src/shared/logs-show.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <signal.h>
  23 #include <stdint.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <syslog.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32 #include "sd-journal.h"
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "formats-util.h"
  37 #include "hashmap.h"
  38 #include "hostname-util.h"
  39 #include "io-util.h"
  40 #include "journal-internal.h"
  41 #include "log.h"
  42 #include "logs-show.h"
  43 #include "macro.h"
  44 #include "output-mode.h"
  45 #include "parse-util.h"
  46 #include "process-util.h"
  47 #include "sparse-endian.h"
  48 #include "string-table.h"
  49 #include "string-util.h"
  50 #include "terminal-util.h"
  51 #include "time-util.h"
  52 #include "utf8.h"
  53 #include "util.h"
  54
  55 /* up to three lines (each up to 100 characters) or 300 characters, whichever is less */
  56 #define PRINT_LINE_THRESHOLD 3
  57 #define PRINT_CHAR_THRESHOLD 300
  58
  59 #define JSON_THRESHOLD 4096
  60
  61 static int print_catalog(FILE *f, sd_journal *j) {
  62         int r;
  63         _cleanup_free_ char *t = NULL, *z = NULL;
  64
  65
  66         r = sd_journal_get_catalog(j, &t);
  67         if (r < 0)
  68                 return r;
  69
  70         z = strreplace(strstrip(t), "\n", "\n-- ");
  71         if (!z)
  72                 return log_oom();
  73
  74         fputs("-- ", f);
  75         fputs(z, f);
  76         fputc('\n', f);
  77
  78         return 0;
  79 }
  80
  81 static int parse_field(const void *data, size_t length, const char *field, char **target, size_t *target_size) {
  82         size_t fl, nl;
  83         char *buf;
  84
  85         assert(data);
  86         assert(field);
  87         assert(target);
  88
  89         fl = strlen(field);
  90         if (length < fl)
  91                 return 0;
  92
  93         if (memcmp(data, field, fl))
  94                 return 0;
  95
  96         nl = length - fl;
  97         buf = new(char, nl+1);
  98         if (!buf)
  99                 return log_oom();
 100
 101         memcpy(buf, (const char*) data + fl, nl);
 102         buf[nl] = 0;
 103
 104         free(*target);
 105         *target = buf;
 106
 107         if (target_size)
 108                 *target_size = nl;
 109
 110         return 1;
 111 }
 112
 113 static bool shall_print(const char *p, size_t l, OutputFlags flags) {
 114         assert(p);
 115
 116         if (flags & OUTPUT_SHOW_ALL)
 117                 return true;
 118
 119         if (l >= PRINT_CHAR_THRESHOLD)
 120                 return false;
 121
 122         if (!utf8_is_printable(p, l))
 123                 return false;
 124
 125         return true;
 126 }
 127
 128 static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
 129         const char *color_on = "", *color_off = "";
 130         const char *pos, *end;
 131         bool ellipsized = false;
 132         int line = 0;
 133
 134         if (flags & OUTPUT_COLOR) {
 135                 if (priority <= LOG_ERR) {
 136                         color_on = ANSI_HIGHLIGHT_RED;
 137                         color_off = ANSI_NORMAL;
 138                 } else if (priority <= LOG_NOTICE) {
 139                         color_on = ANSI_HIGHLIGHT;
 140                         color_off = ANSI_NORMAL;
 141                 }
 142         }
 143
 144         /* A special case: make sure that we print a newline when
 145            the message is empty. */
 146         if (message_len == 0)
 147                 fputs("\n", f);
 148
 149         for (pos = message;
 150              pos < message + message_len;
 151              pos = end + 1, line++) {
 152                 bool continuation = line > 0;
 153                 bool tail_line;
 154                 int len;
 155                 for (end = pos; end < message + message_len && *end != '\n'; end++)
 156                         ;
 157                 len = end - pos;
 158                 assert(len >= 0);
 159
 160                 /* We need to figure out when we are showing not-last line, *and*
 161                  * will skip subsequent lines. In that case, we will put the dots
 162                  * at the end of the line, instead of putting dots in the middle
 163                  * or not at all.
 164                  */
 165                 tail_line =
 166                         line + 1 == PRINT_LINE_THRESHOLD ||
 167                         end + 1 >= message + PRINT_CHAR_THRESHOLD;
 168
 169                 if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
 170                     (prefix + len + 1 < n_columns && !tail_line)) {
 171                         fprintf(f, "%*s%s%.*s%s\n",
 172                                 continuation * prefix, "",
 173                                 color_on, len, pos, color_off);
 174                         continue;
 175                 }
 176
 177                 /* Beyond this point, ellipsization will happen. */
 178                 ellipsized = true;
 179
 180                 if (prefix < n_columns && n_columns - prefix >= 3) {
 181                         if (n_columns - prefix > (unsigned) len + 3)
 182                                 fprintf(f, "%*s%s%.*s...%s\n",
 183                                         continuation * prefix, "",
 184                                         color_on, len, pos, color_off);
 185                         else {
 186                                 _cleanup_free_ char *e;
 187
 188                                 e = ellipsize_mem(pos, len, n_columns - prefix,
 189                                                   tail_line ? 100 : 90);
 190                                 if (!e)
 191                                         fprintf(f, "%*s%s%.*s%s\n",
 192                                                 continuation * prefix, "",
 193                                                 color_on, len, pos, color_off);
 194                                 else
 195                                         fprintf(f, "%*s%s%s%s\n",
 196                                                 continuation * prefix, "",
 197                                                 color_on, e, color_off);
 198                         }
 199                 } else
 200                         fputs("...\n", f);
 201
 202                 if (tail_line)
 203                         break;
 204         }
 205
 206         return ellipsized;
 207 }
 208
 209 static int output_short(
 210                 FILE *f,
 211                 sd_journal *j,
 212                 OutputMode mode,
 213                 unsigned n_columns,
 214                 OutputFlags flags) {
 215
 216         int r;
 217         const void *data;
 218         size_t length;
 219         size_t n = 0;
 220         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
 221         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
 222         int p = LOG_INFO;
 223         bool ellipsized = false;
 224
 225         assert(f);
 226         assert(j);
 227
 228         /* Set the threshold to one bigger than the actual print
 229          * threshold, so that if the line is actually longer than what
 230          * we're willing to print, ellipsization will occur. This way
 231          * we won't output a misleading line without any indication of
 232          * truncation.
 233          */
 234         sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 235
 236         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 237
 238                 r = parse_field(data, length, "PRIORITY=", &priority, &priority_len);
 239                 if (r < 0)
 240                         return r;
 241                 else if (r > 0)
 242                         continue;
 243
 244                 r = parse_field(data, length, "_HOSTNAME=", &hostname, &hostname_len);
 245                 if (r < 0)
 246                         return r;
 247                 else if (r > 0)
 248                         continue;
 249
 250                 r = parse_field(data, length, "SYSLOG_IDENTIFIER=", &identifier, &identifier_len);
 251                 if (r < 0)
 252                         return r;
 253                 else if (r > 0)
 254                         continue;
 255
 256                 r = parse_field(data, length, "_COMM=", &comm, &comm_len);
 257                 if (r < 0)
 258                         return r;
 259                 else if (r > 0)
 260                         continue;
 261
 262                 r = parse_field(data, length, "_PID=", &pid, &pid_len);
 263                 if (r < 0)
 264                         return r;
 265                 else if (r > 0)
 266                         continue;
 267
 268                 r = parse_field(data, length, "SYSLOG_PID=", &fake_pid, &fake_pid_len);
 269                 if (r < 0)
 270                         return r;
 271                 else if (r > 0)
 272                         continue;
 273
 274                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &realtime, &realtime_len);
 275                 if (r < 0)
 276                         return r;
 277                 else if (r > 0)
 278                         continue;
 279
 280                 r = parse_field(data, length, "_SOURCE_MONOTONIC_TIMESTAMP=", &monotonic, &monotonic_len);
 281                 if (r < 0)
 282                         return r;
 283                 else if (r > 0)
 284                         continue;
 285
 286                 r = parse_field(data, length, "MESSAGE=", &message, &message_len);
 287                 if (r < 0)
 288                         return r;
 289         }
 290
 291         if (r < 0)
 292                 return log_error_errno(r, "Failed to get journal fields: %m");
 293
 294         if (!message) {
 295                 log_debug("Skipping message without MESSAGE= field.");
 296                 return 0;
 297         }
 298
 299         if (!(flags & OUTPUT_SHOW_ALL))
 300                 strip_tab_ansi(&message, &message_len);
 301
 302         if (priority_len == 1 && *priority >= '0' && *priority <= '7')
 303                 p = *priority - '0';
 304
 305         if (mode == OUTPUT_SHORT_MONOTONIC) {
 306                 uint64_t t;
 307                 sd_id128_t boot_id;
 308
 309                 r = -ENOENT;
 310
 311                 if (monotonic)
 312                         r = safe_atou64(monotonic, &t);
 313
 314                 if (r < 0)
 315                         r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 316
 317                 if (r < 0)
 318                         return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 319
 320                 fprintf(f, "[%5llu.%06llu]",
 321                         (unsigned long long) (t / USEC_PER_SEC),
 322                         (unsigned long long) (t % USEC_PER_SEC));
 323
 324                 n += 1 + 5 + 1 + 6 + 1;
 325
 326         } else {
 327                 char buf[64];
 328                 uint64_t x;
 329                 time_t t;
 330                 struct tm tm;
 331                 struct tm *(*gettime_r)(const time_t *, struct tm *);
 332
 333                 r = -ENOENT;
 334                 gettime_r = (flags & OUTPUT_UTC) ? gmtime_r : localtime_r;
 335
 336                 if (realtime)
 337                         r = safe_atou64(realtime, &x);
 338
 339                 if (r < 0)
 340                         r = sd_journal_get_realtime_usec(j, &x);
 341
 342                 if (r < 0)
 343                         return log_error_errno(r, "Failed to get realtime timestamp: %m");
 344
 345                 t = (time_t) (x / USEC_PER_SEC);
 346
 347                 switch(mode) {
 348                 case OUTPUT_SHORT_ISO:
 349                         r = strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", gettime_r(&t, &tm));
 350                         break;
 351                 case OUTPUT_SHORT_PRECISE:
 352                         r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm));
 353                         if (r > 0)
 354                                 snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
 355                                          ".%06llu", (unsigned long long) (x % USEC_PER_SEC));
 356                         break;
 357                 default:
 358                         r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", gettime_r(&t, &tm));
 359                 }
 360
 361                 if (r <= 0) {
 362                         log_error("Failed to format time.");
 363                         return -EINVAL;
 364                 }
 365
 366                 fputs(buf, f);
 367                 n += strlen(buf);
 368         }
 369
 370         if (hostname && shall_print(hostname, hostname_len, flags)) {
 371                 fprintf(f, " %.*s", (int) hostname_len, hostname);
 372                 n += hostname_len + 1;
 373         }
 374
 375         if (identifier && shall_print(identifier, identifier_len, flags)) {
 376                 fprintf(f, " %.*s", (int) identifier_len, identifier);
 377                 n += identifier_len + 1;
 378         } else if (comm && shall_print(comm, comm_len, flags)) {
 379                 fprintf(f, " %.*s", (int) comm_len, comm);
 380                 n += comm_len + 1;
 381         } else
 382                 fputs(" unknown", f);
 383
 384         if (pid && shall_print(pid, pid_len, flags)) {
 385                 fprintf(f, "[%.*s]", (int) pid_len, pid);
 386                 n += pid_len + 2;
 387         } else if (fake_pid && shall_print(fake_pid, fake_pid_len, flags)) {
 388                 fprintf(f, "[%.*s]", (int) fake_pid_len, fake_pid);
 389                 n += fake_pid_len + 2;
 390         }
 391
 392         if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
 393                 char bytes[FORMAT_BYTES_MAX];
 394                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
 395         } else {
 396                 fputs(": ", f);
 397                 ellipsized |=
 398                         print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
 399         }
 400
 401         if (flags & OUTPUT_CATALOG)
 402                 print_catalog(f, j);
 403
 404         return ellipsized;
 405 }
 406
 407 static int output_verbose(
 408                 FILE *f,
 409                 sd_journal *j,
 410                 OutputMode mode,
 411                 unsigned n_columns,
 412                 OutputFlags flags) {
 413
 414         const void *data;
 415         size_t length;
 416         _cleanup_free_ char *cursor = NULL;
 417         uint64_t realtime = 0;
 418         char ts[FORMAT_TIMESTAMP_MAX + 7];
 419         int r;
 420
 421         assert(f);
 422         assert(j);
 423
 424         sd_journal_set_data_threshold(j, 0);
 425
 426         r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
 427         if (r == -ENOENT)
 428                 log_debug("Source realtime timestamp not found");
 429         else if (r < 0)
 430                 return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get source realtime timestamp: %m");
 431         else {
 432                 _cleanup_free_ char *value = NULL;
 433
 434                 r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &value, NULL);
 435                 if (r < 0)
 436                         return r;
 437                 assert(r > 0);
 438
 439                 r = safe_atou64(value, &realtime);
 440                 if (r < 0)
 441                         log_debug_errno(r, "Failed to parse realtime timestamp: %m");
 442         }
 443
 444         if (r < 0) {
 445                 r = sd_journal_get_realtime_usec(j, &realtime);
 446                 if (r < 0)
 447                         return log_full_errno(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR, r, "Failed to get realtime timestamp: %m");
 448         }
 449
 450         r = sd_journal_get_cursor(j, &cursor);
 451         if (r < 0)
 452                 return log_error_errno(r, "Failed to get cursor: %m");
 453
 454         fprintf(f, "%s [%s]\n",
 455                 flags & OUTPUT_UTC ?
 456                 format_timestamp_us_utc(ts, sizeof(ts), realtime) :
 457                 format_timestamp_us(ts, sizeof(ts), realtime),
 458                 cursor);
 459
 460         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 461                 const char *c;
 462                 int fieldlen;
 463                 const char *on = "", *off = "";
 464
 465                 c = memchr(data, '=', length);
 466                 if (!c) {
 467                         log_error("Invalid field.");
 468                         return -EINVAL;
 469                 }
 470                 fieldlen = c - (const char*) data;
 471
 472                 if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
 473                         on = ANSI_HIGHLIGHT;
 474                         off = ANSI_NORMAL;
 475                 }
 476
 477                 if (flags & OUTPUT_SHOW_ALL ||
 478                     (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
 479                      && utf8_is_printable(data, length))) {
 480                         fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
 481                         print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
 482                         fputs(off, f);
 483                 } else {
 484                         char bytes[FORMAT_BYTES_MAX];
 485
 486                         fprintf(f, "    %s%.*s=[%s blob data]%s\n",
 487                                 on,
 488                                 (int) (c - (const char*) data),
 489                                 (const char*) data,
 490                                 format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
 491                                 off);
 492                 }
 493         }
 494
 495         if (r < 0)
 496                 return r;
 497
 498         if (flags & OUTPUT_CATALOG)
 499                 print_catalog(f, j);
 500
 501         return 0;
 502 }
 503
 504 static int output_export(
 505                 FILE *f,
 506                 sd_journal *j,
 507                 OutputMode mode,
 508                 unsigned n_columns,
 509                 OutputFlags flags) {
 510
 511         sd_id128_t boot_id;
 512         char sid[33];
 513         int r;
 514         usec_t realtime, monotonic;
 515         _cleanup_free_ char *cursor = NULL;
 516         const void *data;
 517         size_t length;
 518
 519         assert(j);
 520
 521         sd_journal_set_data_threshold(j, 0);
 522
 523         r = sd_journal_get_realtime_usec(j, &realtime);
 524         if (r < 0)
 525                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 526
 527         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 528         if (r < 0)
 529                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 530
 531         r = sd_journal_get_cursor(j, &cursor);
 532         if (r < 0)
 533                 return log_error_errno(r, "Failed to get cursor: %m");
 534
 535         fprintf(f,
 536                 "__CURSOR=%s\n"
 537                 "__REALTIME_TIMESTAMP="USEC_FMT"\n"
 538                 "__MONOTONIC_TIMESTAMP="USEC_FMT"\n"
 539                 "_BOOT_ID=%s\n",
 540                 cursor,
 541                 realtime,
 542                 monotonic,
 543                 sd_id128_to_string(boot_id, sid));
 544
 545         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 546
 547                 /* We already printed the boot id, from the data in
 548                  * the header, hence let's suppress it here */
 549                 if (length >= 9 &&
 550                     startswith(data, "_BOOT_ID="))
 551                         continue;
 552
 553                 if (utf8_is_printable_newline(data, length, false))
 554                         fwrite(data, length, 1, f);
 555                 else {
 556                         const char *c;
 557                         uint64_t le64;
 558
 559                         c = memchr(data, '=', length);
 560                         if (!c) {
 561                                 log_error("Invalid field.");
 562                                 return -EINVAL;
 563                         }
 564
 565                         fwrite(data, c - (const char*) data, 1, f);
 566                         fputc('\n', f);
 567                         le64 = htole64(length - (c - (const char*) data) - 1);
 568                         fwrite(&le64, sizeof(le64), 1, f);
 569                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
 570                 }
 571
 572                 fputc('\n', f);
 573         }
 574
 575         if (r < 0)
 576                 return r;
 577
 578         fputc('\n', f);
 579
 580         return 0;
 581 }
 582
 583 void json_escape(
 584                 FILE *f,
 585                 const char* p,
 586                 size_t l,
 587                 OutputFlags flags) {
 588
 589         assert(f);
 590         assert(p);
 591
 592         if (!(flags & OUTPUT_SHOW_ALL) && l >= JSON_THRESHOLD)
 593                 fputs("null", f);
 594
 595         else if (!utf8_is_printable(p, l)) {
 596                 bool not_first = false;
 597
 598                 fputs("[ ", f);
 599
 600                 while (l > 0) {
 601                         if (not_first)
 602                                 fprintf(f, ", %u", (uint8_t) *p);
 603                         else {
 604                                 not_first = true;
 605                                 fprintf(f, "%u", (uint8_t) *p);
 606                         }
 607
 608                         p++;
 609                         l--;
 610                 }
 611
 612                 fputs(" ]", f);
 613         } else {
 614                 fputc('\"', f);
 615
 616                 while (l > 0) {
 617                         if (*p == '"' || *p == '\\') {
 618                                 fputc('\\', f);
 619                                 fputc(*p, f);
 620                         } else if (*p == '\n')
 621                                 fputs("\\n", f);
 622                         else if ((uint8_t) *p < ' ')
 623                                 fprintf(f, "\\u%04x", (uint8_t) *p);
 624                         else
 625                                 fputc(*p, f);
 626
 627                         p++;
 628                         l--;
 629                 }
 630
 631                 fputc('\"', f);
 632         }
 633 }
 634
 635 static int output_json(
 636                 FILE *f,
 637                 sd_journal *j,
 638                 OutputMode mode,
 639                 unsigned n_columns,
 640                 OutputFlags flags) {
 641
 642         uint64_t realtime, monotonic;
 643         _cleanup_free_ char *cursor = NULL;
 644         const void *data;
 645         size_t length;
 646         sd_id128_t boot_id;
 647         char sid[33], *k;
 648         int r;
 649         Hashmap *h = NULL;
 650         bool done, separator;
 651
 652         assert(j);
 653
 654         sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : JSON_THRESHOLD);
 655
 656         r = sd_journal_get_realtime_usec(j, &realtime);
 657         if (r < 0)
 658                 return log_error_errno(r, "Failed to get realtime timestamp: %m");
 659
 660         r = sd_journal_get_monotonic_usec(j, &monotonic, &boot_id);
 661         if (r < 0)
 662                 return log_error_errno(r, "Failed to get monotonic timestamp: %m");
 663
 664         r = sd_journal_get_cursor(j, &cursor);
 665         if (r < 0)
 666                 return log_error_errno(r, "Failed to get cursor: %m");
 667
 668         if (mode == OUTPUT_JSON_PRETTY)
 669                 fprintf(f,
 670                         "{\n"
 671                         "\t\"__CURSOR\" : \"%s\",\n"
 672                         "\t\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\",\n"
 673                         "\t\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\",\n"
 674                         "\t\"_BOOT_ID\" : \"%s\"",
 675                         cursor,
 676                         realtime,
 677                         monotonic,
 678                         sd_id128_to_string(boot_id, sid));
 679         else {
 680                 if (mode == OUTPUT_JSON_SSE)
 681                         fputs("data: ", f);
 682
 683                 fprintf(f,
 684                         "{ \"__CURSOR\" : \"%s\", "
 685                         "\"__REALTIME_TIMESTAMP\" : \""USEC_FMT"\", "
 686                         "\"__MONOTONIC_TIMESTAMP\" : \""USEC_FMT"\", "
 687                         "\"_BOOT_ID\" : \"%s\"",
 688                         cursor,
 689                         realtime,
 690                         monotonic,
 691                         sd_id128_to_string(boot_id, sid));
 692         }
 693
 694         h = hashmap_new(&string_hash_ops);
 695         if (!h)
 696                 return log_oom();
 697
 698         /* First round, iterate through the entry and count how often each field appears */
 699         JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 700                 const char *eq;
 701                 char *n;
 702                 unsigned u;
 703
 704                 if (length >= 9 &&
 705                     memcmp(data, "_BOOT_ID=", 9) == 0)
 706                         continue;
 707
 708                 eq = memchr(data, '=', length);
 709                 if (!eq)
 710                         continue;
 711
 712                 n = strndup(data, eq - (const char*) data);
 713                 if (!n) {
 714                         r = log_oom();
 715                         goto finish;
 716                 }
 717
 718                 u = PTR_TO_UINT(hashmap_get(h, n));
 719                 if (u == 0) {
 720                         r = hashmap_put(h, n, UINT_TO_PTR(1));
 721                         if (r < 0) {
 722                                 free(n);
 723                                 log_oom();
 724                                 goto finish;
 725                         }
 726                 } else {
 727                         r = hashmap_update(h, n, UINT_TO_PTR(u + 1));
 728                         free(n);
 729                         if (r < 0) {
 730                                 log_oom();
 731                                 goto finish;
 732                         }
 733                 }
 734         }
 735
 736         if (r < 0)
 737                 return r;
 738
 739         separator = true;
 740         do {
 741                 done = true;
 742
 743                 SD_JOURNAL_FOREACH_DATA(j, data, length) {
 744                         const char *eq;
 745                         char *kk, *n;
 746                         size_t m;
 747                         unsigned u;
 748
 749                         /* We already printed the boot id, from the data in
 750                          * the header, hence let's suppress it here */
 751                         if (length >= 9 &&
 752                             memcmp(data, "_BOOT_ID=", 9) == 0)
 753                                 continue;
 754
 755                         eq = memchr(data, '=', length);
 756                         if (!eq)
 757                                 continue;
 758
 759                         if (separator) {
 760                                 if (mode == OUTPUT_JSON_PRETTY)
 761                                         fputs(",\n\t", f);
 762                                 else
 763                                         fputs(", ", f);
 764                         }
 765
 766                         m = eq - (const char*) data;
 767
 768                         n = strndup(data, m);
 769                         if (!n) {
 770                                 r = log_oom();
 771                                 goto finish;
 772                         }
 773
 774                         u = PTR_TO_UINT(hashmap_get2(h, n, (void**) &kk));
 775                         if (u == 0) {
 776                                 /* We already printed this, let's jump to the next */
 777                                 free(n);
 778                                 separator = false;
 779
 780                                 continue;
 781                         } else if (u == 1) {
 782                                 /* Field only appears once, output it directly */
 783
 784                                 json_escape(f, data, m, flags);
 785                                 fputs(" : ", f);
 786
 787                                 json_escape(f, eq + 1, length - m - 1, flags);
 788
 789                                 hashmap_remove(h, n);
 790                                 free(kk);
 791                                 free(n);
 792
 793                                 separator = true;
 794
 795                                 continue;
 796
 797                         } else {
 798                                 /* Field appears multiple times, output it as array */
 799                                 json_escape(f, data, m, flags);
 800                                 fputs(" : [ ", f);
 801                                 json_escape(f, eq + 1, length - m - 1, flags);
 802
 803                                 /* Iterate through the end of the list */
 804
 805                                 while (sd_journal_enumerate_data(j, &data, &length) > 0) {
 806                                         if (length < m + 1)
 807                                                 continue;
 808
 809                                         if (memcmp(data, n, m) != 0)
 810                                                 continue;
 811
 812                                         if (((const char*) data)[m] != '=')
 813                                                 continue;
 814
 815                                         fputs(", ", f);
 816                                         json_escape(f, (const char*) data + m + 1, length - m - 1, flags);
 817                                 }
 818
 819                                 fputs(" ]", f);
 820
 821                                 hashmap_remove(h, n);
 822                                 free(kk);
 823                                 free(n);
 824
 825                                 /* Iterate data fields form the beginning */
 826                                 done = false;
 827                                 separator = true;
 828
 829                                 break;
 830                         }
 831                 }
 832
 833         } while (!done);
 834
 835         if (mode == OUTPUT_JSON_PRETTY)
 836                 fputs("\n}\n", f);
 837         else if (mode == OUTPUT_JSON_SSE)
 838                 fputs("}\n\n", f);
 839         else
 840                 fputs(" }\n", f);
 841
 842         r = 0;
 843
 844 finish:
 845         while ((k = hashmap_steal_first_key(h)))
 846                 free(k);
 847
 848         hashmap_free(h);
 849
 850         return r;
 851 }
 852
 853 static int output_cat(
 854                 FILE *f,
 855                 sd_journal *j,
 856                 OutputMode mode,
 857                 unsigned n_columns,
 858                 OutputFlags flags) {
 859
 860         const void *data;
 861         size_t l;
 862         int r;
 863
 864         assert(j);
 865         assert(f);
 866
 867         sd_journal_set_data_threshold(j, 0);
 868
 869         r = sd_journal_get_data(j, "MESSAGE", &data, &l);
 870         if (r < 0) {
 871                 /* An entry without MESSAGE=? */
 872                 if (r == -ENOENT)
 873                         return 0;
 874
 875                 return log_error_errno(r, "Failed to get data: %m");
 876         }
 877
 878         assert(l >= 8);
 879
 880         fwrite((const char*) data + 8, 1, l - 8, f);
 881         fputc('\n', f);
 882
 883         return 0;
 884 }
 885
 886 static int (*output_funcs[_OUTPUT_MODE_MAX])(
 887                 FILE *f,
 888                 sd_journal*j,
 889                 OutputMode mode,
 890                 unsigned n_columns,
 891                 OutputFlags flags) = {
 892
 893         [OUTPUT_SHORT] = output_short,
 894         [OUTPUT_SHORT_ISO] = output_short,
 895         [OUTPUT_SHORT_PRECISE] = output_short,
 896         [OUTPUT_SHORT_MONOTONIC] = output_short,
 897         [OUTPUT_VERBOSE] = output_verbose,
 898         [OUTPUT_EXPORT] = output_export,
 899         [OUTPUT_JSON] = output_json,
 900         [OUTPUT_JSON_PRETTY] = output_json,
 901         [OUTPUT_JSON_SSE] = output_json,
 902         [OUTPUT_CAT] = output_cat
 903 };
 904
 905 int output_journal(
 906                 FILE *f,
 907                 sd_journal *j,
 908                 OutputMode mode,
 909                 unsigned n_columns,
 910                 OutputFlags flags,
 911                 bool *ellipsized) {
 912
 913         int ret;
 914         assert(mode >= 0);
 915         assert(mode < _OUTPUT_MODE_MAX);
 916
 917         if (n_columns <= 0)
 918                 n_columns = columns();
 919
 920         ret = output_funcs[mode](f, j, mode, n_columns, flags);
 921         fflush(stdout);
 922
 923         if (ellipsized && ret > 0)
 924                 *ellipsized = true;
 925
 926         return ret;
 927 }
 928
 929 static int maybe_print_begin_newline(FILE *f, OutputFlags *flags) {
 930         assert(f);
 931         assert(flags);
 932
 933         if (!(*flags & OUTPUT_BEGIN_NEWLINE))
 934                 return 0;
 935
 936         /* Print a beginning new line if that's request, but only once
 937          * on the first line we print. */
 938
 939         fputc('\n', f);
 940         *flags &= ~OUTPUT_BEGIN_NEWLINE;
 941         return 0;
 942 }
 943
 944 static int show_journal(FILE *f,
 945                         sd_journal *j,
 946                         OutputMode mode,
 947                         unsigned n_columns,
 948                         usec_t not_before,
 949                         unsigned how_many,
 950                         OutputFlags flags,
 951                         bool *ellipsized) {
 952
 953         int r;
 954         unsigned line = 0;
 955         bool need_seek = false;
 956         int warn_cutoff = flags & OUTPUT_WARN_CUTOFF;
 957
 958         assert(j);
 959         assert(mode >= 0);
 960         assert(mode < _OUTPUT_MODE_MAX);
 961
 962         /* Seek to end */
 963         r = sd_journal_seek_tail(j);
 964         if (r < 0)
 965                 return log_error_errno(r, "Failed to seek to tail: %m");
 966
 967         r = sd_journal_previous_skip(j, how_many);
 968         if (r < 0)
 969                 return log_error_errno(r, "Failed to skip previous: %m");
 970
 971         for (;;) {
 972                 for (;;) {
 973                         usec_t usec;
 974
 975                         if (need_seek) {
 976                                 r = sd_journal_next(j);
 977                                 if (r < 0)
 978                                         return log_error_errno(r, "Failed to iterate through journal: %m");
 979                         }
 980
 981                         if (r == 0)
 982                                 break;
 983
 984                         need_seek = true;
 985
 986                         if (not_before > 0) {
 987                                 r = sd_journal_get_monotonic_usec(j, &usec, NULL);
 988
 989                                 /* -ESTALE is returned if the
 990                                    timestamp is not from this boot */
 991                                 if (r == -ESTALE)
 992                                         continue;
 993                                 else if (r < 0)
 994                                         return log_error_errno(r, "Failed to get journal time: %m");
 995
 996                                 if (usec < not_before)
 997                                         continue;
 998                         }
 999
1000                         line++;
1001                         maybe_print_begin_newline(f, &flags);
1002
1003                         r = output_journal(f, j, mode, n_columns, flags, ellipsized);
1004                         if (r < 0)
1005                                 return r;
1006                 }
1007
1008                 if (warn_cutoff && line < how_many && not_before > 0) {
1009                         sd_id128_t boot_id;
1010                         usec_t cutoff = 0;
1011
1012                         /* Check whether the cutoff line is too early */
1013
1014                         r = sd_id128_get_boot(&boot_id);
1015                         if (r < 0)
1016                                 return log_error_errno(r, "Failed to get boot id: %m");
1017
1018                         r = sd_journal_get_cutoff_monotonic_usec(j, boot_id, &cutoff, NULL);
1019                         if (r < 0)
1020                                 return log_error_errno(r, "Failed to get journal cutoff time: %m");
1021
1022                         if (r > 0 && not_before < cutoff) {
1023                                 maybe_print_begin_newline(f, &flags);
1024                                 fprintf(f, "Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.\n");
1025                         }
1026
1027                         warn_cutoff = false;
1028                 }
1029
1030                 if (!(flags & OUTPUT_FOLLOW))
1031                         break;
1032
1033                 r = sd_journal_wait(j, USEC_INFINITY);
1034                 if (r < 0)
1035                         return log_error_errno(r, "Failed to wait for journal: %m");
1036
1037         }
1038
1039         return 0;
1040 }
1041
1042 int add_matches_for_unit(sd_journal *j, const char *unit) {
1043         int r;
1044         char *m1, *m2, *m3, *m4;
1045
1046         assert(j);
1047         assert(unit);
1048
1049         m1 = strjoina("_SYSTEMD_UNIT=", unit);
1050         m2 = strjoina("COREDUMP_UNIT=", unit);
1051         m3 = strjoina("UNIT=", unit);
1052         m4 = strjoina("OBJECT_SYSTEMD_UNIT=", unit);
1053
1054         (void)(
1055             /* Look for messages from the service itself */
1056             (r = sd_journal_add_match(j, m1, 0)) ||
1057
1058             /* Look for coredumps of the service */
1059             (r = sd_journal_add_disjunction(j)) ||
1060             (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
1061             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1062             (r = sd_journal_add_match(j, m2, 0)) ||
1063
1064              /* Look for messages from PID 1 about this service */
1065             (r = sd_journal_add_disjunction(j)) ||
1066             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
1067             (r = sd_journal_add_match(j, m3, 0)) ||
1068
1069             /* Look for messages from authorized daemons about this service */
1070             (r = sd_journal_add_disjunction(j)) ||
1071             (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1072             (r = sd_journal_add_match(j, m4, 0))
1073         );
1074
1075         if (r == 0 && endswith(unit, ".slice")) {
1076                 char *m5 = strappend("_SYSTEMD_SLICE=", unit);
1077
1078                 /* Show all messages belonging to a slice */
1079                 (void)(
1080                         (r = sd_journal_add_disjunction(j)) ||
1081                         (r = sd_journal_add_match(j, m5, 0))
1082                         );
1083         }
1084
1085         return r;
1086 }
1087
1088 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
1089         int r;
1090         char *m1, *m2, *m3, *m4;
1091         char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
1092
1093         assert(j);
1094         assert(unit);
1095
1096         m1 = strjoina("_SYSTEMD_USER_UNIT=", unit);
1097         m2 = strjoina("USER_UNIT=", unit);
1098         m3 = strjoina("COREDUMP_USER_UNIT=", unit);
1099         m4 = strjoina("OBJECT_SYSTEMD_USER_UNIT=", unit);
1100         sprintf(muid, "_UID="UID_FMT, uid);
1101
1102         (void) (
1103                 /* Look for messages from the user service itself */
1104                 (r = sd_journal_add_match(j, m1, 0)) ||
1105                 (r = sd_journal_add_match(j, muid, 0)) ||
1106
1107                 /* Look for messages from systemd about this service */
1108                 (r = sd_journal_add_disjunction(j)) ||
1109                 (r = sd_journal_add_match(j, m2, 0)) ||
1110                 (r = sd_journal_add_match(j, muid, 0)) ||
1111
1112                 /* Look for coredumps of the service */
1113                 (r = sd_journal_add_disjunction(j)) ||
1114                 (r = sd_journal_add_match(j, m3, 0)) ||
1115                 (r = sd_journal_add_match(j, muid, 0)) ||
1116                 (r = sd_journal_add_match(j, "_UID=0", 0)) ||
1117
1118                 /* Look for messages from authorized daemons about this service */
1119                 (r = sd_journal_add_disjunction(j)) ||
1120                 (r = sd_journal_add_match(j, m4, 0)) ||
1121                 (r = sd_journal_add_match(j, muid, 0)) ||
1122                 (r = sd_journal_add_match(j, "_UID=0", 0))
1123         );
1124
1125         if (r == 0 && endswith(unit, ".slice")) {
1126                 char *m5 = strappend("_SYSTEMD_SLICE=", unit);
1127
1128                 /* Show all messages belonging to a slice */
1129                 (void)(
1130                         (r = sd_journal_add_disjunction(j)) ||
1131                         (r = sd_journal_add_match(j, m5, 0)) ||
1132                         (r = sd_journal_add_match(j, muid, 0))
1133                         );
1134         }
1135
1136         return r;
1137 }
1138
1139 static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) {
1140         _cleanup_close_pair_ int pair[2] = { -1, -1 };
1141         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1;
1142         pid_t pid, child;
1143         siginfo_t si;
1144         char buf[37];
1145         ssize_t k;
1146         int r;
1147
1148         assert(machine);
1149         assert(boot_id);
1150
1151         if (!machine_name_is_valid(machine))
1152                 return -EINVAL;
1153
1154         r = container_get_leader(machine, &pid);
1155         if (r < 0)
1156                 return r;
1157
1158         r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, NULL, &rootfd);
1159         if (r < 0)
1160                 return r;
1161
1162         if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
1163                 return -errno;
1164
1165         child = fork();
1166         if (child < 0)
1167                 return -errno;
1168
1169         if (child == 0) {
1170                 int fd;
1171
1172                 pair[0] = safe_close(pair[0]);
1173
1174                 r = namespace_enter(pidnsfd, mntnsfd, -1, -1, rootfd);
1175                 if (r < 0)
1176                         _exit(EXIT_FAILURE);
1177
1178                 fd = open("/proc/sys/kernel/random/boot_id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
1179                 if (fd < 0)
1180                         _exit(EXIT_FAILURE);
1181
1182                 r = loop_read_exact(fd, buf, 36, false);
1183                 safe_close(fd);
1184                 if (r < 0)
1185                         _exit(EXIT_FAILURE);
1186
1187                 k = send(pair[1], buf, 36, MSG_NOSIGNAL);
1188                 if (k != 36)
1189                         _exit(EXIT_FAILURE);
1190
1191                 _exit(EXIT_SUCCESS);
1192         }
1193
1194         pair[1] = safe_close(pair[1]);
1195
1196         r = wait_for_terminate(child, &si);
1197         if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS)
1198                 return r < 0 ? r : -EIO;
1199
1200         k = recv(pair[0], buf, 36, 0);
1201         if (k != 36)
1202                 return -EIO;
1203
1204         buf[36] = 0;
1205         r = sd_id128_from_string(buf, boot_id);
1206         if (r < 0)
1207                 return r;
1208
1209         return 0;
1210 }
1211
1212 int add_match_this_boot(sd_journal *j, const char *machine) {
1213         char match[9+32+1] = "_BOOT_ID=";
1214         sd_id128_t boot_id;
1215         int r;
1216
1217         assert(j);
1218
1219         if (machine) {
1220                 r = get_boot_id_for_machine(machine, &boot_id);
1221                 if (r < 0)
1222                         return log_error_errno(r, "Failed to get boot id of container %s: %m", machine);
1223         } else {
1224                 r = sd_id128_get_boot(&boot_id);
1225                 if (r < 0)
1226                         return log_error_errno(r, "Failed to get boot id: %m");
1227         }
1228
1229         sd_id128_to_string(boot_id, match + 9);
1230         r = sd_journal_add_match(j, match, strlen(match));
1231         if (r < 0)
1232                 return log_error_errno(r, "Failed to add match: %m");
1233
1234         r = sd_journal_add_conjunction(j);
1235         if (r < 0)
1236                 return log_error_errno(r, "Failed to add conjunction: %m");
1237
1238         return 0;
1239 }
1240
1241 int show_journal_by_unit(
1242                 FILE *f,
1243                 const char *unit,
1244                 OutputMode mode,
1245                 unsigned n_columns,
1246                 usec_t not_before,
1247                 unsigned how_many,
1248                 uid_t uid,
1249                 OutputFlags flags,
1250                 int journal_open_flags,
1251                 bool system_unit,
1252                 bool *ellipsized) {
1253
1254         _cleanup_(sd_journal_closep) sd_journal *j = NULL;
1255         int r;
1256
1257         assert(mode >= 0);
1258         assert(mode < _OUTPUT_MODE_MAX);
1259         assert(unit);
1260
1261         if (how_many <= 0)
1262                 return 0;
1263
1264         r = sd_journal_open(&j, journal_open_flags);
1265         if (r < 0)
1266                 return log_error_errno(r, "Failed to open journal: %m");
1267
1268         r = add_match_this_boot(j, NULL);
1269         if (r < 0)
1270                 return r;
1271
1272         if (system_unit)
1273                 r = add_matches_for_unit(j, unit);
1274         else
1275                 r = add_matches_for_user_unit(j, unit, uid);
1276         if (r < 0)
1277                 return log_error_errno(r, "Failed to add unit matches: %m");
1278
1279         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1280                 _cleanup_free_ char *filter;
1281
1282                 filter = journal_make_match_string(j);
1283                 if (!filter)
1284                         return log_oom();
1285
1286                 log_debug("Journal filter: %s", filter);
1287         }
1288
1289         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
1290 }
1291
1292 static const char *const output_mode_table[_OUTPUT_MODE_MAX] = {
1293         [OUTPUT_SHORT] = "short",
1294         [OUTPUT_SHORT_ISO] = "short-iso",
1295         [OUTPUT_SHORT_PRECISE] = "short-precise",
1296         [OUTPUT_SHORT_MONOTONIC] = "short-monotonic",
1297         [OUTPUT_VERBOSE] = "verbose",
1298         [OUTPUT_EXPORT] = "export",
1299         [OUTPUT_JSON] = "json",
1300         [OUTPUT_JSON_PRETTY] = "json-pretty",
1301         [OUTPUT_JSON_SSE] = "json-sse",
1302         [OUTPUT_CAT] = "cat"
1303 };
1304
1305 DEFINE_STRING_TABLE_LOOKUP(output_mode, OutputMode);