sdjournal

package
v22.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 7, 2022 License: Apache-2.0 Imports: 12 Imported by: 47

Documentation

Overview

Package sdjournal provides a low-level Go interface to the systemd journal wrapped around the sd-journal C API.

All public read methods map closely to the sd-journal API functions. See the sd-journal.h documentation[1] for information about each function.

To write to the journal, see the pure-Go "journal" package

[1] http://www.freedesktop.org/software/systemd/man/sd-journal.html

Index

Constants

View Source 
const (
	// User Journal Fields
	SD_JOURNAL_FIELD_MESSAGE           = "MESSAGE"
	SD_JOURNAL_FIELD_MESSAGE_ID        = "MESSAGE_ID"
	SD_JOURNAL_FIELD_PRIORITY          = "PRIORITY"
	SD_JOURNAL_FIELD_CODE_FILE         = "CODE_FILE"
	SD_JOURNAL_FIELD_CODE_LINE         = "CODE_LINE"
	SD_JOURNAL_FIELD_CODE_FUNC         = "CODE_FUNC"
	SD_JOURNAL_FIELD_ERRNO             = "ERRNO"
	SD_JOURNAL_FIELD_SYSLOG_FACILITY   = "SYSLOG_FACILITY"
	SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER = "SYSLOG_IDENTIFIER"
	SD_JOURNAL_FIELD_SYSLOG_PID        = "SYSLOG_PID"

	// Trusted Journal Fields
	SD_JOURNAL_FIELD_PID                       = "_PID"
	SD_JOURNAL_FIELD_UID                       = "_UID"
	SD_JOURNAL_FIELD_GID                       = "_GID"
	SD_JOURNAL_FIELD_COMM                      = "_COMM"
	SD_JOURNAL_FIELD_EXE                       = "_EXE"
	SD_JOURNAL_FIELD_CMDLINE                   = "_CMDLINE"
	SD_JOURNAL_FIELD_CAP_EFFECTIVE             = "_CAP_EFFECTIVE"
	SD_JOURNAL_FIELD_AUDIT_SESSION             = "_AUDIT_SESSION"
	SD_JOURNAL_FIELD_AUDIT_LOGINUID            = "_AUDIT_LOGINUID"
	SD_JOURNAL_FIELD_SYSTEMD_CGROUP            = "_SYSTEMD_CGROUP"
	SD_JOURNAL_FIELD_SYSTEMD_SESSION           = "_SYSTEMD_SESSION"
	SD_JOURNAL_FIELD_SYSTEMD_UNIT              = "_SYSTEMD_UNIT"
	SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT         = "_SYSTEMD_USER_UNIT"
	SD_JOURNAL_FIELD_SYSTEMD_OWNER_UID         = "_SYSTEMD_OWNER_UID"
	SD_JOURNAL_FIELD_SYSTEMD_SLICE             = "_SYSTEMD_SLICE"
	SD_JOURNAL_FIELD_SELINUX_CONTEXT           = "_SELINUX_CONTEXT"
	SD_JOURNAL_FIELD_SOURCE_REALTIME_TIMESTAMP = "_SOURCE_REALTIME_TIMESTAMP"
	SD_JOURNAL_FIELD_BOOT_ID                   = "_BOOT_ID"
	SD_JOURNAL_FIELD_MACHINE_ID                = "_MACHINE_ID"
	SD_JOURNAL_FIELD_HOSTNAME                  = "_HOSTNAME"
	SD_JOURNAL_FIELD_TRANSPORT                 = "_TRANSPORT"

	// Address Fields
	SD_JOURNAL_FIELD_CURSOR              = "__CURSOR"
	SD_JOURNAL_FIELD_REALTIME_TIMESTAMP  = "__REALTIME_TIMESTAMP"
	SD_JOURNAL_FIELD_MONOTONIC_TIMESTAMP = "__MONOTONIC_TIMESTAMP"
)

Journal entry field strings which correspond to: http://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html

View Source 
const (
	SD_JOURNAL_NOP        = int(C.SD_JOURNAL_NOP)
	SD_JOURNAL_APPEND     = int(C.SD_JOURNAL_APPEND)
	SD_JOURNAL_INVALIDATE = int(C.SD_JOURNAL_INVALIDATE)
)

Journal event constants

View Source 
const (
	// IndefiniteWait is a sentinel value that can be passed to
	// sdjournal.Wait() to signal an indefinite wait for new journal
	// events. It is implemented as the maximum value for a time.Duration:
	// https://github.com/golang/go/blob/e4dcf5c8c22d98ac9eac7b9b226596229624cb1d/src/time/time.go#L434
	IndefiniteWait time.Duration = 1<<63 - 1
)

Variables

View Source 
var (
	// ErrExpired gets returned when the Follow function runs into the
	// specified timeout.
	ErrExpired = errors.New("Timeout expired")
)
View Source 
var (
	// ErrNoTestCursor gets returned when using TestCursor function and cursor
	// parameter is not the same as the current cursor position.
	ErrNoTestCursor = errors.New("Cursor parameter is not the same as current position")
)

Functions

This section is empty.

Types

type Journal 

type Journal struct {
	// contains filtered or unexported fields
}

Journal is a Go wrapper of an sd_journal structure.

func NewJournal 

func NewJournal() (j *Journal, err error)

NewJournal returns a new Journal instance pointing to the local journal

func NewJournalFromDir 

func NewJournalFromDir(path string) (j *Journal, err error)

NewJournalFromDir returns a new Journal instance pointing to a journal residing in a given directory.

func NewJournalFromFiles 

func NewJournalFromFiles(paths ...string) (j *Journal, err error)

NewJournalFromFiles returns a new Journal instance pointing to a journals residing in a given files.

func (*Journal) AddConjunction 

func (j *Journal) AddConjunction() error

AddConjunction inserts a logical AND in the match list.

func (*Journal) AddDisjunction 

func (j *Journal) AddDisjunction() error

AddDisjunction inserts a logical OR in the match list.

func (*Journal) AddMatch 

func (j *Journal) AddMatch(match string) error

AddMatch adds a match by which to filter the entries of the journal.

func (*Journal) Close 

func (j *Journal) Close() error

Close closes a journal opened with NewJournal.

func (*Journal) FlushMatches 

func (j *Journal) FlushMatches()

FlushMatches flushes all matches, disjunctions and conjunctions.

func (*Journal) GetBootID added in v22.2.0 

func (j *Journal) GetBootID() (string, error)

GetBootID get systemd boot id

func (*Journal) GetCatalog 

func (j *Journal) GetCatalog() (string, error)

GetCatalog retrieves a message catalog entry for the journal entry referenced by the last completed Next/Previous function call. To call GetCatalog, you must first have called one of these functions.

func (*Journal) GetCursor 

func (j *Journal) GetCursor() (string, error)

GetCursor gets the cursor of the last journal entry reeferenced by the last completed Next/Previous function call. To call GetCursor, you must first have called one of the Next/Previous functions.

func (*Journal) GetData 

func (j *Journal) GetData(field string) (string, error)

GetData gets the data object associated with a specific field from the the journal entry referenced by the last completed Next/Previous function call. To call GetData, you must have first called one of these functions.

func (*Journal) GetDataBytes 

func (j *Journal) GetDataBytes(field string) ([]byte, error)

GetDataBytes gets the data object associated with a specific field from the journal entry referenced by the last completed Next/Previous function call. To call GetDataBytes, you must first have called one of these functions.

func (*Journal) GetDataValue 

func (j *Journal) GetDataValue(field string) (string, error)

GetDataValue gets the data object associated with a specific field from the journal entry referenced by the last completed Next/Previous function call, returning only the value of the object. To call GetDataValue, you must first have called one of the Next/Previous functions.

func (*Journal) GetDataValueBytes 

func (j *Journal) GetDataValueBytes(field string) ([]byte, error)

GetDataValueBytes gets the data object associated with a specific field from the journal entry referenced by the last completed Next/Previous function call, returning only the value of the object. To call GetDataValueBytes, you must first have called one of the Next/Previous functions.

func (*Journal) GetEntry 

func (j *Journal) GetEntry() (*JournalEntry, error)

GetEntry returns a full representation of the journal entry referenced by the last completed Next/Previous function call, with all key-value pairs of data as well as address fields (cursor, realtime timestamp and monotonic timestamp). To call GetEntry, you must first have called one of the Next/Previous functions.

func (*Journal) GetMonotonicUsec 

func (j *Journal) GetMonotonicUsec() (uint64, error)

GetMonotonicUsec gets the monotonic timestamp of the journal entry referenced by the last completed Next/Previous function call. To call GetMonotonicUsec, you must first have called one of the Next/Previous functions.

func (*Journal) GetRealtimeUsec 

func (j *Journal) GetRealtimeUsec() (uint64, error)

GetRealtimeUsec gets the realtime (wallclock) timestamp of the journal entry referenced by the last completed Next/Previous function call. To call GetRealtimeUsec, you must first have called one of the Next/Previous functions.

func (*Journal) GetUniqueValues 

func (j *Journal) GetUniqueValues(field string) ([]string, error)

GetUniqueValues returns all unique values for a given field.

func (*Journal) GetUsage 

func (j *Journal) GetUsage() (uint64, error)

GetUsage returns the journal disk space usage, in bytes.

func (*Journal) Next 

func (j *Journal) Next() (uint64, error)

Next advances the read pointer into the journal by one entry.

func (*Journal) NextSkip 

func (j *Journal) NextSkip(skip uint64) (uint64, error)

NextSkip advances the read pointer by multiple entries at once, as specified by the skip parameter.

func (*Journal) Previous 

func (j *Journal) Previous() (uint64, error)

Previous sets the read pointer into the journal back by one entry.

func (*Journal) PreviousSkip 

func (j *Journal) PreviousSkip(skip uint64) (uint64, error)

PreviousSkip sets back the read pointer by multiple entries at once, as specified by the skip parameter.

func (*Journal) SeekCursor 

func (j *Journal) SeekCursor(cursor string) error

SeekCursor seeks to a concrete journal cursor. This call must be followed by a call to Next/Previous before any call to Get* will return data about the sought entry.

func (*Journal) SeekHead 

func (j *Journal) SeekHead() error

SeekHead seeks to the beginning of the journal, i.e. the oldest available entry. This call must be followed by a call to Next before any call to Get* will return data about the first element.

func (*Journal) SeekRealtimeUsec 

func (j *Journal) SeekRealtimeUsec(usec uint64) error

SeekRealtimeUsec seeks to the entry with the specified realtime (wallclock) timestamp, i.e. CLOCK_REALTIME. This call must be followed by a call to Next/Previous before any call to Get* will return data about the sought entry.

func (*Journal) SeekTail 

func (j *Journal) SeekTail() error

SeekTail may be used to seek to the end of the journal, i.e. the most recent available entry. This call must be followed by a call to Previous before any call to Get* will return data about the last element.

func (*Journal) SetDataThreshold 

func (j *Journal) SetDataThreshold(threshold uint64) error

SetDataThreshold sets the data field size threshold for data returned by GetData. To retrieve the complete data fields this threshold should be turned off by setting it to 0, so that the library always returns the complete data objects.

func (*Journal) TestCursor 

func (j *Journal) TestCursor(cursor string) error

TestCursor checks whether the current position in the journal matches the specified cursor

func (*Journal) Wait 

func (j *Journal) Wait(timeout time.Duration) int

Wait will synchronously wait until the journal gets changed. The maximum time this call sleeps may be controlled with the timeout parameter. If sdjournal.IndefiniteWait is passed as the timeout parameter, Wait will wait indefinitely for a journal change.

type JournalEntry 

type JournalEntry struct {
	Fields             map[string]string
	Cursor             string
	RealtimeTimestamp  uint64
	MonotonicTimestamp uint64
}

JournalEntry represents all fields of a journal entry plus address fields.

type JournalReader 

type JournalReader struct {
	// contains filtered or unexported fields
}

JournalReader is an io.ReadCloser which provides a simple interface for iterating through the systemd journal. A JournalReader is not safe for concurrent use by multiple goroutines.

func NewJournalReader 

func NewJournalReader(config JournalReaderConfig) (*JournalReader, error)

NewJournalReader creates a new JournalReader with configuration options that are similar to the systemd journalctl tool's iteration and filtering features.

func (*JournalReader) Close 

func (r *JournalReader) Close() error

Close closes the JournalReader's handle to the journal.

func (*JournalReader) Follow 

func (r *JournalReader) Follow(until <-chan time.Time, writer io.Writer) error

Follow synchronously follows the JournalReader, writing each new journal entry to writer. The follow will continue until a single time.Time is received on the until channel.

func (*JournalReader) Read 

func (r *JournalReader) Read(b []byte) (int, error)

Read reads entries from the journal. Read follows the Reader interface so it must be able to read a specific amount of bytes. Journald on the other hand only allows us to read full entries of arbitrary size (without byte granularity). JournalReader is therefore internally buffering entries that don't fit in the read buffer. Callers should keep calling until 0 and/or an error is returned.

func (*JournalReader) Rewind 

func (r *JournalReader) Rewind() error

Rewind attempts to rewind the JournalReader to the first entry.

type JournalReaderConfig 

type JournalReaderConfig struct {
	// The Since, NumFromTail and Cursor options are mutually exclusive and
	// determine where the reading begins within the journal. The order in which
	// options are written is exactly the order of precedence.
	Since       time.Duration // start relative to a Duration from now
	NumFromTail uint64        // start relative to the tail
	Cursor      string        // start relative to the cursor

	// Show only journal entries whose fields match the supplied values. If
	// the array is empty, entries will not be filtered.
	Matches []Match

	// If not empty, the journal instance will point to a journal residing
	// in this directory. The supplied path may be relative or absolute.
	Path string

	// If not nil, Formatter will be used to translate the resulting entries
	// into strings. If not set, the default format (timestamp and message field)
	// will be used. If Formatter returns an error, Read will stop and return the error.
	Formatter func(entry *JournalEntry) (string, error)
}

JournalReaderConfig represents options to drive the behavior of a JournalReader.

type Match 

type Match struct {
	Field string
	Value string
}

Match is a convenience wrapper to describe filters supplied to AddMatch.

func (*Match) String 

func (m *Match) String() string

String returns a string representation of a Match suitable for use with AddMatch.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.