module Systemd::Journal::Filterable

Public Instance Methods

add_conjunction() click to toggle source

Add an AND condition to the filter. All previously added terms will be ANDed together with terms following the conjunction. {#move_next} or {#move_previous} must be invoked after adding a match before attempting to read from the journal. @return [nil] @example Filter entries returned using an AND condition

j = Systemd::Journal.new
j.add_filter('PRIORITY', 5)
j.add_conjunction
j.add_filter('_EXE', '/usr/bin/sshd')
while j.move_next
  # current_entry is an sshd event with priority 5
end
# File lib/systemd/journal/filterable.rb, line 90
def add_conjunction
  rc = Native.sd_journal_add_conjunction(@ptr)
  raise JournalError, rc if rc < 0
end
add_disjunction() click to toggle source

Add an OR condition to the filter. All previously added matches will be ORed with the terms following the disjunction. {#move_next} or {#move_previous} must be invoked after adding a match before attempting to read from the journal. @return [nil] @example Filter entries returned using an OR condition

j = Systemd::Journal.new
j.add_filter('PRIORITY', 5)
j.add_disjunction
j.add_filter('_EXE', '/usr/bin/sshd')
while j.move_next
  # current_entry is either an sshd event or
  # has priority 5
end
# File lib/systemd/journal/filterable.rb, line 72
def add_disjunction
  rc = Native.sd_journal_add_disjunction(@ptr)
  raise JournalError, rc if rc < 0
end
add_filter(field, value) click to toggle source

Add a filter to journal, such that only entries where the given filter matches are returned. {#move_next} or {#move_previous} must be invoked after adding a filter before attempting to read from the journal. @param [String] field the column to filter on, e.g. _PID, _EXE. @param [String] value the match to search for, e.g. '/usr/bin/sshd' @return [nil]

# File lib/systemd/journal/filterable.rb, line 38
def add_filter(field, value)
  match = "#{field.to_s.upcase}=#{value}"
  rc = Native.sd_journal_add_match(@ptr, match, match.length)
  raise JournalError, rc if rc < 0
end
add_filters(filters) click to toggle source

Add a set of filters to the journal, such that only entries where the given filters match are returned. @param [Hash] filters a set of field/filter value pairs.

If the filter value is an array, each value in the array is added
and entries where the specified field matches any of the values is
returned.

@example Filter by PID and EXE

j.add_filters(_pid: 6700, _exe: '/usr/bin/sshd')
# File lib/systemd/journal/filterable.rb, line 52
def add_filters(filters)
  filters.each do |field, value|
    Array(value).each { |v| add_filter(field, v) }
  end
end
clear_filters() click to toggle source

Remove all filters and conjunctions/disjunctions. @return [nil]

# File lib/systemd/journal/filterable.rb, line 97
def clear_filters
  Native.sd_journal_flush_matches(@ptr)
end
filter(*conditions) click to toggle source

Filter the journal at a high level. Takes any number of arguments; each argument should be a hash representing a condition to filter based on. Fields inside the hash will be ANDed together. Each hash will be ORed with the others. Fields in hashes with Arrays as values are treated as an OR statement, since otherwise they would never match. @example

j = Systemd::Journal.filter(
  {_systemd_unit: 'session-4.scope'},
  {priority: [4, 6]},
  {_exe: '/usr/bin/sshd', priority: 1}
)
# equivalent to
(_systemd_unit == 'session-4.scope') ||
(priority == 4 || priority == 6)     ||
(_exe == '/usr/bin/sshd' && priority == 1)
# File lib/systemd/journal/filterable.rb, line 20
def filter(*conditions)
  clear_filters

  last_index = conditions.length - 1

  conditions.each_with_index do |condition, index|
    add_filters(condition)
    add_disjunction unless index == last_index
  end
end