Reference Guide

Table Of Contents
System Journal Fields
Information in the system journal are stored in fields. When you run the svc_journalctl, you can choose to display information
from these fields or filter the output based on the information in these fields. This appendix describes the fields available for use
in the journal:
Topics:
Field descriptions
Field descriptions
The core logging framework relies on the systemd journal services provided by the underlying CoreOS operating system. In
addition to the default fields available with systemd journal in CoreOS, there are custom fields available for use with the cluster.
The following table lists the descriptions of all the fields available for use.
NOTE: For more information on the default fields, refer to https://www.freedesktop.org/software/systemd/man/
systemd.journal-fields.html#.
Table 1. Journal field descriptions
Type Name Description
Default __CURSOR Unique identifier that describes the position of the entry in the
journal.
Default __MONOTONIC_TIMESTAMP The monotonic clock timestamp indicating the time elapsed
between a certain event and the time when the entry in the
journal occurred.
Default __REALTIME_TIMESTAMP The wall clock timestamp indicating the point in time when the
entry was logged in the journal.
Default _AUDIT_LOGINUID, _AUDIT_SESSION The session and login UID of the process from where the
journal entry originates from.
Default _BOOT_ID The kernel boot ID of the boot in which the message was
generated.
Default _CAP_EFFECTIVE The effective capabilities of the process from where the
journal entry originates from.
Default _CMDLINE The command line of the process the journal entry originates
from
Default _COMM The name of the process the journal entry originates from.
Default _EXE The executable path of the process the journal entry
originates from.
Default _GID The group ID of the process the journal entry originates from.
Default _HOSTNAME The name of the originating host.
Default _KERNEL_DEVICE The name of the kernel device.
Default _KERNEL_SUBSYSTEM The name of the kernel subsystem.
Default _LINE_BREAK Indicates that the log message in the standard output/error
stream was not terminated with a normal newline character.
A
90 System Journal Fields