sd_journal_open, sd_journal_open_directory, sd_journal_open_directory_fd, sd_journal_open_files, sd_journal_open_files_fd, sd_journal_close, sd_journal, SD_JOURNAL_LOCAL_ONLY, SD_JOURNAL_RUNTIME_ONLY, SD_JOURNAL_SYSTEM, SD_JOURNAL_CURRENT_USER, SD_JOURNAL_OS_ROOT — Open the system journal for reading
|const char *path,|
|const char **paths,|
sd_journal_open() opens the log journal
for reading. It will find all journal files automatically and
interleave them automatically when reading. As first argument it
takes a pointer to a
sd_journal pointer, which,
on success, will contain a journal context object. The second
argument is a flags field, which may consist of the following
flags ORed together:
makes sure only journal files generated on the local machine will
SD_JOURNAL_RUNTIME_ONLY makes sure
only volatile journal files will be opened, excluding those which
are stored on persistent storage.
SD_JOURNAL_SYSTEM will cause journal files of
system services and the kernel (in opposition to user session
processes) to be opened.
SD_JOURNAL_CURRENT_USER will cause journal
files of the current user to be opened. If neither
SD_JOURNAL_CURRENT_USER are specified, all
journal file types will be opened.
sd_journal_open_directory() is similar to
takes an absolute directory path as argument. All journal files in this directory will be opened and interleaved
automatically. This call also takes a flags argument. The only flags parameter accepted by this call is
SD_JOURNAL_OS_ROOT. If specified, the journal files are searched below the usual
/run/log/journal relative to the specified path,
instead of directly beneath it.
sd_journal_open_directory_fd() is similar to
sd_journal_open_directory(), but takes a file descriptor referencing a directory in the file
system instead of an absolute file system path.
sd_journal_open_files() is similar to
sd_journal_open() but takes a
NULL-terminated list of file paths to open. All files will be opened and interleaved
automatically. This call also takes a flags argument, but it must be passed as 0 as no flags are currently
understood for this call. Please note that in the case of a live journal, this function is only useful for
debugging, because individual journal files can be rotated at any moment, and the opening of specific files is
sd_journal_open_files_fd() is similar to
but takes an array of open file descriptors that must reference journal files, instead of an array of file system
paths. Pass the array of file descriptors as second argument, and the number of array entries in the third. The
flags parameter must be passed as 0.
sd_journal objects cannot be used in the
child after a fork. Functions which take a journal object as an
sd_journal_next() and others) will
-ECHILD after a fork.
sd_journal_close() will close the
journal context allocated with
sd_journal_open_directory() and free its
When opening the journal only journal files accessible to the calling user will be opened. If journal files are not accessible to the caller, this will be silently ignored.
for an example of how to iterate through the journal after opening
A journal context object returned by
sd_journal_open() references a specific
journal entry as current entry, similar to a
file seek index in a classic file system file, but without
absolute positions. It may be altered with
and related calls. The current entry position may be exported in
cursor strings, as accessible via
Cursor strings may be used to globally identify a specific journal
entry in a stable way and then later to seek to it (or if the
specific entry is not available locally, to its closest entry in
Notification of journal changes is available via
sd_journal_get_fd() and related calls.
sd_journal_open_files() calls return 0 on
success or a negative errno-style error code.
sd_journal_close() returns nothing.
sd_journal_close() interfaces are available
as a shared library, which can be compiled and linked to with the