summaryrefslogtreecommitdiff
path: root/src/journal
AgeCommit message (Collapse)Author
2013-09-26journald: accept EPOLLERR from /dev/kmsgZbigniew Jędrzejewski-Szmek
Also print out unexpected epoll events explictly.
2013-09-17Remove six unused variables and add annotationZbigniew Jędrzejewski-Szmek
clang FTW!
2013-09-17journald: avoid NSS in journaldLennart Poettering
In order to avoid a deadlock between journald looking up the "systemd-journal" group name, and nscd (or anyother NSS backing daemon) logging something back to the journal avoid all NSS in journald the same way as we avoid it from PID 1. With this change we rely on the kernel file system logic to adjust the group of created journal files via the SETGID bit on the journal directory. To ensure that it is always set, even after the user created it with a simply "mkdir" on the shell we fix it up via tmpfiles on boot.
2013-09-17journald: log the slice of a process along with each message in _SYSTEMD_SLICE=Lennart Poettering
2013-09-12journald: Log error when failed to get machine-id on startOlivier Brunel
Can help since the journal requires /etc/machine-id to exists in order to start, and will simply silently exit when it does not.
2013-09-10journald: be a bit more verbose when vacuumingZbigniew Jędrzejewski-Szmek
Vacuuming behaviour is a bit confusing, and/or we have some bugs, so those additional messages should help to find out what's going on. Also, rotation of journal files shouldn't be happening too often, so the level of the messages is bumped to info, so that they'll be logged under normal operation.
2013-09-06systemd-coredump: Log crashes without coredumps on failureAndrew Cook
Make a best-effort attempt to store information about crashes during failure, currently if these are encountered the crash is completely silenced. ideally coredumpctl would show if a coredump is available.
2013-09-06systemd-coredump: Ignore coredumps larger than COREDUMP_MAXAndrew Cook
Currently this check happens when the coredump has been collected in it's entirety and being received by journald. this is not ideal behaviour when the crashing process is consuming significant percentage of physical memory such as a large instance of firefox or a java application.
2013-09-06journald: fix fd leak in journal_file_emptyGeorge McCollister
Before my previous patch, journal_file_empty wasn't be called with the correct filename. Now that it's being called with the correct filename it leaks file descriptors. This patch closes the file descriptors before returning. Signed-off-by: George McCollister <george.mccollister@gmail.com> [Edit harald@redhat.com: make use of _cleanup_close_ instead]
2013-09-06journald: fix vacuuming of archived journalsGeorge McCollister
d_name is modified on line 227 so if the entire journal name is needed again p must be used. Before this change when journal_file_empty was called on archived journals it would always return with -2. Signed-off-by: George McCollister <george.mccollister@gmail.com>
2013-08-22remove hasprefix(), use startswith()Shawn Landden
2013-08-22test: Make testing work on systems without or old systemdHolger Hans Peter Freyther
* Introduce a macro to conditionally execute tests. This avoids skipping the entire test if some parts require systemd * Skip the journal tests when no /etc/machine-id is present * Change test-catalog to load the catalog from the source directory of systemd. * /proc/PID/comm got introduced in v2.6.33 but travis is still using v2.6.32. * Enable make check and make distcheck on the travis build * Use -D"CATALOG_DIR=STR($(abs_top_srcdir)/catalog)" as a STRINGIY would result in the path '/home/ich/source/linux' to be expanded to '/home/ich/source/1' as linux is defined to 1.
2013-08-20logs-show: add short-precise mode with us timestampsZbigniew Jędrzejewski-Szmek
Also, always show us timestamps in verbose mode. https://bugzilla.redhat.com/show_bug.cgi?id=991678
2013-08-20Rename F_TYPE_CMP() to F_TYPE_EQUAL()Zbigniew Jędrzejewski-Szmek
2013-08-19journal: fix parsing of facility in syslog messagesZbigniew Jędrzejewski-Szmek
In 49998b383 (journald: do not overwrite syslog facility when parsing priority) journald started ignoring facility part when reading service stderr to convert to syslog messages. In this case it is fine, because only the priority is allowed. But the same codepath is used for syslog messages, where the facility should be used. Split the two codepaths by explicitly specyfing whether the facility should be ignored or not. https://bugzilla.redhat.com/show_bug.cgi?id=988814
2013-08-11systemctl: show hint about --full when lines don't fitZbigniew Jędrzejewski-Szmek
2013-08-06journald: remove unused variableZbigniew Jędrzejewski-Szmek
2013-08-06journal: handle multiline syslog messagesHarald Hoyer
Since the journal can handle multiple lines just well natively, and rsyslog can be configured to handle them as well, there is no need to truncate messages from syslog() after the first newline. Reproducer: 1. Add following four lines to /etc/rsyslog.conf ---------- $EscapeControlCharactersOnReceive off $ActionFileDefaultTemplate RSYSLOG_SysklogdFileFormat $SpaceLFOnReceive on $DropTrailingLFOnReception off ---------- 3. Restart rsyslog # service rsyslog restart 4. Compile and run the following program ---------- #include <stdio.h> #include <syslog.h> int main() { syslog(LOG_INFO, "aaa%caaa", '\n'); return 0; } ---------- Actual results: Below message appears in /var/log/messages. ----------    Sep 7 19:19:39 localhost test2: aaa ---------- Expected results: Below message, which worked prior to systemd-journald appears in /var/log/messages. ----------    Sep 7 19:19:39 localhost test2: aaa aaa https://bugzilla.redhat.com/show_bug.cgi?id=855313
2013-08-04systemd-delta: Only print colors when on a ttyDaniel Schaal
This make systemd-delta follow the behaviour of systemctl and journalctl. https://bugs.freedesktop.org/show_bug.cgi?id=67656 [zj: unify color query methods between those three programs.]
2013-08-02journal: fix hashmap leak in mmap-cacheGeorge McCollister
hashmap_free() wasn't being called on m->contexts and m->fds resulting in a leak. To reproduce do: while(1) { sd_journal_open(&j, SD_JOURNAL_LOCAL_ONLY); sd_journal_close(j); } Memory usage will increase until OOM.
2013-08-02tests: add a program for repetitive opening and closing of the journalZbigniew Jędrzejewski-Szmek
Basically wraps an example provided by George McCollister. Should help with leaks in the future.
2013-08-02coredumpctl: add more debug outputZbigniew Jędrzejewski-Szmek
It can be quite useful when somebody confuses _PID with COREDUMP_PID :).
2013-07-26journalctl: use _COMM= match for scriptsZbigniew Jędrzejewski-Szmek
In case of scripts, _EXE is set to the interpreter name, and _COMM is set based on the file name. Add a match for _COMM, and _EXE if the interpreter is not a link (e.g. for yum, the interpreter is /usr/bin/python, but it is a link to /usr/bin/python2, which in turn is a link to /usr/bin/python2.7, at least on Fedora, so we end up with _EXE=/usr/bin/python2.7). I don't think that such link chasing makes sense, because the final _EXE name is more likely to change.
2013-07-24journal: immediately sync to disk as soon as we receieve an EMERG/ALERT/CRIT ↵Lennart Poettering
message
2013-07-19journald: after the cgroup rework processes may be in both user and system ↵Lennart Poettering
units at the same time
2013-07-18journal: Leave server_dispatch_message early when Storage is noneHolger Hans Peter Freyther
When using Storage=none there is no point in collecting all the information just to throw them away. After this change journald consumes a lot less CPU time when only forwarding messages.
2013-07-18journalctl: add ”short-iso” output format with verbose ISO8601 timestampsTomasz Torcz
Example: 2013-07-18T10:10:01+0200 sandworm CROND[20957]: (root) CMD (/usr/lib64/sa/sa1 1 1)
2013-07-18journalctl: fix signedness warning and boot-id syntax checkZbigniew Jędrzejewski-Szmek
2013-07-17journalctl: remove ":" from the --boot syntaxZbigniew Jędrzejewski-Szmek
Instead of :-0, :1, :5, etc., use -0, 1 or +1, 5, etc. For BOOT_ID+OFFSET, use BOOT_ID+offset or BOOT_ID-offset (either + or - is required). Also make error handling a bit more robust and verbose. Modify the man page to describe the most common case (-b) first, and the second most common case (-b -1) second.
2013-07-16journalctl,systemctl: fix tiny memleakZbigniew Jędrzejewski-Szmek
2013-07-16journalctl: augment short mode with a cursor at the endZbigniew Jędrzejewski-Szmek
Two options are added: --show-cursor to print the cursor at the end, and --after-cursor to resume logs on the next line after the previous one.
2013-07-16journal: return -ECHILD after a forkZbigniew Jędrzejewski-Szmek
A few asserts are replaced with 'return -EINVAL'. I think that assert should not be used to check argument in public functions. Fields in struct sd_journal are rearranged to make it less swiss-cheesy.
2013-07-16journalctl: Add support for showing messages from a previous bootJan Janssen
Hi, I redid the boot ID look up to use enumerate_unique. This is quite fast if the cache is warm but painfully slow if it isn't. It has a slight chance of returning the wrong order if realtime clock jumps around. This one has to do n searches for every boot ID there is plus a sort, so it depends heavily on cache hotness. This is in contrast to the other way of look-up through filtering by a MESSAGE_ID, which only needs about 1 seek + whatever amount of relative IDs you want to walk. I also have a linked-list + (in-place) mergesort version of this patch, which has pretty much the same runtime. But since this one is using libc sorting and armortized allocation, I prefer this one. To summarize: The MESSAGE_ID way is a *lot* faster but can be incomplete due to rotation, while the enumerate+sort will find every boot ID out there but will be painfully slow for large journals and cold caches. You choose :P Jan
2013-07-16journal: add logging of effective capabilities _CAP_EFFECTIVEShawn Landden
I think this is the most important of the capabilities bitmasks to log.
2013-07-14journalctl: add --force option to recreate FSSShawn Landden
2013-07-13journalctl: have a useful --setup-keys error message when using ↵Shawn Landden
non-persistant logging Generating seed... Generating key pair... Generating sealing key... Failed to open /var/log/journal/33f46101703a10c5fc6fa4f451840101/fss.tmp.k2wDDU: No such file or directory
2013-07-12journald-server: r should be checked after journal_file_open_reliablyLukas Nykryn
2013-06-27journal-verify: Use proper printf placeholderJan Janssen
2013-06-24journald: always vacuum empty offline filesZbigniew Jędrzejewski-Szmek
Corrupted empty files are relatively common. I think they are created when a coredump for a user who never logged anything before is attempted to be written, but the write does not succeed because the coredump is too big, but there are probably other ways to create those, especially if the machine crashes at the right time. Non-corrupted empty files can also happen, e.g. if a journal file is opened, but nothing is ever successfully written to it and it is rotated because of MaxFileSec=. Either way, each "empty" journal file costs around 3 MB, and there's little point in keeping them around.
2013-06-24journald: fix space limits reportingZbigniew Jędrzejewski-Szmek
Reporting of the free space was bogus, since the remaining space was compared with the maximum allowed, instead of the current use being compared with the maximum allowed. Simplify and fix by reporting limits directly at the point where they are calculated. Also, assign a UUID to the message.
2013-06-24journal/vacuum: cleanupZbigniew Jędrzejewski-Szmek
2013-06-22journal-verify: allow unlinked data entriesZbigniew Jędrzejewski-Szmek
Sometimes an entry is not successfully written, and we end up with data items which are "unlinked", not connected to, and not used by any entry. This will usually happen when we write to write a core dump, and the initial small data fields are written successfully, but the huge COREDUMP= field is not written. This situation is hard to avoid, but the results are mostly harmless. Thus only warn about unused data items. Also, be more verbose about why journal files failed verification. This should help diagnose journal failure modes without resorting to a hexadecimal editor. https://bugs.freedesktop.org/show_bug.cgi?id=65235 (esp. see system.journal attached to the bug report).
2013-06-21journald: bump the journal per-unit ratelimit defaultsLennart Poettering
Too many people kept hitting them, so let's increase the limits a bit. https://bugzilla.redhat.com/show_bug.cgi?id=965803
2013-06-20journal: allow callers to specify OBJECT_PID=Zbigniew Jędrzejewski-Szmek
When journald encounters a message with OBJECT_PID= set coming from a priviledged process (UID==0), additional fields will be added to the message: OBJECT_UID=, OBJECT_GID=, OBJECT_COMM=, OBJECT_EXE=, OBJECT_CMDLINE=, OBJECT_AUDIT_SESSION=, OBJECT_AUDIT_LOGINUID=, OBJECT_SYSTEMD_CGROUP=, OBJECT_SYSTEMD_SESSION=, OBJECT_SYSTEMD_OWNER_UID=, OBJECT_SYSTEMD_UNIT= or OBJECT_SYSTEMD_USER_UNIT=. This is for other logging daemons, like setroubleshoot, to be able to augment their logs with data about the process. https://bugzilla.redhat.com/show_bug.cgi?id=951627
2013-06-20Add hasprefix macro to check prefixes of fixed lengthZbigniew Jędrzejewski-Szmek
2013-06-18journal: add references to SSKG paper FSS is based onLennart Poettering
2013-06-18journalctl: properly print headers of empty journalsZbigniew Jędrzejewski-Szmek
2013-06-17journalctl,loginctl,systemctl,systemd-cgls: add -l as alias for --fullDaniel Albers
https://bugs.freedesktop.org/show_bug.cgi?id=65850
2013-06-13journald: do not calculate free space too earlyZbigniew Jędrzejewski-Szmek
Since the system journal wasn't open yet, available_space() returned 0. Before: systemd-journal[22170]: Allowing system journal files to grow to 4.0G. systemd-journal[22170]: Journal size currently limited to 0B due to SystemKeepFree. After: systemd-journal[22178]: Allowing system journal files to grow to 4.0G. systemd-journal[22178]: Journal size currently limited to 3.0G due to SystemKeepFree. Also, when failing to write a message, show how much space was needed: "Failed to write entry (26 items, 260123456 bytes) despite vacuuming, ignoring: ...".
2013-06-13journal: use initialization instead of zeroingZbigniew Jędrzejewski-Szmek