[systemd-devel] [PATCH V2] journalctl: fix logic with parameter "-u"

[Lennart Poettering]

On Fri, 22.03.13 15:51, harald at redhat.com (harald at redhat.com) wrote:

> From: Harald Hoyer <harald at redhat.com>
> 
> When using "-p" and "-b" in combination with "-u", the output is not
> what you would expect. The reason is the sd_journal_add_disjunction()
> call in add_matches_for_unit() and add_matches_for_user_unit(), which
> adds two ORs without taking the other conditions to every OR.

Hmm, the current code that filters for units/coredumps is certainly
broken, but I fear that it's not the right solution...

The logic behind the matches would allow for expressions of any depth,
however, our API doesn't open this up, and only allows disjunctions of
conjunctions of very specific disjunctions. (i.e. an OR expression of
AND expressions of very specific OR expressions). It did this because I
wanted the API to be as simple as possible, and I didn't want to create
an API that was complex enough to build arbitrary boolean expressions.

To me it appears as if we should expose a fourth level on top, of AND
expressions, and should by this then expose a sufficiently capable
language that is good enough to do the unit matching.

Example, currently:

 "FOO=BAR + BAR=FOO WALDO=QUUX WALDO=QIIX"

will be resolved in three levels:

 Level 0 OR:   ("FOO=BAR" OR "BAR=FOO WALDO=QUUX WALDO=QIIX")
 Level 1 AND:  ("FOO=BAR" OR ("BAR=FOO" AND "WALDO=QUUX WALDO=QIIX"))
 Level 2 OR:   ("FOO=BAR" OR ("BAR=FOO" AND ("WALDO=QUUX" OR "WALDO=QIIX")))

And maybe we should beef this up with a level -1 implementing an AND.
For example, we could introduce the highest level with a parsing character such as @:

 "FOO=BAR + BAR=FOO WALDO=QUUX WALDO=QIIX @ MIAU=KIKIRIKI"

which would be resolved in four levels:

 Level 0 AND: (("FOO=BAR + BAR=FOO WALDO=QUUX WALDO=QIIX") AND ("MIAU=KIKIRIKI"))
 Level 1 OR:  (("FOO=BAR" OR "BAR=FOO WALDO=QUUX WALDO=QIIX") AND ("MIAU=KIKIRIKI"))
 Level 2 AND: (("FOO=BAR" OR ("BAR=FOO" AND "WALDO=QUUX WALDO=QIIX")) AND ("MIAU=KIKIRIKI"))
 Level 3 OR:  (("FOO=BAR" OR ("BAR=FOO" AND ("WALDO=QUUX" OR "WALDO=QIIX"))) AND ("MIAU=KIKIRIKI"))

Does this make sense?

On the API side we'd need an additional sd_journal_add_conjunction()
call. And sd_journal_add_match() and sd_journal_add_disjunction() need
to be updated to deal with the deeper hierarchy.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.