summaryrefslogtreecommitdiff
path: root/src/journal
AgeCommit message (Collapse)Author
2013-10-13journald: use greedy_realloc in one placeZbigniew Jędrzejewski-Szmek
2013-10-13Never call qsort on potentially NULL arraysZbigniew Jędrzejewski-Szmek
This extends 62678ded 'efi: never call qsort on potentially NULL arrays' to all other places where qsort is used and it is not obvious that the count is non-zero.
2013-10-10security: missing header inclusionsLennart Poettering
2013-10-10security: rework selinux, smack, ima, apparmor detection logicLennart Poettering
Always cache the results, and bypass low-level security calls when the respective subsystem is not enabled.
2013-10-09journald: remove rotated file from hashmap when rotation failsZbigniew Jędrzejewski-Szmek
Before, when the user journal file was rotated, journal_file_rotate could close the old file and fail to open the new file. In that case, we would leave the old (deallocated) file in the hashmap. On subsequent accesses, we could retrieve this stale entry, leading to a segfault. When journal_file_rotate fails with the file pointer set to 0, old file is certainly gone, and cannot be used anymore. https://bugzilla.redhat.com/show_bug.cgi?id=890463
2013-10-09journald: replace new+snprintf with asprintfZbigniew Jędrzejewski-Szmek
2013-10-09tests: fix some memory leaks in testsLennart Poettering
2013-10-09journald: fix minor memory leakLennart Poettering
2013-10-07journalctl: flip to --full by defaultZbigniew Jędrzejewski-Szmek
We already shew lines in full when using a pager or not on a tty. The commit disables ellipsization in the sole remaining case, namely when --follow is used. This has been a popular request for a long time, and indeed, full output seems much more useful. Old behaviour can still be requested by using --no-full. Old options retain their behaviour for compatiblity, but aren't advertised as much. This change applies only to jornalctl, not to systemctl, when ellipsization is useful to keep the layout. https://bugzilla.redhat.com/show_bug.cgi?id=984758
2013-10-02journald: add missing error checkLennart Poettering
2013-09-27Do not use unitialized variable and remove duplicated lineZbigniew Jędrzejewski-Szmek
2013-09-26journald: accept EPOLLERR from /dev/kmsgZbigniew Jędrzejewski-Szmek
Also print out unexpected epoll events explictly.
2013-09-17Remove six unused variables and add annotationZbigniew Jędrzejewski-Szmek
clang FTW!
2013-09-17journald: avoid NSS in journaldLennart Poettering
In order to avoid a deadlock between journald looking up the "systemd-journal" group name, and nscd (or anyother NSS backing daemon) logging something back to the journal avoid all NSS in journald the same way as we avoid it from PID 1. With this change we rely on the kernel file system logic to adjust the group of created journal files via the SETGID bit on the journal directory. To ensure that it is always set, even after the user created it with a simply "mkdir" on the shell we fix it up via tmpfiles on boot.
2013-09-17journald: log the slice of a process along with each message in _SYSTEMD_SLICE=Lennart Poettering
2013-09-12journald: Log error when failed to get machine-id on startOlivier Brunel
Can help since the journal requires /etc/machine-id to exists in order to start, and will simply silently exit when it does not.
2013-09-10journald: be a bit more verbose when vacuumingZbigniew Jędrzejewski-Szmek
Vacuuming behaviour is a bit confusing, and/or we have some bugs, so those additional messages should help to find out what's going on. Also, rotation of journal files shouldn't be happening too often, so the level of the messages is bumped to info, so that they'll be logged under normal operation.
2013-09-06systemd-coredump: Log crashes without coredumps on failureAndrew Cook
Make a best-effort attempt to store information about crashes during failure, currently if these are encountered the crash is completely silenced. ideally coredumpctl would show if a coredump is available.
2013-09-06systemd-coredump: Ignore coredumps larger than COREDUMP_MAXAndrew Cook
Currently this check happens when the coredump has been collected in it's entirety and being received by journald. this is not ideal behaviour when the crashing process is consuming significant percentage of physical memory such as a large instance of firefox or a java application.
2013-09-06journald: fix fd leak in journal_file_emptyGeorge McCollister
Before my previous patch, journal_file_empty wasn't be called with the correct filename. Now that it's being called with the correct filename it leaks file descriptors. This patch closes the file descriptors before returning. Signed-off-by: George McCollister <george.mccollister@gmail.com> [Edit harald@redhat.com: make use of _cleanup_close_ instead]
2013-09-06journald: fix vacuuming of archived journalsGeorge McCollister
d_name is modified on line 227 so if the entire journal name is needed again p must be used. Before this change when journal_file_empty was called on archived journals it would always return with -2. Signed-off-by: George McCollister <george.mccollister@gmail.com>
2013-08-22remove hasprefix(), use startswith()Shawn Landden
2013-08-22test: Make testing work on systems without or old systemdHolger Hans Peter Freyther
* Introduce a macro to conditionally execute tests. This avoids skipping the entire test if some parts require systemd * Skip the journal tests when no /etc/machine-id is present * Change test-catalog to load the catalog from the source directory of systemd. * /proc/PID/comm got introduced in v2.6.33 but travis is still using v2.6.32. * Enable make check and make distcheck on the travis build * Use -D"CATALOG_DIR=STR($(abs_top_srcdir)/catalog)" as a STRINGIY would result in the path '/home/ich/source/linux' to be expanded to '/home/ich/source/1' as linux is defined to 1.
2013-08-20logs-show: add short-precise mode with us timestampsZbigniew Jędrzejewski-Szmek
Also, always show us timestamps in verbose mode. https://bugzilla.redhat.com/show_bug.cgi?id=991678
2013-08-20Rename F_TYPE_CMP() to F_TYPE_EQUAL()Zbigniew Jędrzejewski-Szmek
2013-08-19journal: fix parsing of facility in syslog messagesZbigniew Jędrzejewski-Szmek
In 49998b383 (journald: do not overwrite syslog facility when parsing priority) journald started ignoring facility part when reading service stderr to convert to syslog messages. In this case it is fine, because only the priority is allowed. But the same codepath is used for syslog messages, where the facility should be used. Split the two codepaths by explicitly specyfing whether the facility should be ignored or not. https://bugzilla.redhat.com/show_bug.cgi?id=988814
2013-08-11systemctl: show hint about --full when lines don't fitZbigniew Jędrzejewski-Szmek
2013-08-06journald: remove unused variableZbigniew Jędrzejewski-Szmek
2013-08-06journal: handle multiline syslog messagesHarald Hoyer
Since the journal can handle multiple lines just well natively, and rsyslog can be configured to handle them as well, there is no need to truncate messages from syslog() after the first newline. Reproducer: 1. Add following four lines to /etc/rsyslog.conf ---------- $EscapeControlCharactersOnReceive off $ActionFileDefaultTemplate RSYSLOG_SysklogdFileFormat $SpaceLFOnReceive on $DropTrailingLFOnReception off ---------- 3. Restart rsyslog # service rsyslog restart 4. Compile and run the following program ---------- #include <stdio.h> #include <syslog.h> int main() { syslog(LOG_INFO, "aaa%caaa", '\n'); return 0; } ---------- Actual results: Below message appears in /var/log/messages. ----------    Sep 7 19:19:39 localhost test2: aaa ---------- Expected results: Below message, which worked prior to systemd-journald appears in /var/log/messages. ----------    Sep 7 19:19:39 localhost test2: aaa aaa https://bugzilla.redhat.com/show_bug.cgi?id=855313
2013-08-04systemd-delta: Only print colors when on a ttyDaniel Schaal
This make systemd-delta follow the behaviour of systemctl and journalctl. https://bugs.freedesktop.org/show_bug.cgi?id=67656 [zj: unify color query methods between those three programs.]
2013-08-02journal: fix hashmap leak in mmap-cacheGeorge McCollister
hashmap_free() wasn't being called on m->contexts and m->fds resulting in a leak. To reproduce do: while(1) { sd_journal_open(&j, SD_JOURNAL_LOCAL_ONLY); sd_journal_close(j); } Memory usage will increase until OOM.
2013-08-02tests: add a program for repetitive opening and closing of the journalZbigniew Jędrzejewski-Szmek
Basically wraps an example provided by George McCollister. Should help with leaks in the future.
2013-08-02coredumpctl: add more debug outputZbigniew Jędrzejewski-Szmek
It can be quite useful when somebody confuses _PID with COREDUMP_PID :).
2013-07-26journalctl: use _COMM= match for scriptsZbigniew Jędrzejewski-Szmek
In case of scripts, _EXE is set to the interpreter name, and _COMM is set based on the file name. Add a match for _COMM, and _EXE if the interpreter is not a link (e.g. for yum, the interpreter is /usr/bin/python, but it is a link to /usr/bin/python2, which in turn is a link to /usr/bin/python2.7, at least on Fedora, so we end up with _EXE=/usr/bin/python2.7). I don't think that such link chasing makes sense, because the final _EXE name is more likely to change.
2013-07-24journal: immediately sync to disk as soon as we receieve an EMERG/ALERT/CRIT ↵Lennart Poettering
message
2013-07-19journald: after the cgroup rework processes may be in both user and system ↵Lennart Poettering
units at the same time
2013-07-18journal: Leave server_dispatch_message early when Storage is noneHolger Hans Peter Freyther
When using Storage=none there is no point in collecting all the information just to throw them away. After this change journald consumes a lot less CPU time when only forwarding messages.
2013-07-18journalctl: add ”short-iso” output format with verbose ISO8601 timestampsTomasz Torcz
Example: 2013-07-18T10:10:01+0200 sandworm CROND[20957]: (root) CMD (/usr/lib64/sa/sa1 1 1)
2013-07-18journalctl: fix signedness warning and boot-id syntax checkZbigniew Jędrzejewski-Szmek
2013-07-17journalctl: remove ":" from the --boot syntaxZbigniew Jędrzejewski-Szmek
Instead of :-0, :1, :5, etc., use -0, 1 or +1, 5, etc. For BOOT_ID+OFFSET, use BOOT_ID+offset or BOOT_ID-offset (either + or - is required). Also make error handling a bit more robust and verbose. Modify the man page to describe the most common case (-b) first, and the second most common case (-b -1) second.
2013-07-16journalctl,systemctl: fix tiny memleakZbigniew Jędrzejewski-Szmek
2013-07-16journalctl: augment short mode with a cursor at the endZbigniew Jędrzejewski-Szmek
Two options are added: --show-cursor to print the cursor at the end, and --after-cursor to resume logs on the next line after the previous one.
2013-07-16journal: return -ECHILD after a forkZbigniew Jędrzejewski-Szmek
A few asserts are replaced with 'return -EINVAL'. I think that assert should not be used to check argument in public functions. Fields in struct sd_journal are rearranged to make it less swiss-cheesy.
2013-07-16journalctl: Add support for showing messages from a previous bootJan Janssen
Hi, I redid the boot ID look up to use enumerate_unique. This is quite fast if the cache is warm but painfully slow if it isn't. It has a slight chance of returning the wrong order if realtime clock jumps around. This one has to do n searches for every boot ID there is plus a sort, so it depends heavily on cache hotness. This is in contrast to the other way of look-up through filtering by a MESSAGE_ID, which only needs about 1 seek + whatever amount of relative IDs you want to walk. I also have a linked-list + (in-place) mergesort version of this patch, which has pretty much the same runtime. But since this one is using libc sorting and armortized allocation, I prefer this one. To summarize: The MESSAGE_ID way is a *lot* faster but can be incomplete due to rotation, while the enumerate+sort will find every boot ID out there but will be painfully slow for large journals and cold caches. You choose :P Jan
2013-07-16journal: add logging of effective capabilities _CAP_EFFECTIVEShawn Landden
I think this is the most important of the capabilities bitmasks to log.
2013-07-14journalctl: add --force option to recreate FSSShawn Landden
2013-07-13journalctl: have a useful --setup-keys error message when using ↵Shawn Landden
non-persistant logging Generating seed... Generating key pair... Generating sealing key... Failed to open /var/log/journal/33f46101703a10c5fc6fa4f451840101/fss.tmp.k2wDDU: No such file or directory
2013-07-12journald-server: r should be checked after journal_file_open_reliablyLukas Nykryn
2013-06-27journal-verify: Use proper printf placeholderJan Janssen
2013-06-24journald: always vacuum empty offline filesZbigniew Jędrzejewski-Szmek
Corrupted empty files are relatively common. I think they are created when a coredump for a user who never logged anything before is attempted to be written, but the write does not succeed because the coredump is too big, but there are probably other ways to create those, especially if the machine crashes at the right time. Non-corrupted empty files can also happen, e.g. if a journal file is opened, but nothing is ever successfully written to it and it is rotated because of MaxFileSec=. Either way, each "empty" journal file costs around 3 MB, and there's little point in keeping them around.