On Fri, 06.03.15 21:28, Chris Morgan (chmor...@gmail.com) wrote: > http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html > is pretty clear that the matches are in the form of 'FIELD=value' but > it doesn't mention the why. > > What if I've written a field like "FIELD", can I then match on it as > "FIELD"?
Hmm, not sure I understand what you mean? The journal stores key/value pairs, on display and when parsing we denote them in the form of an uppercase fied name, followed by a "=", followed by any kind of data. Hence, just "FIELD" is not something the journald would or could store. If you try to pass this to journald for it to write, it would drop this, because it's malformed and not a key/value pair. > I presume that sd_journal_add_match is doing an identical value match > that would preclude searching for "FIELD=value" using just "FIELD"? The matches check fields against values. That's all, really. Lennart -- Lennart Poettering, Red Hat _______________________________________________ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel
