SD_JOURNAL_OPEN(3)

📦
version 261.3 · 16 versions
, in ubuntu stonking

💖 NAME 💖

okay so bestie, this whole page is about the squad of functions that open the system journal for reading — and uh, that's kind of a big deal 👑

The full roster (yes, all of them, no skipping 🙅) is:

  • sd_journal_open
  • sd_journal_open_directory
  • sd_journal_open_directory_fd
  • sd_journal_open_files
  • sd_journal_open_files_fd
  • sd_journal_open_namespace
  • sd_journal_close
  • sd_journal
  • SD_JOURNAL_LOCAL_ONLY
  • SD_JOURNAL_RUNTIME_ONLY
  • SD_JOURNAL_SYSTEM
  • SD_JOURNAL_CURRENT_USER
  • SD_JOURNAL_OS_ROOT
  • SD_JOURNAL_ALL_NAMESPACES
  • SD_JOURNAL_INCLUDE_DEFAULT_NAMESPACE
  • SD_JOURNAL_TAKE_DIRECTORY_FD

and what do they all do? they open the system journal for reading. iconic. ✨

🦋 SYNOPSIS 🦋

like, here's the exact shape of everything, fr fr:

#include <systemd/sd-journal.h>

int sd_journal_open(sd_journal **ret, int flags);

int sd_journal_open_namespace(sd_journal **ret, const char *namespace,
                              int flags);

int sd_journal_open_directory(sd_journal **ret, const char *path,
                              int flags);

int sd_journal_open_directory_fd(sd_journal **ret, int fd, int flags);

int sd_journal_open_files(sd_journal **ret, const char **paths,
                          int flags);

int sd_journal_open_files_fd(sd_journal **ret, int fds[],
                             unsigned n_fds, int flags);

void sd_journal_close(sd_journal *j);

🌸 DESCRIPTION 🌸

sd_journal_open() — the main character 👑

sd_journal_open() opens the log journal for reading. it will find all journal files automatically and interleave them automatically when reading. so you don't gotta do the legwork, it just does it 💅

first argument is a pointer to a sd_journal pointer, which on success will contain a journal context object (that's your new bestie). second argument is a flags field, which may consist of the following flags ORed together:

  • SD_JOURNAL_LOCAL_ONLY — makes sure only journal files generated on the local machine get opened 🏠
  • SD_JOURNAL_RUNTIME_ONLY — makes sure only volatile journal files get opened, excluding the ones stored on persistent storage 🫧
  • SD_JOURNAL_SYSTEM — causes journal files of system services and the kernel to be opened (as opposed to user session processes) 🖥️
  • SD_JOURNAL_CURRENT_USER — causes journal files of the current user to be opened 🙋

and if neither SD_JOURNAL_SYSTEM nor SD_JOURNAL_CURRENT_USER are specified, all journal file types will be opened. everything. the whole buffet 🍓

sd_journal_open_namespace() — same vibe, but with a namespace 🧚

sd_journal_open_namespace() is similar to sd_journal_open() but takes an additional namespace parameter that specifies which journal namespace to operate on.

  • if specified as NULL, the call is identical to sd_journal_open() 🪞
  • if non-NULL, only data from the namespace identified by the specified parameter is accessed

this call understands two additional flags:

  • SD_JOURNAL_ALL_NAMESPACES — the namespace parameter is ignored and all defined namespaces are accessed simultaneously 🤯
  • SD_JOURNAL_INCLUDE_DEFAULT_NAMESPACE — the specified namespace and the default namespace are accessed, but no others. heads up: this flag has no effect when namespace is passed as NULL ⚠️

for details about journal namespaces, go peek at systemd-journald.service(8) 📖

sd_journal_open_directory() — pick a directory, any directory 📁

sd_journal_open_directory() is similar to sd_journal_open() but takes an absolute directory path as argument. all journal files in this directory will be opened and interleaved automatically. slay.

this call also takes a flags argument, and the flags parameters accepted by this call are:

  • SD_JOURNAL_OS_ROOT
  • SD_JOURNAL_SYSTEM
  • SD_JOURNAL_CURRENT_USER

if SD_JOURNAL_OS_ROOT is specified, journal files are searched for below the usual /var/log/journal and /run/log/journal relative to the specified path, instead of directly beneath it. the other two flags limit which files are opened, the same as for sd_journal_open() 🔍

sd_journal_open_directory_fd() — same but with a file descriptor 🔥

sd_journal_open_directory_fd() is similar to sd_journal_open_directory(), but takes a file descriptor referencing a directory in the file system instead of an absolute file system path.

in addition to the flags accepted by sd_journal_open_directory(), this function also accepts SD_JOURNAL_TAKE_DIRECTORY_FD. here's the tea:

  • if SD_JOURNAL_TAKE_DIRECTORY_FD is specified, the function will take ownership of the specified file descriptor on success, and it will be closed by sd_journal_close() — so like, the caller of the function must not close the file descriptor 🙈
  • when the flag is not specified, sd_journal_close() will not close the file descriptor, so the caller should close it after sd_journal_close() 👌

sd_journal_open_files() — you hand it the paths 🎀

sd_journal_open_files() is similar to sd_journal_open() but takes a NULL-terminated list of file paths to open. all files will be opened and interleaved automatically.

this call also takes a flags argument, but it must be passed as 0 as no flags are currently understood for this call. zero. nothing. that's the whole vibe 🫶

⚠️ please note: in the case of a live journal, this function is only useful for debugging, because individual journal files can be rotated at any moment, and the opening of specific files is inherently racy. like, genuinely racy. be careful bestie 😭

sd_journal_open_files_fd() — you hand it the fds 🍓

sd_journal_open_files_fd() is similar to sd_journal_open_files() but takes an array of open file descriptors that must reference journal files, instead of an array of file system paths.

  • pass the array of file descriptors as second argument
  • and the number of array entries in the third

the flags parameter must be passed as 0. no cap. 💀

fork() warning — read this one fr fr 🚨

sd_journal objects cannot be used in the child after a fork. functions which take a journal object as an argument (sd_journal_next() and others) will return -ECHILD after a fork. so like… don't do that 💅

sd_journal_close() — the goodbye 🥺

sd_journal_close() will close the journal context allocated with sd_journal_open() or sd_journal_open_directory() and free its resources. clean up after yourself, king 👑

permissions, silently ✨

when opening the journal, only journal files accessible to the calling user will be opened. if journal files are not accessible to the caller, this will be silently ignored. no error, no drama, just vibes 🤫

how to actually iterate 👀

see sd_journal_next(3) for an example of how to iterate through the journal after opening it with sd_journal_open().

the current entry + cursor lore 🌈

a journal context object returned by sd_journal_open() references a specific journal entry as current entry, similar to a file seek index in a classic file system file — but without absolute positions. it may be altered with sd_journal_next(3) and sd_journal_seek_head(3) and related calls.

the current entry position may be exported in cursor strings, as accessible via sd_journal_get_cursor(3). cursor strings may be used to:

  • globally identify a specific journal entry in a stable way 🎯
  • and then later seek to it via sd_journal_seek_cursor(3) — or, if the specific entry is not available locally, to its closest entry in time ⏳

notification of journal changes is available via sd_journal_get_fd() and related calls. yup, you can get notified 🔔

⭐ RETURN VALUE ⭐

the sd_journal_open(), sd_journal_open_directory(), and sd_journal_open_files() calls return 0 on success or a negative errno-style error code. sd_journal_close() returns nothing. that's it, that's the whole thing 💖

💜 NOTES 💜

all functions listed here are thread-agnostic and only a single thread may operate on a given object at any given time. different threads may access the same object at different times. multiple independent objects may be used from different threads in parallel. so like, share responsibly 🫶

functions described here are available as a shared library, which can be compiled against and linked to with the libsystemd pkg-config(1) file 🔗

👑 HISTORY 👑

the timeline, bestie 🕰️:

  • sd_journal_open(), sd_journal_open_directory(), and sd_journal_close() were added in version 187
  • sd_journal_open_files() was added in version 205
  • sd_journal_open_directory_fd() and sd_journal_open_files_fd() were added in version 230
  • sd_journal_open_namespace() was added in version 245

glow-up after glow-up, honestly ✨

🧚 SEE ALSO 🧚

go read these next, iyklyk 📚:

and that's the whole page, bestie 🎀 this lil' beauty ships as part of systemd 261.3 — go open some journals, you absolute icon 💅💖✨

📦 where this page comes from