HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. |  |
NAME |SYNOPSIS |DESCRIPTION |RETURN VALUE |NOTES |EXAMPLES |HISTORY |SEE ALSO |COLOPHON | |
SD_JOURNAL_NEXT(3) sd_journal_nextSD_JOURNAL_NEXT(3)sd_journal_next, sd_journal_previous, sd_journal_step_one, sd_journal_next_skip, sd_journal_previous_skip, SD_JOURNAL_FOREACH, SD_JOURNAL_FOREACH_BACKWARDS - Advance or set back the read pointer in the journal
#include <systemd/sd-journal.h>int sd_journal_next(sd_journal *j);int sd_journal_previous(sd_journal *j);int sd_journal_step_one(sd_journal *j, intadvanced);int sd_journal_next_skip(sd_journal *j, uint64_tskip);int sd_journal_previous_skip(sd_journal *j, uint64_tskip);SD_JOURNAL_FOREACH(sd_journal *j);SD_JOURNAL_FOREACH_BACKWARDS(sd_journal *j);
sd_journal_next()advances the read pointer into the journal by one entry. The only argument taken is a journal context object as allocated viasd_journal_open(3). After successful invocation the entry may be read with functions such assd_journal_get_data(3). Similarly,sd_journal_previous()sets the read pointer back one entry.sd_journal_step_one()also moves the read pointer. If the current location is the head of the journal, e.g. when this is called followingsd_journal_seek_head(), then this is equivalent tosd_journal_next(), and the argumentadvanced will be ignored. Similarly, if the current location is the tail of the journal, e.g. when this is called followingsd_journal_seek_tail(), then this is equivalent tosd_journal_previous(), andadvanced will be ignored. Otherwise, this is equivalent tosd_journal_next()whenadvanced is non-zero, andsd_journal_previous()whenadvanced is zero.sd_journal_next_skip()andsd_journal_previous_skip()advance/set back the read pointer by multiple entries at once, as specified in theskip parameter. Theskip parameter must be less than or equal to 2147483647 (2³¹-1). The journal is strictly ordered by reception time, and hence advancing to the next entry guarantees that the entry then pointing to is later in time than then previous one, or has the same timestamp. Note thatsd_journal_get_data(3) and related calls will fail unlesssd_journal_next()has been invoked at least once in order to position the read pointer on a journal entry. Note that theSD_JOURNAL_FOREACH()macro may be used as a wrapper aroundsd_journal_seek_head(3) andsd_journal_next()in order to make iterating through the journal easier. See below for an example. Similarly,SD_JOURNAL_FOREACH_BACKWARDS()may be used for iterating the journal in reverse order.
The four calls return the number of entries advanced/set back on success or a negative errno-style error code. When the end or beginning of the journal is reached, a number smaller than requested is returned. More specifically, ifsd_journal_next()orsd_journal_previous()reach the end/beginning of the journal they will return 0, instead of 1 when they are successful. This should be considered an EOF marker.
All functions listed here are thread-agnostic and only a single specific thread may operate on a given object during its entire lifetime. It is safe to allocate multiple independent objects and use each from a specific thread in parallel. However, it is not safe to allocate such an object in one thread, and operate or free it from any other, even if locking is used to ensure these threads do not operate on it at the very same time. Functions described here are available as a shared library, which can be compiled against and linked to with thelibsystemd pkg-config(1) file.
Iterating through the journal: /* SPDX-License-Identifier: MIT-0 */ #include <errno.h> #include <stdio.h> #include <systemd/sd-journal.h> int main(int argc, char *argv[]) { int r; sd_journal *j; r = sd_journal_open(&j, SD_JOURNAL_LOCAL_ONLY); if (r < 0) { fprintf(stderr, "Failed to open journal: %s\n", strerror(-r)); return 1; } SD_JOURNAL_FOREACH(j) { const char *d; size_t l; r = sd_journal_get_data(j, "MESSAGE", (const void **)&d, &l); if (r < 0) { fprintf(stderr, "Failed to read message field: %s\n", strerror(-r)); continue; } printf("%.*s\n", (int) l, d); } sd_journal_close(j); return 0; }sd_journal_next(),sd_journal_previous(),sd_journal_next_skip(),sd_journal_previous_skip(),SD_JOURNAL_FOREACH(), andSD_JOURNAL_FOREACH_BACKWARDS()were added in version 187.sd_journal_step_one()was added in version 254.
systemd(1),sd-journal(3),sd_journal_open(3),sd_journal_get_data(3),sd_journal_get_realtime_usec(3),sd_journal_get_cursor(3)
This page is part of thesystemd (systemd system and service manager) project. Information about the project can be found at ⟨http://www.freedesktop.org/wiki/Software/systemd⟩. If you have a bug report for this manual page, see ⟨http://www.freedesktop.org/wiki/Software/systemd/#bugreports⟩. This page was obtained from the project's upstream Git repository ⟨https://github.com/systemd/systemd.git⟩ on 2025-08-11. (At that time, the date of the most recent commit that was found in the repository was 2025-08-11.) If you discover any rendering problems in this HTML version of the page, or you believe there is a better or more up-to-date source for the page, or you have corrections or improvements to the information in this COLOPHON (which isnot part of the original manual page), send a mail to man-pages@man7.orgsystemd 258~rc2SD_JOURNAL_NEXT(3)Pages that refer to this page:sd-journal(3), sd_journal_add_match(3), sd_journal_get_catalog(3), sd_journal_get_cursor(3), sd_journal_get_data(3), sd_journal_get_fd(3), sd_journal_get_realtime_usec(3), sd_journal_get_seqnum(3), sd_journal_open(3), sd_journal_query_unique(3), sd_journal_seek_head(3), systemd.directives(7), systemd.index(7)
HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. | |