Documentation
¶
Overview ¶
Package journald is the journald log source: systemd journal files under the console's read-only journal roots, read by the pure-Go reader in ./journal, with a field allowlist applied before any value is read.
Only MESSAGE (decoded by the source's parser, masked as text downstream) and the allowed fields (the trusted journald fields, the human's trusted fields and the reviewed allow list) ever leave this package. Core dumps, command lines, executables, audit and OBJECT_ fields and binary values are dropped whatever the lists say.
Index ¶
- Constants
- Variables
- func NeverServed(name string) bool
- type Options
- type Source
- func (s *Source) Around(ctx context.Context, ref source.RawRef, before, after int) ([]source.RawRecord, error)
- func (s *Source) Describe(ctx context.Context) (source.Schema, error)
- func (s *Source) Kind() string
- func (s *Source) Name() string
- func (s *Source) Plan(ctx context.Context, r source.Range, _ source.Selector) (source.Byteplan, error)
- func (s *Source) Reread(ctx context.Context, ref source.RawRef) (source.RawRecord, error)
- func (s *Source) Scan(ctx context.Context, c source.Chunk) (source.Iterator, error)
Constants ¶
const ( // GranuleEntries is the size of a plan granule: fixed groups of // entries of one file, in file order, independent of any query. GranuleEntries = 256 // MaxAround bounds before and after of Around. MaxAround = 50 )
const Kind = "journald"
Kind is the source kind.
Variables ¶
var Trusted = []string{"CODE_FILE", "CODE_FUNC", "CODE_LINE", "CONTAINER_NAME", "PRIORITY",
"SYSLOG_IDENTIFIER", "_HOSTNAME", "_PID", "_SYSTEMD_UNIT", "_TRANSPORT"}
Trusted are the journald fields locklog always serves (after the detectors), besides MESSAGE.
Functions ¶
func NeverServed ¶
NeverServed reports a field no list can make this source serve: core dumps, command lines, executables, audit records and OBJECT_ fields.
Types ¶
type Options ¶
type Options struct {
Name string
// Roots are the journal roots mounted read-only (/var/log/journal,
// /run/log/journal): each holds <machine-id>/ directories.
Roots []string
// Units are globs on _SYSTEMD_UNIT; empty serves every unit.
Units []string
// Trusted are the human's trusted fields beyond Trusted; Allow the
// reviewed fields served (masked) besides MESSAGE and the trusted ones.
Trusted []string
Allow []string
// UserJournals also serves user-*.journal files.
UserJournals bool
// Parser decodes MESSAGE (format of the message).
Parser *parse.Parser
// Now is the clock (tests).
Now func() time.Time
}
Options configure a journald source.
type Source ¶
type Source struct {
// contains filtered or unexported fields
}
Source is a journald source. It is safe for concurrent use.
func (*Source) Around ¶
func (s *Source) Around(ctx context.Context, ref source.RawRef, before, after int) ([]source.RawRecord, error)
Around returns up to before served entries before ref, ref's entry and up to after served entries after it, from ref's file.
func (*Source) Describe ¶
Describe returns the source's fields, file count, size and time bounds. It reads headers only.
func (*Source) Plan ¶
func (s *Source) Plan(ctx context.Context, r source.Range, _ source.Selector) (source.Byteplan, error)
Plan returns, per file, one chunk per run of consecutive granules that may hold entries of r, judged on each granule's true time bounds (every entry's timestamp), so clock steps inside a file never drop an entry.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package journal reads systemd journal files (the format of systemd's JOURNAL_FILE_FORMAT.md): regular and compact layouts, XZ, LZ4 and ZSTD compressed data objects, keyed or Jenkins hashes.
|
Package journal reads systemd journal files (the format of systemd's JOURNAL_FILE_FORMAT.md): regular and compact layouts, XZ, LZ4 and ZSTD compressed data objects, keyed or Jenkins hashes. |
|
journaltest
Package journaltest builds small journal files in memory for tests and fuzz seeds: header, DATA, ENTRY and chained ENTRY_ARRAY objects, regular or compact, plain or ZSTD/LZ4/XZ compressed (no hash tables: the reader does not use them).
|
Package journaltest builds small journal files in memory for tests and fuzz seeds: header, DATA, ENTRY and chained ENTRY_ARRAY objects, regular or compact, plain or ZSTD/LZ4/XZ compressed (no hash tables: the reader does not use them). |