Documentation
¶
Overview ¶
Package journal reads systemd journal files (the format of systemd's JOURNAL_FILE_FORMAT.md): regular and compact layouts, XZ, LZ4 and ZSTD compressed data objects, keyed or Jenkins hashes.
It reads through an io.ReaderAt and never writes. Every offset is checked against the size the file had when opened; every decompressed DATA payload is capped (MaxData) before it is allocated, and a field's name is read before its value is decompressed, so a field the caller does not keep is never decompressed whole. What it returns is raw journal content.
Index ¶
- Constants
- Variables
- type ArrayPos
- type Entry
- type EntryHead
- type Field
- type File
- func (f *File) Close()
- func (f *File) Entry(off uint64, keep func(name string) bool) (*Entry, error)
- func (f *File) EntryOffsets(fn func(i uint64, off uint64) bool) error
- func (f *File) EntryOffsetsFrom(p ArrayPos, fn func(i uint64, off uint64, at ArrayPos) bool) error
- func (f *File) Head(off uint64) (EntryHead, error)
- func (f *File) Header() Header
- func (f *File) Realtime(off uint64) (uint64, error)
- type Header
Constants ¶
const ( // MaxData is the largest decompressed DATA payload (name=value) the // reader returns; larger fields are reported as dropped. MaxData = 1 << 20 // MaxEntryData bounds the decompressed bytes kept for one entry: the // fields past it are reported as dropped. MaxEntryData = 2 * MaxData // MaxNameBytes is the longest field name journald accepts. MaxNameBytes = 64 )
const MaxXZDict uint64 = MaxData + 64<<10
MaxXZDict is the largest LZMA2 dictionary an XZ payload may declare. The decoder allocates the declared dictionary, so a crafted header could otherwise make it allocate up to 4 GiB; payloads are at most MaxData, so a larger dictionary is never needed (journald's own is 1 MiB).
Variables ¶
var ( ErrNotJournal = errors.New("journal: not a journal file") ErrUnsupported = errors.New("journal: unsupported journal file features") ErrCorrupt = errors.New("journal: corrupt journal file") )
Errors. Their text never holds journal content.
Functions ¶
This section is empty.
Types ¶
type ArrayPos ¶ added in v0.2.0
type ArrayPos struct {
Offset, Index uint64
}
ArrayPos is a position in the entry-array chain: the offset of an entry-array object and the index of its first entry. The zero value is the head of the chain.
type Entry ¶
type Entry struct {
EntryHead
Offset uint64
// Fields are the kept fields in the file's item order; a name may
// repeat.
Fields []Field
// Dropped counts fields left out: kept fields over MaxData or past the
// entry's budgets, and compressed fields left undecoded (their name
// unread) once the decode budget is spent.
Dropped int
// Decoded is the decompression work the entry cost, in bytes (names
// and values decoded, not served from the caches): the bytes a
// source reports as processed besides the entry's own size.
Decoded int64
}
Entry is one entry with the fields its reader kept.
type EntryHead ¶
type EntryHead struct {
Seqnum uint64
Realtime uint64 // µs since the epoch
Monotonic uint64
BootID [16]byte
XorHash uint64
Size uint64 // object size
}
EntryHead is an entry's fixed part: no field is read.
type File ¶
type File struct {
// contains filtered or unexported fields
}
File is an open journal file. It is not safe for concurrent use.
func (*File) Entry ¶
Entry reads the entry at off. keep is called with each field's name (before its value is decompressed); only fields it accepts are read. On an error after the entry's header, the partial entry (its Size and the work Decoded so far) is returned with the error.
func (*File) EntryOffsets ¶
EntryOffsets walks the entry-array chain from the header and calls fn with each entry's index and object offset, in file order (seqnum order), until fn returns false.
func (*File) EntryOffsetsFrom ¶ added in v0.2.0
EntryOffsetsFrom walks the chain as EntryOffsets does, from the array at p (the zero ArrayPos: the header's first), and also gives fn the position of the array holding each entry: a later walk may resume there (a position read from an earlier walk of the same, unchanged file) without reading the arrays before it.
type Header ¶
type Header struct {
Compatible, Incompatible uint32
State uint8
FileID, MachineID [16]byte
SeqnumID [16]byte
HeaderSize uint64
NEntries uint64
EntryArrayOffset uint64
HeadRealtime uint64
TailRealtime uint64
TailObjectOffset uint64
}
Header is the part of the file header the reader uses.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package journaltest builds small journal files in memory for tests and fuzz seeds: header, DATA, ENTRY and chained ENTRY_ARRAY objects, regular or compact, plain or ZSTD/LZ4/XZ compressed (no hash tables: the reader does not use them).
|
Package journaltest builds small journal files in memory for tests and fuzz seeds: header, DATA, ENTRY and chained ENTRY_ARRAY objects, regular or compact, plain or ZSTD/LZ4/XZ compressed (no hash tables: the reader does not use them). |