journal

Documentation

Index

• Constants
• type Entry
  • func (e Entry) Realtime() time.Time
• type ExportReader
  • func NewExportReader(r io.Reader) *ExportReader
  • func (e *ExportReader) ReadEntry() (Entry, error)
• type Formatter
  • func ShortWriter(w io.Writer) Formatter
• type Recorder
  • func NewRecorder(f Formatter, rawFile io.WriteCloser) *Recorder
  • func (r *Recorder) RunLocal(ctx context.Context) error
  • func (r *Recorder) RunSSH(ctx context.Context, client *ssh.Client) error
  • func (r *Recorder) StartLocal(ctx context.Context) error
  • func (r *Recorder) StartSSH(ctx context.Context, client *ssh.Client) error
  • func (r *Recorder) Wait() error

Constants

const (
	// User Journal Fields
	FIELD_MESSAGE           = "MESSAGE"
	FIELD_MESSAGE_ID        = "MESSAGE_ID"
	FIELD_PRIORITY          = "PRIORITY"
	FIELD_CODE_FILE         = "CODE_FILE"
	FIELD_CODE_LINE         = "CODE_LINE"
	FIELD_CODE_FUNC         = "CODE_FUNC"
	FIELD_ERRNO             = "ERRNO"
	FIELD_SYSLOG_FACILITY   = "SYSLOG_FACILITY"
	FIELD_SYSLOG_IDENTIFIER = "SYSLOG_IDENTIFIER"
	FIELD_SYSLOG_PID        = "SYSLOG_PID"

	// Trusted Journal Fields
	FIELD_PID                       = "_PID"
	FIELD_UID                       = "_UID"
	FIELD_GID                       = "_GID"
	FIELD_COMM                      = "_COMM"
	FIELD_EXE                       = "_EXE"
	FIELD_CMDLINE                   = "_CMDLINE"
	FIELD_CAP_EFFECTIVE             = "_CAP_EFFECTIVE"
	FIELD_AUDIT_SESSION             = "_AUDIT_SESSION"
	FIELD_AUDIT_LOGINUID            = "_AUDIT_LOGINUID"
	FIELD_SYSTEMD_CGROUP            = "_SYSTEMD_CGROUP"
	FIELD_SYSTEMD_SESSION           = "_SYSTEMD_SESSION"
	FIELD_SYSTEMD_UNIT              = "_SYSTEMD_UNIT"
	FIELD_SYSTEMD_USER_UNIT         = "_SYSTEMD_USER_UNIT"
	FIELD_SYSTEMD_OWNER_UID         = "_SYSTEMD_OWNER_UID"
	FIELD_SYSTEMD_SLICE             = "_SYSTEMD_SLICE"
	FIELD_SELINUX_CONTEXT           = "_SELINUX_CONTEXT"
	FIELD_SOURCE_REALTIME_TIMESTAMP = "_SOURCE_REALTIME_TIMESTAMP"
	FIELD_BOOT_ID                   = "_BOOT_ID"
	FIELD_MACHINE_ID                = "_MACHINE_ID"
	FIELD_HOSTNAME                  = "_HOSTNAME"
	FIELD_TRANSPORT                 = "_TRANSPORT"

	// Kernel Journal Fields
	FIELD_KERNEL_DEVICE    = "_KERNEL_DEVICE"
	FIELD_KERNEL_SUBSYSTEM = "_KERNEL_SUBSYSTEM"
	FIELD_UDEV_SYSNAME     = "_UDEV_SYSNAME"
	FIELD_UDEV_DEVNODE     = "_UDEV_DEVNODE"
	FIELD_UDEV_DEVLINK     = "_UDEV_DEVLINK"

	// Fields to log on behalf of a different program
	FIELD_COREDUMP_UNIT            = "COREDUMP_UNIT"
	FIELD_COREDUMP_USER_UNIT       = "COREDUMP_USER_UNIT"
	FIELD_OBJECT_PID               = "OBJECT_PID"
	FIELD_OBJECT_UID               = "OBJECT_UID"
	FIELD_OBJECT_GID               = "OBJECT_GID"
	FIELD_OBJECT_COMM              = "OBJECT_COMM"
	FIELD_OBJECT_EXE               = "OBJECT_EXE"
	FIELD_OBJECT_CMDLINE           = "OBJECT_CMDLINE"
	FIELD_OBJECT_AUDIT_SESSION     = "OBJECT_AUDIT_SESSION"
	FIELD_OBJECT_AUDIT_LOGINUID    = "OBJECT_AUDIT_LOGINUID"
	FIELD_OBJECT_SYSTEMD_CGROUP    = "OBJECT_SYSTEMD_CGROUP"
	FIELD_OBJECT_SYSTEMD_SESSION   = "OBJECT_SYSTEMD_SESSION"
	FIELD_OBJECT_SYSTEMD_UNIT      = "OBJECT_SYSTEMD_UNIT"
	FIELD_OBJECT_SYSTEMD_USER_UNIT = "OBJECT_SYSTEMD_USER_UNIT"
	FIELD_OBJECT_SYSTEMD_OWNER_UID = "OBJECT_SYSTEMD_OWNER_UID"

	// Address Fields
	FIELD_CURSOR              = "__CURSOR"
	FIELD_REALTIME_TIMESTAMP  = "__REALTIME_TIMESTAMP"
	FIELD_MONOTONIC_TIMESTAMP = "__MONOTONIC_TIMESTAMP"
)

Journal entry field strings which correspond to: http://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html

Types

type Entry

type Entry map[string][]byte

Entry is a map of fields representing a single journal entry.

func (Entry) Realtime

func (e Entry) Realtime() time.Time

Realtime parses the SOURCE_REALTIME_TIMESTAMP or REALTIME_TIMESTAMP field, preferring the former when available.

type ExportReader

type ExportReader struct {
	// contains filtered or unexported fields
}

func NewExportReader

func NewExportReader(r io.Reader) *ExportReader

func (*ExportReader) ReadEntry

func (e *ExportReader) ReadEntry() (Entry, error)

ReadEntry reads one journal entry from the stream and returns it as a map.

type Formatter

type Formatter interface {
	SetTimezone(tz *time.Location)
	WriteEntry(entry Entry) error
}

func ShortWriter

func ShortWriter(w io.Writer) Formatter

ShortWriter writes journal entries in a format similar to journalctl's "short-precise" format, excluding hostname for conciseness.

type Recorder

type Recorder struct {
	// contains filtered or unexported fields
}

func NewRecorder

func NewRecorder(f Formatter, rawFile io.WriteCloser) *Recorder

func (*Recorder) RunLocal

func (r *Recorder) RunLocal(ctx context.Context) error

func (*Recorder) RunSSH

func (r *Recorder) RunSSH(ctx context.Context, client *ssh.Client) error

func (*Recorder) StartLocal

func (r *Recorder) StartLocal(ctx context.Context) error

func (*Recorder) StartSSH

func (r *Recorder) StartSSH(ctx context.Context, client *ssh.Client) error

func (*Recorder) Wait

func (r *Recorder) Wait() error