HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. |  |
NAME |SYNOPSIS |DESCRIPTION |RETURN VALUE |SIGNAL SAFETY |NOTES |EXAMPLES |HISTORY |SEE ALSO |COLOPHON | |
SD_JOURNAL_GET_FD(3) sd_journal_get_fdSD_JOURNAL_GET_FD(3)sd_journal_get_fd, sd_journal_get_events, sd_journal_get_timeout, sd_journal_process, sd_journal_wait, sd_journal_reliable_fd, SD_JOURNAL_NOP, SD_JOURNAL_APPEND, SD_JOURNAL_INVALIDATE - Journal change notification interface
#include <systemd/sd-journal.h>int sd_journal_get_fd(sd_journal *j);int sd_journal_get_events(sd_journal *j);int sd_journal_get_timeout(sd_journal *j, uint64_t *timeout_usec);int sd_journal_process(sd_journal *j);int sd_journal_wait(sd_journal *j, uint64_ttimeout_usec);int sd_journal_reliable_fd(sd_journal *j);
sd_journal_get_fd()returns a file descriptor that may be asynchronously polled in an external event loop and is signaled as soon as the journal changes, because new entries or files were added, rotation took place, or files have been deleted, and similar. The file descriptor is suitable for usage inpoll(2). Usesd_journal_get_events()for an events mask to watch for. The call takes one argument: the journal context object. Note that not all file systems are capable of generating the necessary events for wakeups from this file descriptor for changes to be noticed immediately. In particular network files systems do not generate suitable file change events in all cases. Cases like this can be detected withsd_journal_reliable_fd(), below.sd_journal_get_timeout()will ensure in these cases that wake-ups happen frequently enough for changes to be noticed, although with a certain latency.sd_journal_get_events()will return thepoll()mask to wait for. This function will return a combination ofPOLLINandPOLLOUTand similar to fill into the ".events" field ofstruct pollfd.sd_journal_get_timeout()will return a timeout value for usage inpoll(). This returns a value in microseconds since the epoch ofCLOCK_MONOTONICfor timing outpoll()intimeout_usec. Seeclock_gettime(2) for details aboutCLOCK_MONOTONIC. If there is no timeout to wait for, this will fill in(uint64_t) -1instead. Note thatpoll()takes a relative timeout in milliseconds rather than an absolute timeout in microseconds. To convert the absolute 'us' timeout into relative 'ms', use code like the following: uint64_t t; int msec; sd_journal_get_timeout(m, &t); if (t == (uint64_t) -1) msec = -1; else { struct timespec ts; uint64_t n; clock_gettime(CLOCK_MONOTONIC, &ts); n = (uint64_t) ts.tv_sec * 1000000 + ts.tv_nsec / 1000; msec = t > n ? (int) ((t - n + 999) / 1000) : 0; } The code above does not do any error checking for brevity's sake. The calculatedmsec integer can be passed directly aspoll()'s timeout parameter. After eachpoll()wake-upsd_journal_process()needs to be called to process events. This call will also indicate what kind of change has been detected (see below; note that spurious wake-ups are possible). A synchronous alternative for usingsd_journal_get_fd(),sd_journal_get_events(),sd_journal_get_timeout()andsd_journal_process()issd_journal_wait(). It will synchronously wait until the journal gets changed. The maximum time this call sleeps may be controlled with thetimeout_usec parameter. Pass(uint64_t) -1to wait indefinitely. Internally this call simply combinessd_journal_get_fd(),sd_journal_get_events(),sd_journal_get_timeout(),poll()andsd_journal_process()into one.sd_journal_reliable_fd()may be used to check whether the wake-up events from the file descriptor returned bysd_journal_get_fd() are known to be quickly triggered. On certain file systems where file change events from the OS are not available (such as NFS) changes need to be polled for repeatedly, and hence are detected only with a considerable latency. This call will return a positive value if the journal changes are detected quickly and zero when they need to be polled for. Note that there is usually no need to invoke this function directly assd_journal_get_timeout()will request appropriate timeouts anyway. Note that all of the above change notification interfaces do not report changes instantly. Latencies are introduced for multiple reasons: as mentioned certain storage backends require time-based polling, in other cases wake-ups are optimized by coalescing events, and the OS introduces additional IO/CPU scheduling latencies.sd_journal_get_fd()returns a valid file descriptor on success or a negative errno-style error code.sd_journal_get_events()returns a combination ofPOLLIN,POLLOUT and suchlike on success or a negative errno-style error code.sd_journal_reliable_fd()returns a positive integer if the file descriptor returned bysd_journal_get_fd()will generate wake-ups immediately for all journal changes. Returns 0 if there might be a latency involved.sd_journal_process()andsd_journal_wait()return a negative errno-style error code, or one ofSD_JOURNAL_NOP,SD_JOURNAL_APPENDorSD_JOURNAL_INVALIDATEon success: • IfSD_JOURNAL_NOPis returned, the journal did not change since the last invocation. • IfSD_JOURNAL_APPENDis returned, new entries have been appended to the end of the journal. In this case, it is sufficient to simply continue reading at the previous end location of the journal, to read the newly added entries. • IfSD_JOURNAL_INVALIDATE, journal files were added to or removed from the set of journal files watched (e.g. due to rotation or vacuuming), and thus entries might have appeared or disappeared at arbitrary places in the log stream, possibly before or after the previous end of the log stream. IfSD_JOURNAL_INVALIDATEis returned, live-view UIs that want to reflect on screen the precise state of the log data on disk should probably refresh their entire display (relative to the cursor of the log entry on the top of the screen). Programs only interested in a strictly sequential stream of log data may treatSD_JOURNAL_INVALIDATEthe same way asSD_JOURNAL_APPEND, thus ignoring any changes to the log view earlier than the old end of the log stream.
In general,sd_journal_get_fd(),sd_journal_get_events(), andsd_journal_get_timeout()arenot "async signal safe" in the meaning ofsignal-safety(7). Nevertheless, only the first call to any of those three functions performs unsafe operations, so subsequent callsare safe.sd_journal_process()andsd_journal_wait()are not safe.sd_journal_reliable_fd()is safe.
All functions listed here are thread-agnostic and only a single specific thread may operate on a given object during its entire lifetime. It is safe to allocate multiple independent objects and use each from a specific thread in parallel. However, it is not safe to allocate such an object in one thread, and operate or free it from any other, even if locking is used to ensure these threads do not operate on it at the very same time. Functions described here are available as a shared library, which can be compiled against and linked to with thelibsystemd pkg-config(1) file.
Iterating through the journal, in a live view tracking all changes: /* SPDX-License-Identifier: MIT-0 */ #include <errno.h> #include <stdio.h> #include <systemd/sd-journal.h> int main(int argc, char *argv[]) { int r; sd_journal *j; r = sd_journal_open(&j, SD_JOURNAL_LOCAL_ONLY); if (r < 0) { fprintf(stderr, "Failed to open journal: %s\n", strerror(-r)); return 1; } for (;;) { const void *d; size_t l; r = sd_journal_next(j); if (r < 0) { fprintf(stderr, "Failed to iterate to next entry: %s\n", strerror(-r)); break; } if (r == 0) { /* Reached the end, let's wait for changes, and try again */ r = sd_journal_wait(j, (uint64_t) -1); if (r < 0) { fprintf(stderr, "Failed to wait for changes: %s\n", strerror(-r)); break; } continue; } r = sd_journal_get_data(j, "MESSAGE", &d, &l); if (r < 0) { fprintf(stderr, "Failed to read message field: %s\n", strerror(-r)); continue; } printf("%.*s\n", (int) l, (const char*) d); } sd_journal_close(j); return 0; } Waiting withpoll()(this example lacks all error checking for the sake of simplicity): /* SPDX-License-Identifier: MIT-0 */ #define _GNU_SOURCE 1 #include <poll.h> #include <time.h> #include <systemd/sd-journal.h> int wait_for_changes(sd_journal *j) { uint64_t t; int msec; struct pollfd pollfd; sd_journal_get_timeout(j, &t); if (t == (uint64_t) -1) msec = -1; else { struct timespec ts; uint64_t n; clock_gettime(CLOCK_MONOTONIC, &ts); n = (uint64_t) ts.tv_sec * 1000000 + ts.tv_nsec / 1000; msec = t > n ? (int) ((t - n + 999) / 1000) : 0; } pollfd.fd = sd_journal_get_fd(j); pollfd.events = sd_journal_get_events(j); poll(&pollfd, 1, msec); return sd_journal_process(j); }sd_journal_get_fd(),sd_journal_process(), andsd_journal_wait() were added in version 187.sd_journal_reliable_fd()was added in version 196.sd_journal_get_events()andsd_journal_get_timeout()were added in version 201.
systemd(1),sd-journal(3),sd_journal_open(3),sd_journal_next(3),poll(2),clock_gettime(2)
This page is part of thesystemd (systemd system and service manager) project. Information about the project can be found at ⟨http://www.freedesktop.org/wiki/Software/systemd⟩. If you have a bug report for this manual page, see ⟨http://www.freedesktop.org/wiki/Software/systemd/#bugreports⟩. This page was obtained from the project's upstream Git repository ⟨https://github.com/systemd/systemd.git⟩ on 2025-08-11. (At that time, the date of the most recent commit that was found in the repository was 2025-08-11.) If you discover any rendering problems in this HTML version of the page, or you believe there is a better or more up-to-date source for the page, or you have corrections or improvements to the information in this COLOPHON (which isnot part of the original manual page), send a mail to man-pages@man7.orgsystemd 258~rc2SD_JOURNAL_GET_FD(3)Pages that refer to this page:sd-journal(3), systemd.directives(7), systemd.index(7)
HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. | |