Arch Linux

superipermeganoob

Member

Registered: 2011-05-03

Posts: 26

[SOLVED][journalctl] how can filter log by MESSAGE?

hi all, i try to get a log of a specific target via journalctl without redirect the standard output, i can get what i want with this command:

$ journalctl /usr/bin/firefox  -n 20 --since today --no-pager --output=cat | grep WARN
1503031939881	addons.webextension.firefox@ghostery.com	WARN	Please specify whether you want browser_style or not in your browser_action options.
1503031939891	addons.webextension.https-everywhere-eff@eff.org	WARN	Please specify whether you want browser_style or not in your browser_action options.
1503031939897	addons.webextension.jid1-MnnxcxisBPnSXQ-eff@jetpack	WARN	Please specify whether you want browser_style or not in your browser_action options.
1503031939909	addons.webextension.izer@camelcamelcamel.com	WARN	Please specify whether you want browser_style or not in your page_action options.

but i can NOT use redirection therefore i try with the MESSAGE option but it does NOT work:

$ journalctl /usr/bin/firefox  -n 20 --since today --no-pager --output=cat MESSAGE=WARN 
$ journalctl MESSAGE=WARN
-- Logs begin at Thu 2017-08-17 11:09:55 CEST, end at Fri 2017-08-18 15:23:12 CEST. --
-- No entries --

so the question is how can i filter the message by content without redirection? thx

Last edited by superipermeganoob (2017-08-19 09:58:10)

mpan

Member

Registered: 2012-08-01

Posts: 1,207

Website

Re: [SOLVED][journalctl] how can filter log by MESSAGE?

I see no reason to not use the redirection. Seems like XYproblem to me.

However, there is no need to redirection in the first place, because journalctl can handle log level filtering by itself, which should be more efficient and cleaner than using grep for the task: -p warning..warning.

---

Sometimes I seem a bit harsh — don’t get offended too easily!

superipermeganoob

Member

Registered: 2011-05-03

Posts: 26

Re: [SOLVED][journalctl] how can filter log by MESSAGE?

because journalctl can handle log level filtering by itself, which should be more efficient and cleaner than using grep for the task: -p warning..warning.

i no need to filter by log level, but i need to filter by a specific string into a message content; the WARN example above is just one example, it could be another word. I can not use redirection because i call this command into this function [1], the | (pipe) Is not recognized and the redirection is not executed.
from what I understand [2] I can do this using the MESSAGE=<value to search> param but I can not get it running.
Is there a way to filter the contents of messages?

[1] https://developer.gnome.org/glib/stable … spawn-sync
[2] https://www.freedesktop.org/software/sy … ields.html

mpan

Member

Registered: 2012-08-01

Posts: 1,207

Website

Re: [SOLVED][journalctl] how can filter log by MESSAGE?

I don’t really see what’s the problem with redirection. Please post an actual example showing the problem¹.
____
¹ Exactly the problem and nothing more (if you post more than the minimal example showing the problem, I consider it to be the end of this topic).

---

Sometimes I seem a bit harsh — don’t get offended too easily!

loqs

Member

Registered: 2014-03-06

Posts: 17,362

Re: [SOLVED][journalctl] how can filter log by MESSAGE?

If you can not get journalctl to perform the filter then the problem would be if the executable called by g-spawn-async was /usr/bin/journalctl not /usr/bin/sh etc.
Calling a shell does have security implications but it does allow piping.  Without using the shell you would need to perform the filter internally or store journalctl's output then feed that to grep.
Edit:
grammar missing the
Edit2:
MESSAGE must be an exact match

$ journalctl -b -1 --output cat MESSAGE='WARNING: t+5800.07518s: Requesting system shutdown...'
WARNING: t+5800.07518s: Requesting system shutdown...

Last edited by loqs (2017-08-18 17:03:03)

superipermeganoob

Member

Registered: 2011-05-03

Posts: 26

Re: [SOLVED][journalctl] how can filter log by MESSAGE?

...MESSAGE must be an exact match

$ journalctl -b -1 --output cat MESSAGE='WARNING: t+5800.07518s: Requesting system shutdown...'
WARNING: t+5800.07518s: Requesting system shutdown...

ok, I now understand why it did not work, journalctl wants the exact string of the message; however I would have expected the possibility of searching part of the messages, i think it is a big limit for this tool..
To solve, I'll call a shell before the rest of the command, aware of security issues. thx