<?xml version='1.0'?> <!--*-nxml-*-->
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
-
-<!--
- This file is part of systemd.
-
- Copyright 2010 Lennart Poettering
-
- systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU Lesser General Public License as published by
- the Free Software Foundation; either version 2.1 of the License, or
- (at your option) any later version.
-
- systemd is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- Lesser General Public License for more details.
-
- You should have received a copy of the GNU Lesser General Public License
- along with systemd; If not, see <http://www.gnu.org/licenses/>.
--->
+<!-- SPDX-License-Identifier: LGPL-2.1+ -->
<refentry id="systemd.journal-fields">
<refentryinfo>
<title>systemd.journal-fields</title>
<productname>systemd</productname>
-
- <authorgroup>
- <author>
- <contrib>Developer</contrib>
- <firstname>Lennart</firstname>
- <surname>Poettering</surname>
- <email>lennart@poettering.net</email>
- </author>
- </authorgroup>
</refentryinfo>
<refmeta>
<varlistentry>
<term><varname>MESSAGE_ID=</varname></term>
<listitem>
- <para>A 128-bit message identifier ID for recognizing
- certain message types, if this is desirable. This should
- contain a 128-bit ID formatted as a lower-case hexadecimal
- string, without any separating dashes or suchlike. This is
- recommended to be a UUID-compatible ID, but this is not
- enforced, and formatted differently. Developers can generate
- a new ID for this purpose with <command>journalctl
- <option>--new-id</option></command>.
+ <para>A 128-bit message identifier ID for recognizing certain message types, if this is desirable. This
+ should contain a 128-bit ID formatted as a lower-case hexadecimal string, without any separating dashes or
+ suchlike. This is recommended to be a UUID-compatible ID, but this is not enforced, and formatted
+ differently. Developers can generate a new ID for this purpose with <command>systemd-id128 new</command>.
</para>
</listitem>
</varlistentry>
<term><varname>SYSLOG_FACILITY=</varname></term>
<term><varname>SYSLOG_IDENTIFIER=</varname></term>
<term><varname>SYSLOG_PID=</varname></term>
+ <term><varname>SYSLOG_TIMESTAMP=</varname></term>
<listitem>
- <para>Syslog compatibility fields containing the facility
- (formatted as decimal string), the identifier string (i.e.
- "tag"), and the client PID. (Note that the tag is usually
- derived from glibc's
- <varname>program_invocation_short_name</varname> variable,
- see
+ <para>Syslog compatibility fields containing the facility (formatted as
+ decimal string), the identifier string (i.e. "tag"), the client PID, and
+ the timestamp as specified in the original datagram. (Note that the tag is
+ usually derived from glibc's
+ <varname>program_invocation_short_name</varname> variable, see
<citerefentry project='die-net'><refentrytitle>program_invocation_short_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.)</para>
+ <para>Note that the journal service does not validate the values of any structured
+ journal fields whose name is not prefixed with an underscore, and this includes any
+ syslog related fields such as these. Hence, applications that supply a facility, PID,
+ or log level are expected to do so properly formatted, i.e. as numeric integers formatted
+ as decimal strings.</para>
</listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>SYSLOG_RAW=</varname></term>
+ <listitem>
+ <para>The original contents of the syslog line as received in the syslog
+ datagram. This field is only included if the <varname>MESSAGE=</varname>
+ field was modified compared to the original payload or the timestamp could
+ not be located properly and is not included in
+ <varname>SYSLOG_TIMESTAMP=</varname>. Message truncation occurs when when
+ the message contains leading or trailing whitespace (trailing and leading
+ whitespace is stripped), or it contains an embedded
+ <constant>NUL</constant> byte (the <constant>NUL</constant> byte and
+ anything after it is not included). Thus, the original syslog line is
+ either stored as <varname>SYSLOG_RAW=</varname> or it can be recreated
+ based on the stored priority and facility, timestamp, identifier, and the
+ message payload in <varname>MESSAGE=</varname>.
+ </para>
+ </listitem>
</varlistentry>
</variablelist>
</refsect1>
<listitem>
<para>The process, user, and group ID of the process the
journal entry originates from formatted as a decimal
- string.</para>
+ string. Note that entries obtained via <literal>stdout</literal> or
+ <literal>stderr</literal> of forked processes will contain credentials valid for a parent
+ process (that initiated the connection to <command>systemd-journald</command>).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>_SYSTEMD_CGROUP=</varname></term>
- <term><varname>_SYSTEMD_SESSION=</varname></term>
+ <term><varname>_SYSTEMD_SLICE=</varname></term>
<term><varname>_SYSTEMD_UNIT=</varname></term>
<term><varname>_SYSTEMD_USER_UNIT=</varname></term>
+ <term><varname>_SYSTEMD_SESSION=</varname></term>
<term><varname>_SYSTEMD_OWNER_UID=</varname></term>
- <term><varname>_SYSTEMD_SLICE=</varname></term>
<listitem>
<para>The control group path in the systemd hierarchy, the
- systemd session ID (if any), the systemd unit name (if any),
- the systemd user session unit name (if any), the owner UID
- of the systemd session (if any) and the systemd slice unit
- of the process the journal entry originates from.</para>
+ the systemd slice unit name, the systemd unit name, the
+ unit name in the systemd user manager (if any), the systemd
+ session ID (if any), and the owner UID of the systemd user
+ unit or systemd session (if any) of the process the journal
+ entry originates from.</para>
</listitem>
</varlistentry>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>_SYSTEMD_INVOCATION_ID=</varname></term>
+ <listitem>
+ <para>The invocation ID for the runtime cycle of the unit
+ the message was generated in, as available to processes
+ of the unit in <varname>$INVOCATION_ID</varname> (see
+ <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>).</para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><varname>_HOSTNAME=</varname></term>
<listitem>
</variablelist>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>_STREAM_ID=</varname></term>
+ <listitem>
+ <para>Only applies to <literal>_TRANSPORT=stdout</literal> records: specifies a randomized 128bit ID assigned
+ to the stream connection when it was first created. This ID is useful to reconstruct individual log streams
+ from the log records: all log records carrying the same stream ID originate from the same stream.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>_LINE_BREAK=</varname></term>
+ <listitem>
+ <para>Only applies to <literal>_TRANSPORT=stdout</literal> records: indicates that the log message in the
+ standard output/error stream was not terminated with a normal newline character (<literal>\n</literal>,
+ i.e. ASCII 10). Specifically, when set this field is one of <option>nul</option> (in case the line was
+ terminated by a NUL byte), <option>line-max</option> (in case the maximum log line length was reached, as
+ configured with <varname>LineMax=</varname> in
+ <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>) or
+ <option>eof</option> (if this was the last log record of a stream and the stream ended without a final
+ newline character). Note that this record is not generated when a normal newline character was used for
+ marking the log line end.</para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
<para>During serialization into external formats, such as the
<ulink
- url="http://www.freedesktop.org/wiki/Software/systemd/export">Journal
+ url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal
Export Format</ulink> or the <ulink
- url="http://www.freedesktop.org/wiki/Software/systemd/json">Journal
+ url="https://www.freedesktop.org/wiki/Software/systemd/json">Journal
JSON Format</ulink>, the addresses of journal entries are
serialized into fields prefixed with double underscores. Note that
these are not proper fields when stored in the journal but for
projects / thirdparty / systemd.git / blobdiff