Section: systemd.journal-fields (7)
Entries in the journal resemble an environment block in their syntax but with fields that can include binary data. Primarily, fields are formatted UTF-8 text strings, and binary formatting is used only where formatting as UTF-8 text strings makes little sense. New fields may freely be defined by applications, but a few fields have special meaning. All fields with special meanings are optional. In some cases, fields may appear more than once per entry.
User fields are fields that are directly passed from clients and stored in the journal.
CODE_FILE=, CODE_LINE=, CODE_FUNC=
SYSLOG_FACILITY=, SYSLOG_IDENTIFIER=, SYSLOG_PID=
Fields prefixed with an underscore are trusted fields, i.e. fields that are implicitly added by the journal and cannot be altered by client code.
_PID=, _UID=, _GID=
_COMM=, _EXE=, _CMDLINE=
_SYSTEMD_CGROUP=, _SYSTEMD_SESSION=, _SYSTEMD_UNIT=, _SYSTEMD_USER_UNIT=, _SYSTEMD_OWNER_UID=, _SYSTEMD_SLICE=
Kernel fields are fields that are used by messages originating in the kernel and stored in the journal.
Fields in this section are used by programs to specify that they are logging on behalf of another program or unit.
Fields used by the systemd-coredump coredump kernel helper:
Priviledged programs (currently UID 0) may attach OBJECT_PID= to a message. This will instruct systemd-journald to attach additional fields on behalf of the caller:
OBJECT_UID=, OBJECT_GID=, OBJECT_COMM=, OBJECT_EXE=, OBJECT_CMDLINE=, OBJECT_AUDIT_SESSION=, OBJECT_AUDIT_LOGINUID=, OBJECT_SYSTEMD_CGROUP=, OBJECT_SYSTEMD_SESSION=, OBJECT_SYSTEMD_OWNER_UID=, OBJECT_SYSTEMD_UNIT=, OBJECT_SYSTEMD_USER_UNIT=
During serialization into external formats, such as the m[blue]Journal Export Formatm or the m[blue]Journal JSON Formatm, the addresses of journal entries are serialized into fields prefixed with double underscores. Note that these are not proper fields when stored in the journal but for addressing metadata of entries. They cannot be written as part of structured log entries via calls such as sd_journal_send?(3). They may also not be used as matches for sd_journal_add_match?(3)
Tutoriais de Tecnologia Web