[systemd-devel] filtering journal logs

[Lennart Poettering]

On Sat, 20.06.15 00:57, Michał Zegan (webczat_200 at poczta.onet.pl) wrote:

> Hello.
> 
> I am curious if it is possible or planned to add support for pattern
> matching and/or negation matching in journal? for example I would like
> to view everything except audit entries.
> Actually, when we are at it, are audit entries actually distinguished
> now, or not?

Yes, audit messages have _TRANSPORT=audit set. 

There's currently no "negative" field matching, but we should add it,
and it's on the TODO list for a while. It's not trivial to do nicely
unfortunately, since the data structures are designed to find things
effectively, but not skip things effectively... But certainly doable.

Lennart

-- 
Lennart Poettering, Red Hat