304
 305         if (mode == OUTPUT_SHORT_MONOTONIC) {
 306                 uint64_t t;
 307                 sd_id128_t boot_id;
 308
 309                 r = -ENOENT;
 310
 311                 if (monotonic)
 312                         r = safe_atou64(monotonic, &t);
 313
 314                 if (r < 0)
 315                         r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 316
 317                 if (r < 0)
 318                         return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 319
 320                 fprintf(f, "[%5llu.%06llu]",
 321                         (unsigned long long) (t / USEC_PER_SEC),
 322                         (unsigned long long) (t % USEC_PER_SEC));
 323
 324                 n += 1 + 5 + 1 + 6 + 1;
 325
 326         } else {
 327                 char buf[64];
 328                 uint64_t x;
 329                 time_t t;
 330                 struct tm tm;
 331                 struct tm *(*gettime_r)(const time_t *, struct tm *);
 332
 333                 r = -ENOENT;
 334                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 335
 336                 if (realtime)
 337                         r = safe_atou64(realtime, &x);
 338
 339                 if (r < 0)
 340                         r = sd_journal_get_realtime_usec(j, &x);
 341
 342                 if (r < 0)
 343                         return log_error_errno(r, "Failed to get realtime timestamp: %m");
 344
 345                 t = (time_t) (x / USEC_PER_SEC);
 346
 347                 switch (mode) {
 348
 349                 case OUTPUT_SHORT_UNIX:
 350                         r = snprintf(buf, sizeof(buf), "%10llu.%06llu", (unsigned long long) t, (unsigned long long) (x % USEC_PER_SEC));
 351                         break;
 352
 353                 case OUTPUT_SHORT_ISO:
 354                         r = strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm));
 355                         break;
 356
 357                 case OUTPUT_SHORT_PRECISE:
 358                         r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm));
 359                         if (r > 0)
 360                                 snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), ".%06llu", (unsigned long long) (x % USEC_PER_SEC));
 361                         break;
 362
 363                 default:
 364                         r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm));
 365                 }
 366
 367                 if (r <= 0) {
 368                         log_error("Failed to format time.");
 369                         return -EINVAL;
 370                 }
 371
 372                 fputs(buf, f);
 373                 n += strlen(buf);
 374         }
 375
 376         if (hostname && (flags & OUTPUT_NO_HOSTNAME)) {
 377                 /* Suppress display of the hostname if this is requested. */
 378                 hostname = NULL;
 379                 hostname_len = 0;
 380         }
 381
 382         if (hostname && shall_print(hostname, hostname_len, flags)) {
 383                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 384                 n += hostname_len + 1;
 385         }
 386
 387         if (identifier && shall_print(identifier, identifier_len, flags)) {
 388                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 389                 n += identifier_len + 1;
 390         } else if (comm && shall_print(comm, comm_len, flags)) {
 391                 fprintf(f, " %.*s", (int) comm_len, comm);
 392                 n += comm_len + 1;
 393         } else
 394                 fputs(" unknown", f);
 395
 396         if (pid && shall_print(pid, pid_len, flags)) {
 397                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 398                 n += pid_len + 2;
 399         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 400                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 401                 n += fake_pid_len + 2;
 402         }
 403
 404         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 405                 char bytes[FORMAT_BYTES_MAX];
 406                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 407         } else {
 408                 fputs(": ", f);
 409                 ellipsized |=
 410                         print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
 411         }
 412
 413         if (flags & OUTPUT_CATALOG)
 414                 print_catalog(f, j);
 415
 416         return ellipsized;
 417 }
 418
 419 static int output_verbose(
 420                 FILE *f,
 421                 sd_journal *j,
 422                 OutputMode mode,
 423                 unsigned n_columns,
 424                 OutputFlags flags) {
 425
 426         const void *data;
 427         size_t length;
 428         _cleanup_free_ char *cursor = NULL;
 429         uint64_t realtime = 0;
 430         char ts[FORMAT_TIMESTAMP_MAX + 7];
 431         int r;
 432
 433         assert(f);
 434         assert(j);
 435
 436         sd_journal_set_data_threshold(j, 0);
 437
 438         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 439         if (r == -ENOENT)
 440                 log_debug("Source realtime timestamp not found");
 441         else if (r < 0)
 442                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 443         else {
 444                 _cleanup_free_ char *value = NULL;
 445
 446                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &value, NULL);
 447                 if (r < 0)
 448                         return r;
 449                 assert(r > 0);
 450
 451                 r = safe_atou64(value, &realtime);
 452                 if (r < 0)
 453                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 454         }
 455
 456         if (r < 0) {
 457                 r = sd_journal_get_realtime_usec(j, &realtime);
 458                 if (r < 0)
 459                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 460         }
 461
 462         r = sd_journal_get_cursor(j, &cursor);
 463         if (r < 0)
 464                 return log_error_errno(r, "Failed to get cursor: %m");
 465
 466         fprintf(f, "%s [%s]\n",
 467                 flags & OUTPUT_UTC ?
 468                 format_timestamp_us_utc(ts, sizeof(ts), realtime) :
 469                 format_timestamp_us(ts, sizeof(ts), realtime),
 470                 cursor);
 471
 472         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 473                 const char *c;
 474                 int fieldlen;
 475                 const char *on = "", *off = "";
 476
 477                 c = memchr(data, '=', length);
 478                 if (!c) {
 479                         log_error("Invalid field.");
 480                         return -EINVAL;
 481                 }
 482                 fieldlen = c - (const char*) data;
 483
 484                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 485                         on = ANSI_HIGHLIGHT;
 486                         off = ANSI_NORMAL;
 487                 }
 488
 489                 if (flags & OUTPUT_SHOW_ALL ||
 490                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 491                      && utf8_is_printable(data, length))) {
 492                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 493                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
 494                         fputs(off, f);
 495                 } else {
 496                         char bytes[FORMAT_BYTES_MAX];
 497
 498                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 499                                 on,
 500                                 (int) (c - (const char*) data),
 501                                 (const char*) data,
 502                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 503                                 off);
 504                 }
 505         }
 506
 507         if (r < 0)
 508                 return r;
 509
 510         if (flags & OUTPUT_CATALOG)
 511                 print_catalog(f, j);
 512
 513         return 0;
 514 }
 515
 516 static int output_export(
 517                 FILE *f,
 518                 sd_journal *j,
 519                 OutputMode mode,
 520                 unsigned n_columns,
 521                 OutputFlags flags) {
 522
 523         sd_id128_t boot_id;
 524         char sid[33];
 525         int r;
 526         usec_t realtime, monotonic;
 527         _cleanup_free_ char *cursor = NULL;
 528         const void *data;
 529         size_t length;
 530
 531         assert(j);
 532
 533         sd_journal_set_data_threshold(j, 0);
 534
 535         r = sd_journal_get_realtime_usec(j, &realtime);
 536         if (r < 0)
 537                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 538
 539         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 540         if (r < 0)
 541                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 542
 543         r = sd_journal_get_cursor(j, &cursor);
 544         if (r < 0)
 545                 return log_error_errno(r, "Failed to get cursor: %m");
 546
 547         fprintf(f,
 548                 "__CURSOR=%s\n"
 549                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 550                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 551                 "_BOOT_ID=%s\n",
 552                 cursor,
 553                 realtime,
 554                 monotonic,
 555                 sd_id128_to_string(boot_id, sid));
 556
 557         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 558
 559                 /* We already printed the boot id, from the data in
 560                  * the header, hence let's suppress it here */
 561                 if (length >= 9 &&
 562                     startswith(data, "_BOOT_ID="))
 563                         continue;
 564
 565                 if (utf8_is_printable_newline(data, length, false))
 566                         fwrite(data, length, 1, f);
 567                 else {
 568                         const char *c;
 569                         uint64_t le64;
 570
 571                         c = memchr(data, '=', length);
 572                         if (!c) {
 573                                 log_error("Invalid field.");
 574                                 return -EINVAL;
 575                         }
 576
 577                         fwrite(data, c - (const char*) data, 1, f);
 578                         fputc('\n', f);
 579                         le64 = htole64(length - (c - (const char*) data) - 1);
 580                         fwrite(&le64, sizeof(le64), 1, f);
 581                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 582                 }
 583
 584                 fputc('\n', f);
 585         }
 586
 587         if (r < 0)
 588                 return r;
 589
 590         fputc('\n', f);
 591
 592         return 0;
 593 }
 594
 595 void json_escape(
 596                 FILE *f,
 597                 const char* p,
 598                 size_t l,
 599                 OutputFlags flags) {
 600
 601         assert(f);
 602         assert(p);
 603
 604         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 605                 fputs("null", f);
 606
 607         else if (!utf8_is_printable(p, l)) {
 608                 bool not_first = false;
 609
 610                 fputs("[ ", f);
 611
 612                 while (l > 0) {
 613                         if (not_first)
 614                                 fprintf(f, ", %u", (uint8_t) *p);
 615                         else {
 616                                 not_first = true;
 617                                 fprintf(f, "%u", (uint8_t) *p);
 618                         }
 619
 620                         p++;
 621                         l--;
 622                 }
 623
 624                 fputs(" ]", f);
 625         } else {
 626                 fputc('\"', f);
 627
 628                 while (l > 0) {
 629                         if (*p == '"' || *p == '\\') {
 630                                 fputc('\\', f);
 631                                 fputc(*p, f);
 632                         } else if (*p == '\n')
 633                                 fputs("\\n", f);
 634                         else if ((uint8_t) *p < ' ')
 635                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 636                         else
 637                                 fputc(*p, f);
 638
 639                         p++;
 640                         l--;
 641                 }
 642
 643                 fputc('\"', f);
 644         }
 645 }
 646
 647 static int output_json(
 648                 FILE *f,
 649                 sd_journal *j,
 650                 OutputMode mode,
 651                 unsigned n_columns,
 652                 OutputFlags flags) {
 653
 654         uint64_t realtime, monotonic;
 655         _cleanup_free_ char *cursor = NULL;
 656         const void *data;
 657         size_t length;
 658         sd_id128_t boot_id;
 659         char sid[33], *k;
 660         int r;
 661         Hashmap *h = NULL;
 662         bool done, separator;
 663
 664         assert(j);
 665
 666         sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 667
 668         r = sd_journal_get_realtime_usec(j, &realtime);
 669         if (r < 0)
 670                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 671
 672         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 673         if (r < 0)
 674                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 675
 676         r = sd_journal_get_cursor(j, &cursor);
 677         if (r < 0)
 678                 return log_error_errno(r, "Failed to get cursor: %m");
 679
 680         if (mode == OUTPUT_JSON_PRETTY)
 681                 fprintf(f,
 682                         "{\n"
 683                         "\t\"__CURSOR\" : \"%s\",\n"
 684                         "\t\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\",\n"
 685                         "\t\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\",\n"
 686                         "\t\"_BOOT_ID\" : \"%s\"",
 687                         cursor,
 688                         realtime,
 689                         monotonic,
 690                         sd_id128_to_string(boot_id, sid));
 691         else {
 692                 if (mode == OUTPUT_JSON_SSE)
 693                         fputs("data: ", f);
 694
 695                 fprintf(f,
 696                         "{ \"__CURSOR\" : \"%s\", "
 697                         "\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\", "
 698                         "\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\", "
 699                         "\"_BOOT_ID\" : \"%s\"",
 700                         cursor,
 701                         realtime,
 702                         monotonic,
 703                         sd_id128_to_string(boot_id, sid));
 704         }
 705
 706         h = hashmap_new(&string_hash_ops);
 707         if (!h)
 708                 return log_oom();
 709
 710         /* First round, iterate through the entry and count how often each field appears */
 711         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 712                 const char *eq;
 713                 char *n;
 714                 unsigned u;
 715
 716                 if (length >= 9 &&
 717                     memcmp(data, "_BOOT_ID=", 9) == 0)
 718                         continue;
 719
 720                 eq = memchr(data, '=', length);
 721                 if (!eq)
 722                         continue;
 723
 724                 n = strndup(data, eq - (const char*) data);
 725                 if (!n) {
 726                         r = log_oom();
 727                         goto finish;
 728                 }
 729
 730                 u = PTR_TO_UINT(hashmap_get(h, n));
 731                 if (u == 0) {
 732                         r = hashmap_put(h, n, UINT_TO_PTR(1));
 733                         if (r < 0) {
 734                                 free(n);
 735                                 log_oom();
 736                                 goto finish;
 737                         }
 738                 } else {
 739                         r = hashmap_update(h, n, UINT_TO_PTR(u + 1));
 740                         free(n);
 741                         if (r < 0) {
 742                                 log_oom();
 743                                 goto finish;
 744                         }
 745                 }
 746         }
 747
 748         if (r < 0)
 749                 return r;
 750
 751         separator = true;
 752         do {
 753                 done = true;
 754
 755                 SD_JOURNAL_FOREACH_DATA(j, data, length) {
 756                         const char *eq;
 757                         char *kk, *n;
 758                         size_t m;
 759                         unsigned u;
 760
 761                         /* We already printed the boot id, from the data in
 762                          * the header, hence let's suppress it here */
 763                         if (length >= 9 &&
 764                             memcmp(data, "_BOOT_ID=", 9) == 0)
 765                                 continue;
 766
 767                         eq = memchr(data, '=', length);
 768                         if (!eq)
 769                                 continue;
 770
 771                         if (separator) {
 772                                 if (mode == OUTPUT_JSON_PRETTY)
 773                                         fputs(",\n\t", f);
 774                                 else
 775                                         fputs(", ", f);
 776                         }
 777
 778                         m = eq - (const char*) data;
 779
 780                         n = strndup(data, m);
 781                         if (!n) {
 782                                 r = log_oom();
 783                                 goto finish;
 784                         }
 785
 786                         u = PTR_TO_UINT(hashmap_get2(h, n, (void**) &kk));
 787                         if (u == 0) {
 788                                 /* We already printed this, let's jump to the next */
 789                                 free(n);
 790                                 separator = false;
 791
 792                                 continue;
 793                         } else if (u == 1) {
 794                                 /* Field only appears once, output it directly */
 795
 796                                 json_escape(f, data, m, flags);
 797                                 fputs(" : ", f);
 798
 799                                 json_escape(f, eq + 1, length - m - 1, flags);
 800
 801                                 hashmap_remove(h, n);
 802                                 free(kk);
 803                                 free(n);
 804
 805                                 separator = true;
 806
 807                                 continue;
 808
 809                         } else {
 810                                 /* Field appears multiple times, output it as array */
 811                                 json_escape(f, data, m, flags);
 812                                 fputs(" : [ ", f);
 813                                 json_escape(f, eq + 1, length - m - 1, flags);
 814
 815                                 /* Iterate through the end of the list */
 816
 817                                 while (sd_journal_enumerate_data(j, &data, &length) > 0) {
 818                                         if (length < m + 1)
 819                                                 continue;
 820
 821                                         if (memcmp(data, n, m) != 0)
 822                                                 continue;
 823
 824                                         if (((const char*) data)[m] != '=')
 825                                                 continue;
 826
 827                                         fputs(", ", f);
 828                                         json_escape(f, (const char*) data + m + 1, length - m - 1, flags);
 829                                 }
 830
 831                                 fputs(" ]", f);
 832
 833                                 hashmap_remove(h, n);
 834                                 free(kk);
 835                                 free(n);
 836
 837                                 /* Iterate data fields form the beginning */
 838                                 done = false;
 839                                 separator = true;
 840
 841                                 break;
 842                         }
 843                 }
 844
 845         } while (!done);
 846
 847         if (mode == OUTPUT_JSON_PRETTY)
 848                 fputs("\n}\n", f);
 849         else if (mode == OUTPUT_JSON_SSE)
 850                 fputs("}\n\n", f);
 851         else
 852                 fputs(" }\n", f);
 853
 854         r = 0;
 855
 856 finish:
 857         while ((k = hashmap_steal_first_key(h)))
 858                 free(k);
 859
 860         hashmap_free(h);
 861
 862         return r;
 863 }
 864
 865 static int output_cat(
 866                 FILE *f,
 867                 sd_journal *j,
 868                 OutputMode mode,
 869                 unsigned n_columns,
 870                 OutputFlags flags) {
 871
 872         const void *data;
 873         size_t l;
 874         int r;
 875
 876         assert(j);
 877         assert(f);
 878
 879         sd_journal_set_data_threshold(j, 0);
 880
 881         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
 882         if (r < 0) {
 883                 /* An entry without MESSAGE=? */
 884                 if (r == -ENOENT)
 885                         return 0;
 886
 887                 return log_error_errno(r, "Failed to get data: %m");
 888         }
 889
 890         assert(l >= 8);
 891
 892         fwrite((const char*) data + 8, 1, l - 8, f);
 893         fputc('\n', f);
 894
 895         return 0;
 896 }
 897
 898 static int (*output_funcs[_OUTPUT_MODE_MAX])(
 899                 FILE *f,
 900                 sd_journal*j,
 901                 OutputMode mode,
 902                 unsigned n_columns,
 903                 OutputFlags flags) = {
 904
 905         [OUTPUT_SHORT] = output_short,
 906         [OUTPUT_SHORT_ISO] = output_short,
 907         [OUTPUT_SHORT_PRECISE] = output_short,
 908         [OUTPUT_SHORT_MONOTONIC] = output_short,
 909         [OUTPUT_SHORT_UNIX] = output_short,
 910         [OUTPUT_VERBOSE] = output_verbose,
 911         [OUTPUT_EXPORT] = output_export,
 912         [OUTPUT_JSON] = output_json,
 913         [OUTPUT_JSON_PRETTY] = output_json,
 914         [OUTPUT_JSON_SSE] = output_json,
 915         [OUTPUT_CAT] = output_cat
 916 };
 917
 918 int output_journal(
 919                 FILE *f,
 920                 sd_journal *j,
 921                 OutputMode mode,
 922                 unsigned n_columns,
 923                 OutputFlags flags,
 924                 bool *ellipsized) {
 925
 926         int ret;
 927         assert(mode >= 0);
 928         assert(mode < _OUTPUT_MODE_MAX);
 929
 930         if (n_columns <= 0)
 931                 n_columns = columns();
 932
 933         ret = output_funcs[mode](f, j, mode, n_columns, flags);
 934         fflush(stdout);
 935
 936         if (ellipsized && ret > 0)
 937                 *ellipsized = true;
 938
 939         return ret;
 940 }
 941
 942 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
 943         assert(f);
 944         assert(flags);
 945
 946         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
 947                 return 0;
 948
 949         /* Print a beginning new line if that's request, but only once
 950          * on the first line we print. */
 951
 952         fputc('\n', f);
 953         *flags &= ~OUTPUT_BEGIN_NEWLINE;
 954         return 0;
 955 }
 956
 957 static int show_journal(FILE *f,
 958                         sd_journal *j,
 959                         OutputMode mode,
 960                         unsigned n_columns,
 961                         usec_t not_before,
 962                         unsigned how_many,
 963                         OutputFlags flags,
 964                         bool *ellipsized) {
 965
 966         int r;
 967         unsigned line = 0;
 968         bool need_seek = false;
 969         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
 970
 971         assert(j);
 972         assert(mode >= 0);
 973         assert(mode < _OUTPUT_MODE_MAX);
 974
 975         /* Seek to end */
 976         r = sd_journal_seek_tail(j);
 977         if (r < 0)
 978                 return log_error_errno(r, "Failed to seek to tail: %m");
 979
 980         r = sd_journal_previous_skip(j, how_many);
 981         if (r < 0)
 982                 return log_error_errno(r, "Failed to skip previous: %m");
 983
 984         for (;;) {
 985                 for (;;) {
 986                         usec_t usec;
 987
 988                         if (need_seek) {
 989                                 r = sd_journal_next(j);
 990                                 if (r < 0)
 991                                         return log_error_errno(r, "Failed to iterate through journal: %m");
 992                         }
 993
 994                         if (r == 0)
 995                                 break;
 996
 997                         need_seek = true;
 998
 999                         if (not_before > 0) {
1000                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1001
1002                                 /* -ESTALE is returned if the
1003                                    timestamp is not from this boot */
1004                                 if (r == -ESTALE)
1005                                         continue;
1006                                 else if (r < 0)
1007                                         return log_error_errno(r, "Failed to get journal time: %m");
1008
1009                                 if (usec < not_before)
1010                                         continue;
1011                         }
1012
1013                         line++;
1014                         maybe_print_begin_newline(f, &flags);
1015
1016                         r = output_journal(f, j, mode, n_columns, flags, ellipsized);
1017                         if (r < 0)
1018                                 return r;
1019                 }
1020
1021                 if (warn_cutoff && line < how_many && not_before > 0) {
1022                         sd_id128_t boot_id;
1023                         usec_t cutoff = 0;
1024
1025                         /* Check whether the cutoff line is too early */
1026
1027                         r = sd_id128_get_boot(&boot_id);
1028                         if (r < 0)
1029                                 return log_error_errno(r, "Failed to get boot id: %m");
1030
1031                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1032                         if (r < 0)
1033                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1034
1035                         if (r > 0 && not_before < cutoff) {
1036                                 maybe_print_begin_newline(f, &flags);
1037                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1038                         }
1039
1040                         warn_cutoff = false;
1041                 }
1042
1043                 if (!(flags & OUTPUT_FOLLOW))
1044                         break;
1045
1046                 r = sd_journal_wait(j, USEC_INFINITY);
1047                 if (r < 0)
1048                         return log_error_errno(r, "Failed to wait for journal: %m");
1049
1050         }
1051
1052         return 0;
1053 }
1054
1055 int add_matches_for_unit(sd_journal *j, const char *unit) {
1056         const char *m1, *m2, *m3, *m4;
1057         int r;
1058
1059         assert(j);
1060         assert(unit);
1061
1062         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1063         m2 = strjoina("COREDUMP_UNIT=", unit);
1064         m3 = strjoina("UNIT=", unit);
1065         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1066
1067         (void)(
1068             /* Look for messages from the service itself */
1069             (r = sd_journal_add_match(j, m1, 0)) ||
1070
1071             /* Look for coredumps of the service */
1072             (r = sd_journal_add_disjunction(j)) ||
1073             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1074             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1075             (r = sd_journal_add_match(j, m2, 0)) ||
1076
1077              /* Look for messages from PID 1 about this service */
1078             (r = sd_journal_add_disjunction(j)) ||
1079             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1080             (r = sd_journal_add_match(j, m3, 0)) ||
1081
1082             /* Look for messages from authorized daemons about this service */
1083             (r = sd_journal_add_disjunction(j)) ||
1084             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1085             (r = sd_journal_add_match(j, m4, 0))
1086         );
1087
1088         if (r == 0 && endswith(unit, ".slice")) {
1089                 const char *m5;
1090
1091                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1092
1093                 /* Show all messages belonging to a slice */
1094                 (void)(
1095                         (r = sd_journal_add_disjunction(j)) ||
1096                         (r = sd_journal_add_match(j, m5, 0))
1097                         );
1098         }
1099
1100         return r;
1101 }
1102
1103 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1104         int r;
1105         char *m1, *m2, *m3, *m4;
1106         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1107
1108         assert(j);
1109         assert(unit);
1110
1111         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1112         m2 = strjoina("USER_UNIT=", unit);
1113         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1114         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1115         sprintf(muid, "_UID="UID_FMT, uid);
1116
1117         (void) (
1118                 /* Look for messages from the user service itself */
1119                 (r = sd_journal_add_match(j, m1, 0)) ||
1120                 (r = sd_journal_add_match(j, muid, 0)) ||
1121
1122                 /* Look for messages from systemd about this service */
1123                 (r = sd_journal_add_disjunction(j)) ||
1124                 (r = sd_journal_add_match(j, m2, 0)) ||
1125                 (r = sd_journal_add_match(j, muid, 0)) ||
1126
1127                 /* Look for coredumps of the service */
1128                 (r = sd_journal_add_disjunction(j)) ||
1129                 (r = sd_journal_add_match(j, m3, 0)) ||
1130                 (r = sd_journal_add_match(j, muid, 0)) ||
1131                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1132
1133                 /* Look for messages from authorized daemons about this service */
1134                 (r = sd_journal_add_disjunction(j)) ||
1135                 (r = sd_journal_add_match(j, m4, 0)) ||
1136                 (r = sd_journal_add_match(j, muid, 0)) ||
1137                 (r = sd_journal_add_match(j, "_UID=0", 0))
1138         );
1139
1140         if (r == 0 && endswith(unit, ".slice")) {
1141                 const char *m5;
1142
1143                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1144
1145                 /* Show all messages belonging to a slice */
1146                 (void)(
1147                         (r = sd_journal_add_disjunction(j)) ||
1148                         (r = sd_journal_add_match(j, m5, 0)) ||
1149                         (r = sd_journal_add_match(j, muid, 0))
1150                         );
1151         }
1152
1153         return r;
1154 }
1155
1156 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1157         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1158         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1159         pid_t pid, child;
1160         siginfo_t si;
1161         char buf[37];
1162         ssize_t k;
1163         int r;
1164
1165         assert(machine);
1166         assert(boot_id);
1167
1168         if (!machine_name_is_valid(machine))
1169                 return -EINVAL;
1170
1171         r = container_get_leader(machine, &pid);
1172         if (r < 0)
1173                 return r;
1174
1175         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1176         if (r < 0)
1177                 return r;
1178
1179         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1180                 return -errno;
1181
1182         child = fork();
1183         if (child < 0)
1184                 return -errno;
1185
1186         if (child == 0) {
1187                 int fd;
1188
1189                 pair[0] = safe_close(pair[0]);
1190
1191                 r = namespace_enter(pidnsfd, mntnsfd, -1, -1, rootfd);
1192                 if (r < 0)
1193                         _exit(EXIT_FAILURE);
1194
1195                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1196                 if (fd < 0)
1197                         _exit(EXIT_FAILURE);
1198
1199                 r = loop_read_exact(fd, buf, 36, false);
1200                 safe_close(fd);
1201                 if (r < 0)
1202                         _exit(EXIT_FAILURE);
1203
1204                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1205                 if (k != 36)
1206                         _exit(EXIT_FAILURE);
1207
1208                 _exit(EXIT_SUCCESS);
1209         }
1210
1211         pair[1] = safe_close(pair[1]);
1212
1213         r = wait_for_terminate(child, &si);
1214         if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS)
1215                 return r < 0 ? r : -EIO;
1216
1217         k = recv(pair[0], buf, 36, 0);
1218         if (k != 36)
1219                 return -EIO;
1220
1221         buf[36] = 0;
1222         r = sd_id128_from_string(buf, boot_id);
1223         if (r < 0)
1224                 return r;
1225
1226         return 0;
1227 }
1228
1229 int add_match_this_boot(sd_journal *j, const char *machine) {
1230         char match[9+32+1] = "_BOOT_ID=";
1231         sd_id128_t boot_id;
1232         int r;
1233
1234         assert(j);
1235
1236         if (machine) {
1237                 r = get_boot_id_for_machine(machine, &boot_id);
1238                 if (r < 0)
1239                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1240         } else {
1241                 r = sd_id128_get_boot(&boot_id);
1242                 if (r < 0)
1243                         return log_error_errno(r, "Failed to get boot id: %m");
1244         }
1245
1246         sd_id128_to_string(boot_id, match + 9);
1247         r = sd_journal_add_match(j, match, strlen(match));
1248         if (r < 0)
1249                 return log_error_errno(r, "Failed to add match: %m");
1250
1251         r = sd_journal_add_conjunction(j);
1252         if (r < 0)
1253                 return log_error_errno(r, "Failed to add conjunction: %m");
1254
1255         return 0;
1256 }
1257
1258 int show_journal_by_unit(
1259                 FILE *f,
1260                 const char *unit,
1261                 OutputMode mode,
1262                 unsigned n_columns,
1263                 usec_t not_before,
1264                 unsigned how_many,
1265                 uid_t uid,
1266                 OutputFlags flags,
1267                 int journal_open_flags,
1268                 bool system_unit,
1269                 bool *ellipsized) {
1270
1271         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1272         int r;
1273
1274         assert(mode >= 0);
1275         assert(mode < _OUTPUT_MODE_MAX);
1276         assert(unit);
1277
1278         if (how_many <= 0)
1279                 return 0;
1280
1281         r = sd_journal_open(&j, journal_open_flags);
1282         if (r < 0)
1283                 return log_error_errno(r, "Failed to open journal: %m");
1284
1285         r = add_match_this_boot(j, NULL);
1286         if (r < 0)
1287                 return r;
1288
1289         if (system_unit)
1290                 r = add_matches_for_unit(j, unit);
1291         else
1292                 r = add_matches_for_user_unit(j, unit, uid);
1293         if (r < 0)
1294                 return log_error_errno(r, "Failed to add unit matches: %m");
1295
1296         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1297                 _cleanup_free_ char *filter;
1298
1299                 filter = journal_make_match_string(j);
1300                 if (!filter)
1301                         return log_oom();
1302
1303                 log_debug("Journal filter: %s", filter);
1304         }
1305
1306         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1307 }