src/shared/logs-show.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <signal.h>
  23 #include <stdint.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <syslog.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32 #include "sd-journal.h"
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "formats-util.h"
  37 #include "hashmap.h"
  38 #include "hostname-util.h"
  39 #include "io-util.h"
  40 #include "journal-internal.h"
  41 #include "log.h"
  42 #include "logs-show.h"
  43 #include "macro.h"
  44 #include "output-mode.h"
  45 #include "parse-util.h"
  46 #include "process-util.h"
  47 #include "sparse-endian.h"
  48 #include "stdio-util.h"
  49 #include "string-table.h"
  50 #include "string-util.h"
  51 #include "terminal-util.h"
  52 #include "time-util.h"
  53 #include "utf8.h"
  54 #include "util.h"
  55
  56 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  57 #define PRINT_LINE_THRESHOLD 3
  58 #define PRINT_CHAR_THRESHOLD 300
  59
  60 #define JSON_THRESHOLD 4096
  61
  62 static int print_catalog(FILE *f, sd_journal *j) {
  63         int r;
  64         _cleanup_free_ char *t = NULL, *z = NULL;
  65
  66
  67         r = sd_journal_get_catalog(j, &t);
  68         if (r < 0)
  69                 return r;
  70
  71         z = strreplace(strstrip(t), "\n", "\n-- ");
  72         if (!z)
  73                 return log_oom();
  74
  75         fputs("-- ", f);
  76         fputs(z, f);
  77         fputc('\n', f);
  78
  79         return 0;
  80 }
  81
  82 static int parse_field(const void *data, size_t length, const char *field, char **target, size_t *target_size) {
  83         size_t fl, nl;
  84         char *buf;
  85
  86         assert(data);
  87         assert(field);
  88         assert(target);
  89
  90         fl = strlen(field);
  91         if (length < fl)
  92                 return 0;
  93
  94         if (memcmp(data, field, fl))
  95                 return 0;
  96
  97         nl = length - fl;
  98         buf = new(char, nl+1);
  99         if (!buf)
 100                 return log_oom();
 101
 102         memcpy(buf, (const char*) data + fl, nl);
 103         buf[nl] = 0;
 104
 105         free(*target);
 106         *target = buf;
 107
 108         if (target_size)
 109                 *target_size = nl;
 110
 111         return 1;
 112 }
 113
 114 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 115         assert(p);
 116
 117         if (flags & OUTPUT_SHOW_ALL)
 118                 return true;
 119
 120         if (l >= PRINT_CHAR_THRESHOLD)
 121                 return false;
 122
 123         if (!utf8_is_printable(p, l))
 124                 return false;
 125
 126         return true;
 127 }
 128
 129 static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
 130         const char *color_on = "", *color_off = "";
 131         const char *pos, *end;
 132         bool ellipsized = false;
 133         int line = 0;
 134
 135         if (flags & OUTPUT_COLOR) {
 136                 if (priority <= LOG_ERR) {
 137                         color_on = ANSI_HIGHLIGHT_RED;
 138                         color_off = ANSI_NORMAL;
 139                 } else if (priority <= LOG_NOTICE) {
 140                         color_on = ANSI_HIGHLIGHT;
 141                         color_off = ANSI_NORMAL;
 142                 }
 143         }
 144
 145         /* A special case: make sure that we print a newline when
 146            the message is empty. */
 147         if (message_len == 0)
 148                 fputs("\n", f);
 149
 150         for (pos = message;
 151              pos < message + message_len;
 152              pos = end + 1, line++) {
 153                 bool continuation = line > 0;
 154                 bool tail_line;
 155                 int len;
 156                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 157                         ;
 158                 len = end - pos;
 159                 assert(len >= 0);
 160
 161                 /* We need to figure out when we are showing not-last line, *and*
 162                  * will skip subsequent lines. In that case, we will put the dots
 163                  * at the end of the line, instead of putting dots in the middle
 164                  * or not at all.
 165                  */
 166                 tail_line =
 167                         line + 1 == PRINT_LINE_THRESHOLD ||
 168                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 169
 170                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 171                     (prefix + len + 1 < n_columns && !tail_line)) {
 172                         fprintf(f, "%*s%s%.*s%s\n",
 173                                 continuation * prefix, "",
 174                                 color_on, len, pos, color_off);
 175                         continue;
 176                 }
 177
 178                 /* Beyond this point, ellipsization will happen. */
 179                 ellipsized = true;
 180
 181                 if (prefix < n_columns && n_columns - prefix >= 3) {
 182                         if (n_columns - prefix > (unsigned) len + 3)
 183                                 fprintf(f, "%*s%s%.*s...%s\n",
 184                                         continuation * prefix, "",
 185                                         color_on, len, pos, color_off);
 186                         else {
 187                                 _cleanup_free_ char *e;
 188
 189                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 190                                                   tail_line ? 100 : 90);
 191                                 if (!e)
 192                                         fprintf(f, "%*s%s%.*s%s\n",
 193                                                 continuation * prefix, "",
 194                                                 color_on, len, pos, color_off);
 195                                 else
 196                                         fprintf(f, "%*s%s%s%s\n",
 197                                                 continuation * prefix, "",
 198                                                 color_on, e, color_off);
 199                         }
 200                 } else
 201                         fputs("...\n", f);
 202
 203                 if (tail_line)
 204                         break;
 205         }
 206
 207         return ellipsized;
 208 }
 209
 210 static int output_timestamp_monotonic(FILE *f, sd_journal *j, const char *monotonic) {
 211         sd_id128_t boot_id;
 212         uint64_t t;
 213         int r;
 214
 215         assert(f);
 216         assert(j);
 217
 218         r = -ENXIO;
 219         if (monotonic)
 220                 r = safe_atou64(monotonic, &t);
 221         if (r < 0)
 222                 r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 223         if (r < 0)
 224                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 225
 226         fprintf(f, "[%5llu.%06llu]",
 227                 (unsigned long long) (t / USEC_PER_SEC),
 228                 (unsigned long long) (t % USEC_PER_SEC));
 229
 230         return 1 + 5 + 1 + 6 + 1;
 231 }
 232
 233 static int output_timestamp_realtime(FILE *f, sd_journal *j, OutputMode mode, OutputFlags flags, const char *realtime) {
 234         char buf[MAX(FORMAT_TIMESTAMP_MAX, 64)];
 235         struct tm *(*gettime_r)(const time_t *, struct tm *);
 236         struct tm tm;
 237         uint64_t x;
 238         time_t t;
 239         int r;
 240
 241         assert(f);
 242         assert(j);
 243
 244         r = -ENXIO;
 245         if (realtime)
 246                 r = safe_atou64(realtime, &x);
 247         if (r < 0)
 248                 r = sd_journal_get_realtime_usec(j, &x);
 249         if (r < 0)
 250                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 251
 252         if (mode == OUTPUT_SHORT_FULL) {
 253                 const char *k;
 254
 255                 if (flags & OUTPUT_UTC)
 256                         k = format_timestamp_utc(buf, sizeof(buf), x);
 257                 else
 258                         k = format_timestamp(buf, sizeof(buf), x);
 259                 if (!k) {
 260                         log_error("Failed to format timestamp.");
 261                         return -EINVAL;
 262                 }
 263
 264         } else {
 265                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 266                 t = (time_t) (x / USEC_PER_SEC);
 267
 268                 switch (mode) {
 269
 270                 case OUTPUT_SHORT_UNIX:
 271                         xsprintf(buf, "%10llu.%06llu", (unsigned long long) t, (unsigned long long) (x % USEC_PER_SEC));
 272                         break;
 273
 274                 case OUTPUT_SHORT_ISO:
 275                         if (strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm)) <= 0) {
 276                                 log_error("Failed for format ISO time");
 277                                 return -EINVAL;
 278                         }
 279                         break;
 280
 281                 case OUTPUT_SHORT:
 282                 case OUTPUT_SHORT_PRECISE:
 283
 284                         if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm)) <= 0) {
 285                                 log_error("Failed to format syslog time");
 286                                 return -EINVAL;
 287                         }
 288
 289                         if (mode == OUTPUT_SHORT_PRECISE) {
 290                                 size_t k;
 291
 292                                 assert(sizeof(buf) > strlen(buf));
 293                                 k = sizeof(buf) - strlen(buf);
 294
 295                                 r = snprintf(buf + strlen(buf), k, ".%06llu", (unsigned long long) (x % USEC_PER_SEC));
 296                                 if (r <= 0 || (size_t) r >= k) { /* too long? */
 297                                         log_error("Failed to format precise time");
 298                                         return -EINVAL;
 299                                 }
 300                         }
 301                         break;
 302
 303                 default:
 304                         assert_not_reached("Unknown time format");
 305                 }
 306         }
 307
 308         fputs(buf, f);
 309         return (int) strlen(buf);
 310 }
 311
 312 static int output_short(
 313                 FILE *f,
 314                 sd_journal *j,
 315                 OutputMode mode,
 316                 unsigned n_columns,
 317                 OutputFlags flags) {
 318
 319         int r;
 320         const void *data;
 321         size_t length;
 322         size_t n = 0;
 323         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
 324         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
 325         int p = LOG_INFO;
 326         bool ellipsized = false;
 327
 328         assert(f);
 329         assert(j);
 330
 331         /* Set the threshold to one bigger than the actual print
 332          * threshold, so that if the line is actually longer than what
 333          * we're willing to print, ellipsization will occur. This way
 334          * we won't output a misleading line without any indication of
 335          * truncation.
 336          */
 337         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 338
 339         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 340
 341                 r = parse_field(data, length, "PRIORITY=", &priority, &priority_len);
 342                 if (r < 0)
 343                         return r;
 344                 else if (r > 0)
 345                         continue;
 346
 347                 r = parse_field(data, length, "_HOSTNAME=", &hostname, &hostname_len);
 348                 if (r < 0)
 349                         return r;
 350                 else if (r > 0)
 351                         continue;
 352
 353                 r = parse_field(data, length, "SYSLOG_IDENTIFIER=", &identifier, &identifier_len);
 354                 if (r < 0)
 355                         return r;
 356                 else if (r > 0)
 357                         continue;
 358
 359                 r = parse_field(data, length, "_COMM=", &comm, &comm_len);
 360                 if (r < 0)
 361                         return r;
 362                 else if (r > 0)
 363                         continue;
 364
 365                 r = parse_field(data, length, "_PID=", &pid, &pid_len);
 366                 if (r < 0)
 367                         return r;
 368                 else if (r > 0)
 369                         continue;
 370
 371                 r = parse_field(data, length, "SYSLOG_PID=", &fake_pid, &fake_pid_len);
 372                 if (r < 0)
 373                         return r;
 374                 else if (r > 0)
 375                         continue;
 376
 377                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len);
 378                 if (r < 0)
 379                         return r;
 380                 else if (r > 0)
 381                         continue;
 382
 383                 r = parse_field(data, length, "_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len);
 384                 if (r < 0)
 385                         return r;
 386                 else if (r > 0)
 387                         continue;
 388
 389                 r = parse_field(data, length, "MESSAGE=", &message, &message_len);
 390                 if (r < 0)
 391                         return r;
 392         }
 393         if (r == -EBADMSG) {
 394                 log_debug_errno(r, "Skipping message we can't read: %m");
 395                 return 0;
 396         }
 397         if (r < 0)
 398                 return log_error_errno(r, "Failed to get journal fields: %m");
 399
 400         if (!message) {
 401                 log_debug("Skipping message without MESSAGE= field.");
 402                 return 0;
 403         }
 404
 405         if (!(flags & OUTPUT_SHOW_ALL))
 406                 strip_tab_ansi(&message, &message_len);
 407
 408         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 409                 p = *priority - '0';
 410
 411         if (mode == OUTPUT_SHORT_MONOTONIC)
 412                 r = output_timestamp_monotonic(f, j, monotonic);
 413         else
 414                 r = output_timestamp_realtime(f, j, mode, flags, realtime);
 415         if (r < 0)
 416                 return r;
 417         n += r;
 418
 419         if (flags & OUTPUT_NO_HOSTNAME) {
 420                 /* Suppress display of the hostname if this is requested. */
 421                 hostname = mfree(hostname);
 422                 hostname_len = 0;
 423         }
 424
 425         if (hostname && shall_print(hostname, hostname_len, flags)) {
 426                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 427                 n += hostname_len + 1;
 428         }
 429
 430         if (identifier && shall_print(identifier, identifier_len, flags)) {
 431                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 432                 n += identifier_len + 1;
 433         } else if (comm && shall_print(comm, comm_len, flags)) {
 434                 fprintf(f, " %.*s", (int) comm_len, comm);
 435                 n += comm_len + 1;
 436         } else
 437                 fputs(" unknown", f);
 438
 439         if (pid && shall_print(pid, pid_len, flags)) {
 440                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 441                 n += pid_len + 2;
 442         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 443                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 444                 n += fake_pid_len + 2;
 445         }
 446
 447         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 448                 char bytes[FORMAT_BYTES_MAX];
 449                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 450         } else {
 451                 fputs(": ", f);
 452                 ellipsized |=
 453                         print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
 454         }
 455
 456         if (flags & OUTPUT_CATALOG)
 457                 print_catalog(f, j);
 458
 459         return ellipsized;
 460 }
 461
 462 static int output_verbose(
 463                 FILE *f,
 464                 sd_journal *j,
 465                 OutputMode mode,
 466                 unsigned n_columns,
 467                 OutputFlags flags) {
 468
 469         const void *data;
 470         size_t length;
 471         _cleanup_free_ char *cursor = NULL;
 472         uint64_t realtime = 0;
 473         char ts[FORMAT_TIMESTAMP_MAX + 7];
 474         int r;
 475
 476         assert(f);
 477         assert(j);
 478
 479         sd_journal_set_data_threshold(j, 0);
 480
 481         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 482         if (r == -ENOENT)
 483                 log_debug("Source realtime timestamp not found");
 484         else if (r < 0)
 485                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 486         else {
 487                 _cleanup_free_ char *value = NULL;
 488
 489                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &value, NULL);
 490                 if (r < 0)
 491                         return r;
 492                 assert(r > 0);
 493
 494                 r = safe_atou64(value, &realtime);
 495                 if (r < 0)
 496                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 497         }
 498
 499         if (r < 0) {
 500                 r = sd_journal_get_realtime_usec(j, &realtime);
 501                 if (r < 0)
 502                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 503         }
 504
 505         r = sd_journal_get_cursor(j, &cursor);
 506         if (r < 0)
 507                 return log_error_errno(r, "Failed to get cursor: %m");
 508
 509         fprintf(f, "%s [%s]\n",
 510                 flags & OUTPUT_UTC ?
 511                 format_timestamp_us_utc(ts, sizeof(ts), realtime) :
 512                 format_timestamp_us(ts, sizeof(ts), realtime),
 513                 cursor);
 514
 515         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 516                 const char *c;
 517                 int fieldlen;
 518                 const char *on = "", *off = "";
 519
 520                 c = memchr(data, '=', length);
 521                 if (!c) {
 522                         log_error("Invalid field.");
 523                         return -EINVAL;
 524                 }
 525                 fieldlen = c - (const char*) data;
 526
 527                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 528                         on = ANSI_HIGHLIGHT;
 529                         off = ANSI_NORMAL;
 530                 }
 531
 532                 if ((flags & OUTPUT_SHOW_ALL) ||
 533                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 534                      && utf8_is_printable(data, length))) {
 535                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 536                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
 537                         fputs(off, f);
 538                 } else {
 539                         char bytes[FORMAT_BYTES_MAX];
 540
 541                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 542                                 on,
 543                                 (int) (c - (const char*) data),
 544                                 (const char*) data,
 545                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 546                                 off);
 547                 }
 548         }
 549
 550         if (r < 0)
 551                 return r;
 552
 553         if (flags & OUTPUT_CATALOG)
 554                 print_catalog(f, j);
 555
 556         return 0;
 557 }
 558
 559 static int output_export(
 560                 FILE *f,
 561                 sd_journal *j,
 562                 OutputMode mode,
 563                 unsigned n_columns,
 564                 OutputFlags flags) {
 565
 566         sd_id128_t boot_id;
 567         char sid[33];
 568         int r;
 569         usec_t realtime, monotonic;
 570         _cleanup_free_ char *cursor = NULL;
 571         const void *data;
 572         size_t length;
 573
 574         assert(j);
 575
 576         sd_journal_set_data_threshold(j, 0);
 577
 578         r = sd_journal_get_realtime_usec(j, &realtime);
 579         if (r < 0)
 580                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 581
 582         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 583         if (r < 0)
 584                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 585
 586         r = sd_journal_get_cursor(j, &cursor);
 587         if (r < 0)
 588                 return log_error_errno(r, "Failed to get cursor: %m");
 589
 590         fprintf(f,
 591                 "__CURSOR=%s\n"
 592                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 593                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 594                 "_BOOT_ID=%s\n",
 595                 cursor,
 596                 realtime,
 597                 monotonic,
 598                 sd_id128_to_string(boot_id, sid));
 599
 600         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 601
 602                 /* We already printed the boot id, from the data in
 603                  * the header, hence let's suppress it here */
 604                 if (length >= 9 &&
 605                     startswith(data, "_BOOT_ID="))
 606                         continue;
 607
 608                 if (utf8_is_printable_newline(data, length, false))
 609                         fwrite(data, length, 1, f);
 610                 else {
 611                         const char *c;
 612                         uint64_t le64;
 613
 614                         c = memchr(data, '=', length);
 615                         if (!c) {
 616                                 log_error("Invalid field.");
 617                                 return -EINVAL;
 618                         }
 619
 620                         fwrite(data, c - (const char*) data, 1, f);
 621                         fputc('\n', f);
 622                         le64 = htole64(length - (c - (const char*) data) - 1);
 623                         fwrite(&le64, sizeof(le64), 1, f);
 624                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 625                 }
 626
 627                 fputc('\n', f);
 628         }
 629
 630         if (r < 0)
 631                 return r;
 632
 633         fputc('\n', f);
 634
 635         return 0;
 636 }
 637
 638 void json_escape(
 639                 FILE *f,
 640                 const char* p,
 641                 size_t l,
 642                 OutputFlags flags) {
 643
 644         assert(f);
 645         assert(p);
 646
 647         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 648                 fputs("null", f);
 649
 650         else if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(p, l)) {
 651                 bool not_first = false;
 652
 653                 fputs("[ ", f);
 654
 655                 while (l > 0) {
 656                         if (not_first)
 657                                 fprintf(f, ", %u", (uint8_t) *p);
 658                         else {
 659                                 not_first = true;
 660                                 fprintf(f, "%u", (uint8_t) *p);
 661                         }
 662
 663                         p++;
 664                         l--;
 665                 }
 666
 667                 fputs(" ]", f);
 668         } else {
 669                 fputc('\"', f);
 670
 671                 while (l > 0) {
 672                         if (*p == '"' || *p == '\\') {
 673                                 fputc('\\', f);
 674                                 fputc(*p, f);
 675                         } else if (*p == '\n')
 676                                 fputs("\\n", f);
 677                         else if ((uint8_t) *p < ' ')
 678                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 679                         else
 680                                 fputc(*p, f);
 681
 682                         p++;
 683                         l--;
 684                 }
 685
 686                 fputc('\"', f);
 687         }
 688 }
 689
 690 static int output_json(
 691                 FILE *f,
 692                 sd_journal *j,
 693                 OutputMode mode,
 694                 unsigned n_columns,
 695                 OutputFlags flags) {
 696
 697         uint64_t realtime, monotonic;
 698         _cleanup_free_ char *cursor = NULL;
 699         const void *data;
 700         size_t length;
 701         sd_id128_t boot_id;
 702         char sid[33], *k;
 703         int r;
 704         Hashmap *h = NULL;
 705         bool done, separator;
 706
 707         assert(j);
 708
 709         sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 710
 711         r = sd_journal_get_realtime_usec(j, &realtime);
 712         if (r < 0)
 713                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 714
 715         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 716         if (r < 0)
 717                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 718
 719         r = sd_journal_get_cursor(j, &cursor);
 720         if (r < 0)
 721                 return log_error_errno(r, "Failed to get cursor: %m");
 722
 723         if (mode == OUTPUT_JSON_PRETTY)
 724                 fprintf(f,
 725                         "{\n"
 726                         "\t\"__CURSOR\" : \"%s\",\n"
 727                         "\t\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\",\n"
 728                         "\t\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\",\n"
 729                         "\t\"_BOOT_ID\" : \"%s\"",
 730                         cursor,
 731                         realtime,
 732                         monotonic,
 733                         sd_id128_to_string(boot_id, sid));
 734         else {
 735                 if (mode == OUTPUT_JSON_SSE)
 736                         fputs("data: ", f);
 737
 738                 fprintf(f,
 739                         "{ \"__CURSOR\" : \"%s\", "
 740                         "\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\", "
 741                         "\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\", "
 742                         "\"_BOOT_ID\" : \"%s\"",
 743                         cursor,
 744                         realtime,
 745                         monotonic,
 746                         sd_id128_to_string(boot_id, sid));
 747         }
 748
 749         h = hashmap_new(&string_hash_ops);
 750         if (!h)
 751                 return log_oom();
 752
 753         /* First round, iterate through the entry and count how often each field appears */
 754         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 755                 const char *eq;
 756                 char *n;
 757                 unsigned u;
 758
 759                 if (length >= 9 &&
 760                     memcmp(data, "_BOOT_ID=", 9) == 0)
 761                         continue;
 762
 763                 eq = memchr(data, '=', length);
 764                 if (!eq)
 765                         continue;
 766
 767                 n = strndup(data, eq - (const char*) data);
 768                 if (!n) {
 769                         r = log_oom();
 770                         goto finish;
 771                 }
 772
 773                 u = PTR_TO_UINT(hashmap_get(h, n));
 774                 if (u == 0) {
 775                         r = hashmap_put(h, n, UINT_TO_PTR(1));
 776                         if (r < 0) {
 777                                 free(n);
 778                                 log_oom();
 779                                 goto finish;
 780                         }
 781                 } else {
 782                         r = hashmap_update(h, n, UINT_TO_PTR(u + 1));
 783                         free(n);
 784                         if (r < 0) {
 785                                 log_oom();
 786                                 goto finish;
 787                         }
 788                 }
 789         }
 790
 791         if (r < 0)
 792                 return r;
 793
 794         separator = true;
 795         do {
 796                 done = true;
 797
 798                 SD_JOURNAL_FOREACH_DATA(j, data, length) {
 799                         const char *eq;
 800                         char *kk, *n;
 801                         size_t m;
 802                         unsigned u;
 803
 804                         /* We already printed the boot id, from the data in
 805                          * the header, hence let's suppress it here */
 806                         if (length >= 9 &&
 807                             memcmp(data, "_BOOT_ID=", 9) == 0)
 808                                 continue;
 809
 810                         eq = memchr(data, '=', length);
 811                         if (!eq)
 812                                 continue;
 813
 814                         if (separator) {
 815                                 if (mode == OUTPUT_JSON_PRETTY)
 816                                         fputs(",\n\t", f);
 817                                 else
 818                                         fputs(", ", f);
 819                         }
 820
 821                         m = eq - (const char*) data;
 822
 823                         n = strndup(data, m);
 824                         if (!n) {
 825                                 r = log_oom();
 826                                 goto finish;
 827                         }
 828
 829                         u = PTR_TO_UINT(hashmap_get2(h, n, (void**) &kk));
 830                         if (u == 0) {
 831                                 /* We already printed this, let's jump to the next */
 832                                 free(n);
 833                                 separator = false;
 834
 835                                 continue;
 836                         } else if (u == 1) {
 837                                 /* Field only appears once, output it directly */
 838
 839                                 json_escape(f, data, m, flags);
 840                                 fputs(" : ", f);
 841
 842                                 json_escape(f, eq + 1, length - m - 1, flags);
 843
 844                                 hashmap_remove(h, n);
 845                                 free(kk);
 846                                 free(n);
 847
 848                                 separator = true;
 849
 850                                 continue;
 851
 852                         } else {
 853                                 /* Field appears multiple times, output it as array */
 854                                 json_escape(f, data, m, flags);
 855                                 fputs(" : [ ", f);
 856                                 json_escape(f, eq + 1, length - m - 1, flags);
 857
 858                                 /* Iterate through the end of the list */
 859
 860                                 while (sd_journal_enumerate_data(j, &data, &length) > 0) {
 861                                         if (length < m + 1)
 862                                                 continue;
 863
 864                                         if (memcmp(data, n, m) != 0)
 865                                                 continue;
 866
 867                                         if (((const char*) data)[m] != '=')
 868                                                 continue;
 869
 870                                         fputs(", ", f);
 871                                         json_escape(f, (const char*) data + m + 1, length - m - 1, flags);
 872                                 }
 873
 874                                 fputs(" ]", f);
 875
 876                                 hashmap_remove(h, n);
 877                                 free(kk);
 878                                 free(n);
 879
 880                                 /* Iterate data fields form the beginning */
 881                                 done = false;
 882                                 separator = true;
 883
 884                                 break;
 885                         }
 886                 }
 887
 888         } while (!done);
 889
 890         if (mode == OUTPUT_JSON_PRETTY)
 891                 fputs("\n}\n", f);
 892         else if (mode == OUTPUT_JSON_SSE)
 893                 fputs("}\n\n", f);
 894         else
 895                 fputs(" }\n", f);
 896
 897         r = 0;
 898
 899 finish:
 900         while ((k = hashmap_steal_first_key(h)))
 901                 free(k);
 902
 903         hashmap_free(h);
 904
 905         return r;
 906 }
 907
 908 static int output_cat(
 909                 FILE *f,
 910                 sd_journal *j,
 911                 OutputMode mode,
 912                 unsigned n_columns,
 913                 OutputFlags flags) {
 914
 915         const void *data;
 916         size_t l;
 917         int r;
 918
 919         assert(j);
 920         assert(f);
 921
 922         sd_journal_set_data_threshold(j, 0);
 923
 924         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
 925         if (r < 0) {
 926                 /* An entry without MESSAGE=? */
 927                 if (r == -ENOENT)
 928                         return 0;
 929
 930                 return log_error_errno(r, "Failed to get data: %m");
 931         }
 932
 933         assert(l >= 8);
 934
 935         fwrite((const char*) data + 8, 1, l - 8, f);
 936         fputc('\n', f);
 937
 938         return 0;
 939 }
 940
 941 static int (*output_funcs[_OUTPUT_MODE_MAX])(
 942                 FILE *f,
 943                 sd_journal*j,
 944                 OutputMode mode,
 945                 unsigned n_columns,
 946                 OutputFlags flags) = {
 947
 948         [OUTPUT_SHORT] = output_short,
 949         [OUTPUT_SHORT_ISO] = output_short,
 950         [OUTPUT_SHORT_PRECISE] = output_short,
 951         [OUTPUT_SHORT_MONOTONIC] = output_short,
 952         [OUTPUT_SHORT_UNIX] = output_short,
 953         [OUTPUT_SHORT_FULL] = output_short,
 954         [OUTPUT_VERBOSE] = output_verbose,
 955         [OUTPUT_EXPORT] = output_export,
 956         [OUTPUT_JSON] = output_json,
 957         [OUTPUT_JSON_PRETTY] = output_json,
 958         [OUTPUT_JSON_SSE] = output_json,
 959         [OUTPUT_CAT] = output_cat
 960 };
 961
 962 int output_journal(
 963                 FILE *f,
 964                 sd_journal *j,
 965                 OutputMode mode,
 966                 unsigned n_columns,
 967                 OutputFlags flags,
 968                 bool *ellipsized) {
 969
 970         int ret;
 971         assert(mode >= 0);
 972         assert(mode < _OUTPUT_MODE_MAX);
 973
 974         if (n_columns <= 0)
 975                 n_columns = columns();
 976
 977         ret = output_funcs[mode](f, j, mode, n_columns, flags);
 978         fflush(stdout);
 979
 980         if (ellipsized && ret > 0)
 981                 *ellipsized = true;
 982
 983         return ret;
 984 }
 985
 986 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
 987         assert(f);
 988         assert(flags);
 989
 990         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
 991                 return 0;
 992
 993         /* Print a beginning new line if that's request, but only once
 994          * on the first line we print. */
 995
 996         fputc('\n', f);
 997         *flags &= ~OUTPUT_BEGIN_NEWLINE;
 998         return 0;
 999 }
1000
1001 static int show_journal(FILE *f,
1002                         sd_journal *j,
1003                         OutputMode mode,
1004                         unsigned n_columns,
1005                         usec_t not_before,
1006                         unsigned how_many,
1007                         OutputFlags flags,
1008                         bool *ellipsized) {
1009
1010         int r;
1011         unsigned line = 0;
1012         bool need_seek = false;
1013         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
1014
1015         assert(j);
1016         assert(mode >= 0);
1017         assert(mode < _OUTPUT_MODE_MAX);
1018
1019         /* Seek to end */
1020         r = sd_journal_seek_tail(j);
1021         if (r < 0)
1022                 return log_error_errno(r, "Failed to seek to tail: %m");
1023
1024         r = sd_journal_previous_skip(j, how_many);
1025         if (r < 0)
1026                 return log_error_errno(r, "Failed to skip previous: %m");
1027
1028         for (;;) {
1029                 for (;;) {
1030                         usec_t usec;
1031
1032                         if (need_seek) {
1033                                 r = sd_journal_next(j);
1034                                 if (r < 0)
1035                                         return log_error_errno(r, "Failed to iterate through journal: %m");
1036                         }
1037
1038                         if (r == 0)
1039                                 break;
1040
1041                         need_seek = true;
1042
1043                         if (not_before > 0) {
1044                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
1045
1046                                 /* -ESTALE is returned if the
1047                                    timestamp is not from this boot */
1048                                 if (r == -ESTALE)
1049                                         continue;
1050                                 else if (r < 0)
1051                                         return log_error_errno(r, "Failed to get journal time: %m");
1052
1053                                 if (usec < not_before)
1054                                         continue;
1055                         }
1056
1057                         line++;
1058                         maybe_print_begin_newline(f, &flags);
1059
1060                         r = output_journal(f, j, mode, n_columns, flags, ellipsized);
1061                         if (r < 0)
1062                                 return r;
1063                 }
1064
1065                 if (warn_cutoff && line < how_many && not_before > 0) {
1066                         sd_id128_t boot_id;
1067                         usec_t cutoff = 0;
1068
1069                         /* Check whether the cutoff line is too early */
1070
1071                         r = sd_id128_get_boot(&boot_id);
1072                         if (r < 0)
1073                                 return log_error_errno(r, "Failed to get boot id: %m");
1074
1075                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1076                         if (r < 0)
1077                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1078
1079                         if (r > 0 && not_before < cutoff) {
1080                                 maybe_print_begin_newline(f, &flags);
1081                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1082                         }
1083
1084                         warn_cutoff = false;
1085                 }
1086
1087                 if (!(flags & OUTPUT_FOLLOW))
1088                         break;
1089
1090                 r = sd_journal_wait(j, USEC_INFINITY);
1091                 if (r < 0)
1092                         return log_error_errno(r, "Failed to wait for journal: %m");
1093
1094         }
1095
1096         return 0;
1097 }
1098
1099 int add_matches_for_unit(sd_journal *j, const char *unit) {
1100         const char *m1, *m2, *m3, *m4;
1101         int r;
1102
1103         assert(j);
1104         assert(unit);
1105
1106         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1107         m2 = strjoina("COREDUMP_UNIT=", unit);
1108         m3 = strjoina("UNIT=", unit);
1109         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1110
1111         (void)(
1112             /* Look for messages from the service itself */
1113             (r = sd_journal_add_match(j, m1, 0)) ||
1114
1115             /* Look for coredumps of the service */
1116             (r = sd_journal_add_disjunction(j)) ||
1117             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1118             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1119             (r = sd_journal_add_match(j, m2, 0)) ||
1120
1121              /* Look for messages from PID 1 about this service */
1122             (r = sd_journal_add_disjunction(j)) ||
1123             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1124             (r = sd_journal_add_match(j, m3, 0)) ||
1125
1126             /* Look for messages from authorized daemons about this service */
1127             (r = sd_journal_add_disjunction(j)) ||
1128             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1129             (r = sd_journal_add_match(j, m4, 0))
1130         );
1131
1132         if (r == 0 && endswith(unit, ".slice")) {
1133                 const char *m5;
1134
1135                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1136
1137                 /* Show all messages belonging to a slice */
1138                 (void)(
1139                         (r = sd_journal_add_disjunction(j)) ||
1140                         (r = sd_journal_add_match(j, m5, 0))
1141                         );
1142         }
1143
1144         return r;
1145 }
1146
1147 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1148         int r;
1149         char *m1, *m2, *m3, *m4;
1150         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1151
1152         assert(j);
1153         assert(unit);
1154
1155         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1156         m2 = strjoina("USER_UNIT=", unit);
1157         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1158         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1159         sprintf(muid, "_UID="UID_FMT, uid);
1160
1161         (void) (
1162                 /* Look for messages from the user service itself */
1163                 (r = sd_journal_add_match(j, m1, 0)) ||
1164                 (r = sd_journal_add_match(j, muid, 0)) ||
1165
1166                 /* Look for messages from systemd about this service */
1167                 (r = sd_journal_add_disjunction(j)) ||
1168                 (r = sd_journal_add_match(j, m2, 0)) ||
1169                 (r = sd_journal_add_match(j, muid, 0)) ||
1170
1171                 /* Look for coredumps of the service */
1172                 (r = sd_journal_add_disjunction(j)) ||
1173                 (r = sd_journal_add_match(j, m3, 0)) ||
1174                 (r = sd_journal_add_match(j, muid, 0)) ||
1175                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1176
1177                 /* Look for messages from authorized daemons about this service */
1178                 (r = sd_journal_add_disjunction(j)) ||
1179                 (r = sd_journal_add_match(j, m4, 0)) ||
1180                 (r = sd_journal_add_match(j, muid, 0)) ||
1181                 (r = sd_journal_add_match(j, "_UID=0", 0))
1182         );
1183
1184         if (r == 0 && endswith(unit, ".slice")) {
1185                 const char *m5;
1186
1187                 m5 = strjoina("_SYSTEMD_SLICE=", unit);
1188
1189                 /* Show all messages belonging to a slice */
1190                 (void)(
1191                         (r = sd_journal_add_disjunction(j)) ||
1192                         (r = sd_journal_add_match(j, m5, 0)) ||
1193                         (r = sd_journal_add_match(j, muid, 0))
1194                         );
1195         }
1196
1197         return r;
1198 }
1199
1200 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1201         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1202         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1203         pid_t pid, child;
1204         siginfo_t si;
1205         char buf[37];
1206         ssize_t k;
1207         int r;
1208
1209         assert(machine);
1210         assert(boot_id);
1211
1212         if (!machine_name_is_valid(machine))
1213                 return -EINVAL;
1214
1215         r = container_get_leader(machine, &pid);
1216         if (r < 0)
1217                 return r;
1218
1219         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1220         if (r < 0)
1221                 return r;
1222
1223         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1224                 return -errno;
1225
1226         child = fork();
1227         if (child < 0)
1228                 return -errno;
1229
1230         if (child == 0) {
1231                 int fd;
1232
1233                 pair[0] = safe_close(pair[0]);
1234
1235                 r = namespace_enter(pidnsfd, mntnsfd, -1, -1, rootfd);
1236                 if (r < 0)
1237                         _exit(EXIT_FAILURE);
1238
1239                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1240                 if (fd < 0)
1241                         _exit(EXIT_FAILURE);
1242
1243                 r = loop_read_exact(fd, buf, 36, false);
1244                 safe_close(fd);
1245                 if (r < 0)
1246                         _exit(EXIT_FAILURE);
1247
1248                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1249                 if (k != 36)
1250                         _exit(EXIT_FAILURE);
1251
1252                 _exit(EXIT_SUCCESS);
1253         }
1254
1255         pair[1] = safe_close(pair[1]);
1256
1257         r = wait_for_terminate(child, &si);
1258         if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS)
1259                 return r < 0 ? r : -EIO;
1260
1261         k = recv(pair[0], buf, 36, 0);
1262         if (k != 36)
1263                 return -EIO;
1264
1265         buf[36] = 0;
1266         r = sd_id128_from_string(buf, boot_id);
1267         if (r < 0)
1268                 return r;
1269
1270         return 0;
1271 }
1272
1273 int add_match_this_boot(sd_journal *j, const char *machine) {
1274         char match[9+32+1] = "_BOOT_ID=";
1275         sd_id128_t boot_id;
1276         int r;
1277
1278         assert(j);
1279
1280         if (machine) {
1281                 r = get_boot_id_for_machine(machine, &boot_id);
1282                 if (r < 0)
1283                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1284         } else {
1285                 r = sd_id128_get_boot(&boot_id);
1286                 if (r < 0)
1287                         return log_error_errno(r, "Failed to get boot id: %m");
1288         }
1289
1290         sd_id128_to_string(boot_id, match + 9);
1291         r = sd_journal_add_match(j, match, strlen(match));
1292         if (r < 0)
1293                 return log_error_errno(r, "Failed to add match: %m");
1294
1295         r = sd_journal_add_conjunction(j);
1296         if (r < 0)
1297                 return log_error_errno(r, "Failed to add conjunction: %m");
1298
1299         return 0;
1300 }
1301
1302 int show_journal_by_unit(
1303                 FILE *f,
1304                 const char *unit,
1305                 OutputMode mode,
1306                 unsigned n_columns,
1307                 usec_t not_before,
1308                 unsigned how_many,
1309                 uid_t uid,
1310                 OutputFlags flags,
1311                 int journal_open_flags,
1312                 bool system_unit,
1313                 bool *ellipsized) {
1314
1315         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1316         int r;
1317
1318         assert(mode >= 0);
1319         assert(mode < _OUTPUT_MODE_MAX);
1320         assert(unit);
1321
1322         if (how_many <= 0)
1323                 return 0;
1324
1325         r = sd_journal_open(&j, journal_open_flags);
1326         if (r < 0)
1327                 return log_error_errno(r, "Failed to open journal: %m");
1328
1329         r = add_match_this_boot(j, NULL);
1330         if (r < 0)
1331                 return r;
1332
1333         if (system_unit)
1334                 r = add_matches_for_unit(j, unit);
1335         else
1336                 r = add_matches_for_user_unit(j, unit, uid);
1337         if (r < 0)
1338                 return log_error_errno(r, "Failed to add unit matches: %m");
1339
1340         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1341                 _cleanup_free_ char *filter;
1342
1343                 filter = journal_make_match_string(j);
1344                 if (!filter)
1345                         return log_oom();
1346
1347                 log_debug("Journal filter: %s", filter);
1348         }
1349
1350         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1351 }