[systemd-devel] journalctl | grep -v mail.*

[Lennart Poettering]

On Tue, 23.10.12 22:38, Olav Vitters (olav at vitters.nl) wrote:

> I'm trying to learn journalctl a bit.
> 
> I'd prefer if I could do a grep -v, but in journalctl using some
> argument, e.g. -v.

Negative filtering (i.e. not foo=bar, but foo!=bar) is currently not
implemented. I have figured out how to implement this relatively
efficiently now, but this will take some time to implement. It's on the
TODO list.

> I noticed the SYSLOG_FACILITY for postfix is given as "2", shouldn't
> that be 16? In /usr/include/sys/syslog.h it has 2<<3 for LOG_MAIL, I'd
> expect that to be in SYSLOG_FACILITY. At the moment I'm still using
> rsyslog and /etc/syslog.conf allows me to redirect mail related things
> just fine, example:
> mail.=debug;mail.=info;mail.=notice
> -/var/log/mail/info.log

The full syslog priority field is decoded into PRIORITY= and
SYSLOG_FACILITY=, so that it is easy to filter for them
independently. The latter has the SYSLOG_ prefix since we consider a bit
of an outdated concept. 20 numeric facilities are quite limited, and it
is _SYSTEMD_UNIT= usually a much better way to filter things. We do
store it however, in order not to lose any data.

Messages that are not genreated via syslog( )wil not carry
SYSLOG_FACILITY= however, but they will carry the log priority, since
that is generally useful functionality.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.