Journal entry field strings which correspond to: http://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
const (
// User Journal Fields
SD_JOURNAL_FIELD_MESSAGE = "MESSAGE"
SD_JOURNAL_FIELD_MESSAGE_ID = "MESSAGE_ID"
SD_JOURNAL_FIELD_PRIORITY = "PRIORITY"
SD_JOURNAL_FIELD_CODE_FILE = "CODE_FILE"
SD_JOURNAL_FIELD_CODE_LINE = "CODE_LINE"
SD_JOURNAL_FIELD_CODE_FUNC = "CODE_FUNC"
SD_JOURNAL_FIELD_ERRNO = "ERRNO"
SD_JOURNAL_FIELD_SYSLOG_FACILITY = "SYSLOG_FACILITY"
SD_JOURNAL_FIELD_SYSLOG_IDENTIFIER = "SYSLOG_IDENTIFIER"
SD_JOURNAL_FIELD_SYSLOG_PID = "SYSLOG_PID"
// Trusted Journal Fields
SD_JOURNAL_FIELD_PID = "_PID"
SD_JOURNAL_FIELD_UID = "_UID"
SD_JOURNAL_FIELD_GID = "_GID"
SD_JOURNAL_FIELD_COMM = "_COMM"
SD_JOURNAL_FIELD_EXE = "_EXE"
SD_JOURNAL_FIELD_CMDLINE = "_CMDLINE"
SD_JOURNAL_FIELD_CAP_EFFECTIVE = "_CAP_EFFECTIVE"
SD_JOURNAL_FIELD_AUDIT_SESSION = "_AUDIT_SESSION"
SD_JOURNAL_FIELD_AUDIT_LOGINUID = "_AUDIT_LOGINUID"
SD_JOURNAL_FIELD_SYSTEMD_CGROUP = "_SYSTEMD_CGROUP"
SD_JOURNAL_FIELD_SYSTEMD_SESSION = "_SYSTEMD_SESSION"
SD_JOURNAL_FIELD_SYSTEMD_UNIT = "_SYSTEMD_UNIT"
SD_JOURNAL_FIELD_SYSTEMD_USER_UNIT = "_SYSTEMD_USER_UNIT"
SD_JOURNAL_FIELD_SYSTEMD_OWNER_UID = "_SYSTEMD_OWNER_UID"
SD_JOURNAL_FIELD_SYSTEMD_SLICE = "_SYSTEMD_SLICE"
SD_JOURNAL_FIELD_SELINUX_CONTEXT = "_SELINUX_CONTEXT"
SD_JOURNAL_FIELD_SOURCE_REALTIME_TIMESTAMP = "_SOURCE_REALTIME_TIMESTAMP"
SD_JOURNAL_FIELD_BOOT_ID = "_BOOT_ID"
SD_JOURNAL_FIELD_MACHINE_ID = "_MACHINE_ID"
SD_JOURNAL_FIELD_HOSTNAME = "_HOSTNAME"
SD_JOURNAL_FIELD_TRANSPORT = "_TRANSPORT"
// Address Fields
SD_JOURNAL_FIELD_CURSOR = "__CURSOR"
SD_JOURNAL_FIELD_REALTIME_TIMESTAMP = "__REALTIME_TIMESTAMP"
SD_JOURNAL_FIELD_MONOTONIC_TIMESTAMP = "__MONOTONIC_TIMESTAMP"
)
Journal event constants
const (
SD_JOURNAL_NOP = int(C.SD_JOURNAL_NOP)
SD_JOURNAL_APPEND = int(C.SD_JOURNAL_APPEND)
SD_JOURNAL_INVALIDATE = int(C.SD_JOURNAL_INVALIDATE)
)
const (
// IndefiniteWait is a sentinel value that can be passed to
// sdjournal.Wait() to signal an indefinite wait for new journal
// events. It is implemented as the maximum value for a time.Duration:
// https://github.com/golang/go/blob/e4dcf5c8c22d98ac9eac7b9b226596229624cb1d/src/time/time.go#L434
IndefiniteWait time.Duration = 1<<63 - 1
)
var (
// ErrExpired gets returned when the Follow function runs into the
// specified timeout.
ErrExpired = errors.New("Timeout expired")
)
var (
// ErrNoTestCursor gets returned when using TestCursor function and cursor
// parameter is not the same as the current cursor position.
ErrNoTestCursor = errors.New("Cursor parameter is not the same as current position")
)
Journal is a Go wrapper of an sd_journal structure.
type Journal struct {
// contains filtered or unexported fields
}
func NewJournal() (j *Journal, err error)
NewJournal returns a new Journal instance pointing to the local journal
func NewJournalFromDir(path string) (j *Journal, err error)
NewJournalFromDir returns a new Journal instance pointing to a journal residing in a given directory.
func NewJournalFromFiles(paths ...string) (j *Journal, err error)
NewJournalFromFiles returns a new Journal instance pointing to a journals residing in a given files.
func (j *Journal) AddConjunction() error
AddConjunction inserts a logical AND in the match list.
func (j *Journal) AddDisjunction() error
AddDisjunction inserts a logical OR in the match list.
func (j *Journal) AddMatch(match string) error
AddMatch adds a match by which to filter the entries of the journal.
func (j *Journal) Close() error
Close closes a journal opened with NewJournal.
func (j *Journal) FlushMatches()
FlushMatches flushes all matches, disjunctions and conjunctions.
func (j *Journal) GetBootID() (string, error)
GetBootID get systemd boot id
func (j *Journal) GetCatalog() (string, error)
GetCatalog retrieves a message catalog entry for the journal entry referenced by the last completed Next/Previous function call. To call GetCatalog, you must first have called one of these functions.
func (j *Journal) GetCursor() (string, error)
GetCursor gets the cursor of the last journal entry reeferenced by the last completed Next/Previous function call. To call GetCursor, you must first have called one of the Next/Previous functions.
func (j *Journal) GetData(field string) (string, error)
GetData gets the data object associated with a specific field from the the journal entry referenced by the last completed Next/Previous function call. To call GetData, you must have first called one of these functions.
func (j *Journal) GetDataBytes(field string) ([]byte, error)
GetDataBytes gets the data object associated with a specific field from the journal entry referenced by the last completed Next/Previous function call. To call GetDataBytes, you must first have called one of these functions.
func (j *Journal) GetDataValue(field string) (string, error)
GetDataValue gets the data object associated with a specific field from the journal entry referenced by the last completed Next/Previous function call, returning only the value of the object. To call GetDataValue, you must first have called one of the Next/Previous functions.
func (j *Journal) GetDataValueBytes(field string) ([]byte, error)
GetDataValueBytes gets the data object associated with a specific field from the journal entry referenced by the last completed Next/Previous function call, returning only the value of the object. To call GetDataValueBytes, you must first have called one of the Next/Previous functions.
func (j *Journal) GetEntry() (*JournalEntry, error)
GetEntry returns a full representation of the journal entry referenced by the last completed Next/Previous function call, with all key-value pairs of data as well as address fields (cursor, realtime timestamp and monotonic timestamp). To call GetEntry, you must first have called one of the Next/Previous functions.
func (j *Journal) GetMonotonicUsec() (uint64, error)
GetMonotonicUsec gets the monotonic timestamp of the journal entry referenced by the last completed Next/Previous function call. To call GetMonotonicUsec, you must first have called one of the Next/Previous functions.
func (j *Journal) GetRealtimeUsec() (uint64, error)
GetRealtimeUsec gets the realtime (wallclock) timestamp of the journal entry referenced by the last completed Next/Previous function call. To call GetRealtimeUsec, you must first have called one of the Next/Previous functions.
func (j *Journal) GetUniqueValues(field string) ([]string, error)
GetUniqueValues returns all unique values for a given field.
func (j *Journal) GetUsage() (uint64, error)
GetUsage returns the journal disk space usage, in bytes.
func (j *Journal) Next() (uint64, error)
Next advances the read pointer into the journal by one entry.
func (j *Journal) NextSkip(skip uint64) (uint64, error)
NextSkip advances the read pointer by multiple entries at once, as specified by the skip parameter.
func (j *Journal) Previous() (uint64, error)
Previous sets the read pointer into the journal back by one entry.
func (j *Journal) PreviousSkip(skip uint64) (uint64, error)
PreviousSkip sets back the read pointer by multiple entries at once, as specified by the skip parameter.
func (j *Journal) SeekCursor(cursor string) error
SeekCursor seeks to a concrete journal cursor. This call must be followed by a call to Next/Previous before any call to Get* will return data about the sought entry.
func (j *Journal) SeekHead() error
SeekHead seeks to the beginning of the journal, i.e. the oldest available entry. This call must be followed by a call to Next before any call to Get* will return data about the first element.
func (j *Journal) SeekRealtimeUsec(usec uint64) error
SeekRealtimeUsec seeks to the entry with the specified realtime (wallclock) timestamp, i.e. CLOCK_REALTIME. This call must be followed by a call to Next/Previous before any call to Get* will return data about the sought entry.
func (j *Journal) SeekTail() error
SeekTail may be used to seek to the end of the journal, i.e. the most recent available entry. This call must be followed by a call to Previous before any call to Get* will return data about the last element.
func (j *Journal) SetDataThreshold(threshold uint64) error
SetDataThreshold sets the data field size threshold for data returned by GetData. To retrieve the complete data fields this threshold should be turned off by setting it to 0, so that the library always returns the complete data objects.
func (j *Journal) TestCursor(cursor string) error
TestCursor checks whether the current position in the journal matches the specified cursor
func (j *Journal) Wait(timeout time.Duration) int
Wait will synchronously wait until the journal gets changed. The maximum time this call sleeps may be controlled with the timeout parameter. If sdjournal.IndefiniteWait is passed as the timeout parameter, Wait will wait indefinitely for a journal change.
JournalEntry represents all fields of a journal entry plus address fields.
type JournalEntry struct {
Fields map[string]string
Cursor string
RealtimeTimestamp uint64
MonotonicTimestamp uint64
}
JournalReader is an io.ReadCloser which provides a simple interface for iterating through the systemd journal. A JournalReader is not safe for concurrent use by multiple goroutines.
type JournalReader struct {
// contains filtered or unexported fields
}
func NewJournalReader(config JournalReaderConfig) (*JournalReader, error)
NewJournalReader creates a new JournalReader with configuration options that are similar to the systemd journalctl tool's iteration and filtering features.
func (r *JournalReader) Close() error
Close closes the JournalReader's handle to the journal.
func (r *JournalReader) Follow(until <-chan time.Time, writer io.Writer) error
Follow synchronously follows the JournalReader, writing each new journal entry to writer. The follow will continue until a single time.Time is received on the until channel.
func (r *JournalReader) Read(b []byte) (int, error)
Read reads entries from the journal. Read follows the Reader interface so it must be able to read a specific amount of bytes. Journald on the other hand only allows us to read full entries of arbitrary size (without byte granularity). JournalReader is therefore internally buffering entries that don't fit in the read buffer. Callers should keep calling until 0 and/or an error is returned.
func (r *JournalReader) Rewind() error
Rewind attempts to rewind the JournalReader to the first entry.
JournalReaderConfig represents options to drive the behavior of a JournalReader.
type JournalReaderConfig struct {
// The Since, NumFromTail and Cursor options are mutually exclusive and
// determine where the reading begins within the journal. The order in which
// options are written is exactly the order of precedence.
Since time.Duration // start relative to a Duration from now
NumFromTail uint64 // start relative to the tail
Cursor string // start relative to the cursor
// Show only journal entries whose fields match the supplied values. If
// the array is empty, entries will not be filtered.
Matches []Match
// If not empty, the journal instance will point to a journal residing
// in this directory. The supplied path may be relative or absolute.
Path string
// If not nil, Formatter will be used to translate the resulting entries
// into strings. If not set, the default format (timestamp and message field)
// will be used. If Formatter returns an error, Read will stop and return the error.
Formatter func(entry *JournalEntry) (string, error)
}
Match is a convenience wrapper to describe filters supplied to AddMatch.
type Match struct {
Field string
Value string
}
func (m *Match) String() string
String returns a string representation of a Match suitable for use with AddMatch.