9

I was wondering if it is possible to pull log messages for a particular log with systemd's journal logging. For example, when I open a log in C, openlog('slog', LOG_CONS | LOG_PID, LOG_LOCAL1), to pull just messages logged under 'slog' or LOCAL1?

When I do something like journalctl -u slog or journalctl -u LOG_LOCAL1, it just tells me when the log begins and ends, not the actual log messages.

2 Answers 2

12

Yes, it is possible, but you passed the wrong switch to journalctl.

According to journalctl(1) man page:

  • To read messages with a given syslog identifier (say, "foo"), issue journalctl -t foo or journalctl SYSLOG_IDENTIFIER=foo;

  • To read messages with a given syslog facility, issue journalctl SYSLOG_FACILITY=1 (note that facilities are stored and matched using their numeric values).

More generally, the syslog identifier and facility are stored in the journal as separate fields (SYSLOG_IDENTIFIER and SYSLOG_FACILITY). If you ever need to access the journal from, say, the C API, you will have to add matches on these fields directly.

The journalctl -u switch is used to add a match on the name of a systemd unit which owned the process which has generated the message. So this is the wrong switch to use.

0
5

Right. That does it. Time to script around journalctl.

#!/bin/bash

# Provide a simple command-line interface for systemd "journalctl"
# See /usr/include/sys/syslog.h for syslog integer ids
# Example usage: "./syslog/bin/syslogga.sh --local0 --tail" to tail local0

set -o nounset

declare -a OPTIONS
declare -a MATCHES

OPTIONS=()
MATCHES=()

function processOptions {

   local UNKNOWN=
   local HELP=
   local SYSLOGSEL=0

   for P in "$@"; do

      if [[ $P == --kernel || $P == --kern || $P == -0 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=0")
         continue
      fi

      if [[ $P == --user || $P == -1 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=1")
         continue
      fi

      if [[ $P == --mail || $P == -2 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=2")
         continue
      fi

      if [[ $P == --daemon || $P == -3 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=3")
         continue
      fi

      if [[ $P == --auth || $P == -4 || $P == --selinux ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=4")
         continue
      fi

      if [[ $P == --syslog || $P == -5 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=5")
         continue
      fi

      if [[ $P == --lpr || $P == -6 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=6")
         continue
      fi

      if [[ $P =~ --news || $P == -7 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=7")
         continue
      fi

      if [[ $P == --uucp || $P == -8 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=8")
         continue
      fi

      if [[ $P == --cron || $P == -9 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=9")
         continue
      fi

      if [[ $P == --authpriv || $P == -10 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=10")
         continue
      fi

      if [[ $P == --ftp || $P == -11 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=11")
         continue
      fi

      if [[ $P == --local0 || $P == -16 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=16")
         continue
      fi

      if [[ $P == --local1 || $P == -17 ]]; then 
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=17")
         continue
      fi

      # In our system, local2 is sshd log
      if [[ $P == --local2 || $P == -18 || $P == --ssh ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=18")
         continue
      fi

      # In our system, local3 is pdns-recursor log
      if [[ $P == --local3 || $P == -19 || $P == --dns ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=19")
         continue
      fi

      if [[ $P == --local4 || $P == -20 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=20")
         continue
      fi

      if [[ $P == --local5 || $P == -21 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=21")
         continue
      fi

      if [[ $P == --local6 || $P == -22 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=22")
         continue
      fi

      if [[ $P == --local7 || $P == -23 ]]; then
         (( SYSLOGSEL += 1 )); if [[ $SYSLOGSEL -gt 1 ]]; then break; fi 
         MATCHES+=("SYSLOG_FACILITY=23")
         continue
      fi

      # Additional options

      if [[ $P =~ ^(--tail|-t|--follow|-f) ]]; then
         OPTIONS+=("--follow") # yup, "journalctl" uses "follow" instead of "tail"
         continue
      fi

      if [[ $P =~ ^(--pager-end|-e|--bottom|--btm|--end) ]]; then
         OPTIONS+=("--pager-end")
         continue
      fi

      if [[ $P =~ ^(--help|-h) ]]; then
         HELP=1
         break
      fi

      # if we are here, we encountered something unknown in P
      # if UNKNOWN is already set, add a comma for separation

      if [[ -n $UNKNOWN ]]; then
         UNKNOWN="$UNKNOWN,"
      fi

      UNKNOWN="${UNKNOWN}${P}"

   done

   if [[ $SYSLOGSEL -gt 1 ]]; then
       echo "More than one facility selected" >&2
       HELP=1
   fi

   if [[ -n $UNKNOWN ]]; then
      echo "Unknown parameters '$UNKNOWN'" >&2
      HELP=1
   fi

   if [[ -n $HELP ]]; then
      # Only in our setup:
      SPECIAL_16
      cat >&2 <<HERE
Facilities:
--kern[el] , -0
--user     , -1
--mail     , -2
--daemon   , -3
--auth     , -4 , --selinux
--syslog   , -5
--lpr      , -6
--news     , -7
--uucp     , -8
--cron     , -9
--authpriv , -10
--ftp      , -11
--local0   , -16 
--local1   , -17
--local2   , -18 , --ssh
--local3   , -19 , --dns
--local4   , -20
--local5   , -21
--local6   , -22
--local7   , -23
Options:
--tail , --follow , -t , -f
--pager-end, --btm, --bottom, --end, -e
HERE
      exit 1
   fi

}

processOptions "$@"

declare -a ALL

ALL=()

if [[ -n ${OPTIONS[@]:-""} ]]; then
   ALL+=(${OPTIONS[@]})
fi

if [[ -n ${MATCHES[@]:-""} ]]; then
   ALL+=(${MATCHES[@]})
fi

if [[ -n ${ALL[@]:-""} ]]; then

   echo Running journalctl "${ALL[@]}" >&2

   journalctl "${ALL[@]}"

else 

   echo "Nothing set"

fi
3
  • 2
    Another thing systemd fails to do properly, great. m(
    – stefanct
    Nov 11, 2016 at 11:58
  • @stefanct May I ask you, what do you mean by "properly"? There is no established standard for naming command line arguments, hence your commentary sounds like groundless bashing.
    – intelfx
    Apr 29, 2017 at 21:31
  • 3
    This has not much to do with the naming but the availability of options. Apparently, journalctl does not natively allow to filter for standard facility names, which are standardized in POSIX btw, so that one has to rely on ridiculous workarounds like creating another mapping between those names and respective constants as the script above. Just another instance where systemd people ignore POSIX and become astonished when they get criticized for that...
    – stefanct
    Apr 30, 2017 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.