'\" t .TH "SD_JOURNAL_GET_DATA" "3" "" "systemd 215" "sd_journal_get_data" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .\" http://bugs.debian.org/507673 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" ----------------------------------------------------------------- .\" * set default formatting .\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .\" ----------------------------------------------------------------- .\" * MAIN CONTENT STARTS HERE * .\" ----------------------------------------------------------------- .SH "NAME" sd_journal_get_data, sd_journal_enumerate_data, sd_journal_restart_data, SD_JOURNAL_FOREACH_DATA, sd_journal_set_data_threshold, sd_journal_get_data_threshold \- Read data fields from the current journal entry .SH "SYNOPSIS" .sp .ft B .nf #include .fi .ft .HP \w'int\ sd_journal_get_data('u .BI "int sd_journal_get_data(sd_journal\ *" "j" ", const\ char\ *" "field" ", const\ void\ **" "data" ", size_t\ *" "length" ");" .HP \w'int\ sd_journal_enumerate_data('u .BI "int sd_journal_enumerate_data(sd_journal\ *" "j" ", const\ void\ **" "data" ", size_t\ *" "length" ");" .HP \w'void\ sd_journal_restart_data('u .BI "void sd_journal_restart_data(sd_journal\ *" "j" ");" .HP \w'SD_JOURNAL_FOREACH_DATA('u .BI "SD_JOURNAL_FOREACH_DATA(sd_journal\ *" "j" ", const\ void\ *" "data" ", size_t\ " "length" ");" .HP \w'int\ sd_journal_set_data_threshold('u .BI "int sd_journal_set_data_threshold(sd_journal\ *" "j" ", size_t\ " "sz" ");" .HP \w'int\ sd_journal_get_data_threshold('u .BI "int sd_journal_get_data_threshold(sd_journal\ *" "j" ", size_t\ *" "sz" ");" .SH "DESCRIPTION" .PP \fBsd_journal_get_data()\fR gets the data object associated with a specific field from the current journal entry\&. It takes four arguments: the journal context object, a string with the field name to request, plus a pair of pointers to pointer/size variables where the data object and its size shall be stored in\&. The field name should be an entry field name\&. Well\-known field names are listed in \fBsystemd.journal-fields\fR(7)\&. The returned data is in a read\-only memory map and is only valid until the next invocation of \fBsd_journal_get_data()\fR or \fBsd_journal_enumerate_data()\fR, or the read pointer is altered\&. Note that the data returned will be prefixed with the field name and \*(Aq=\*(Aq\&. Also note that by default data fields larger than 64K might get truncated to 64K\&. This threshold may be changed and turned off with \fBsd_journal_set_data_threshold()\fR (see below)\&. .PP \fBsd_journal_enumerate_data()\fR may be used to iterate through all fields of the current entry\&. On each invocation the data for the next field is returned\&. The order of these fields is not defined\&. The data returned is in the same format as with \fBsd_journal_get_data()\fR and also follows the same life\-time semantics\&. .PP \fBsd_journal_restart_data()\fR resets the data enumeration index to the beginning of the entry\&. The next invocation of \fBsd_journal_enumerate_data()\fR will return the first field of the entry again\&. .PP Note that the \fBSD_JOURNAL_FOREACH_DATA()\fR macro may be used as a handy wrapper around \fBsd_journal_restart_data()\fR and \fBsd_journal_enumerate_data()\fR\&. .PP Note that these functions will not work before \fBsd_journal_next\fR(3) (or related call) has been called at least once, in order to position the read pointer at a valid entry\&. .PP \fBsd_journal_set_data_threshold()\fR may be used to change the data field size threshold for data returned by \fBsd_journal_get_data()\fR, \fBsd_journal_enumerate_data()\fR and \fBsd_journal_enumerate_unique()\fR\&. This threshold is a hint only: it indicates that the client program is interested only in the initial parts of the data fields, up to the threshold in size \-\- but the library might still return larger data objects\&. That means applications should not rely exclusively on this setting to limit the size of the data fields returned, but need to apply a explicit size limit on the returned data as well\&. This threshold defaults to 64K by default\&. To retrieve the complete data fields this threshold should be turned off by setting it to 0, so that the library always returns the complete data objects\&. It is recommended to set this threshold as low as possible since this relieves the library from having to decompress large compressed data objects in full\&. .PP \fBsd_journal_get_data_threshold()\fR returns the currently configured data field size threshold\&. .SH "RETURN VALUE" .PP \fBsd_journal_get_data()\fR returns 0 on success or a negative errno\-style error code\&. If the current entry does not include the specified field, \-ENOENT is returned\&. If \fBsd_journal_next\fR(3) has not been called at least once, \-EADDRNOTAVAIL is returned\&. \fBsd_journal_enumerate_data()\fR returns a positive integer if the next field has been read, 0 when no more fields are known, or a negative errno\-style error code\&. \fBsd_journal_restart_data()\fR returns nothing\&. \fBsd_journal_set_data_threshold()\fR and \fBsd_journal_get_threshold()\fR return 0 on success or a negative errno\-style error code\&. .SH "NOTES" .PP The \fBsd_journal_get_data()\fR, \fBsd_journal_enumerate_data()\fR, \fBsd_journal_restart_data()\fR, \fBsd_journal_set_data_threshold()\fR and \fBsd_journal_get_data_threshold()\fR interfaces are available as a shared library, which can be compiled and linked to with the \fBlibsystemd\fR\ \&\fBpkg-config\fR(1) file\&. .SH "EXAMPLES" .PP See \fBsd_journal_next\fR(3) for a complete example how to use \fBsd_journal_get_data()\fR\&. .PP Use the \fBSD_JOURNAL_FOREACH_DATA\fR macro to iterate through all fields of the current journal entry: .sp .if n \{\ .RS 4 .\} .nf \&.\&.\&. int print_fields(sd_journal *j) { const void *data; size_t length; SD_JOURNAL_FOREACH_DATA(j, data, length) printf("%\&.*s\en", (int) length, data); } \&.\&.\&. .fi .if n \{\ .RE .\} .SH "SEE ALSO" .PP \fBsystemd\fR(1), \fBsystemd.journal-fields\fR(7), \fBsd-journal\fR(3), \fBsd_journal_open\fR(3), \fBsd_journal_next\fR(3), \fBsd_journal_get_realtime_usec\fR(3), \fBsd_journal_query_unique\fR(3)