systemd-Journal by file (#16038)

* query journal file by file: 17% faster

* maintain a registry of journal files in memory and support multiple journal directories; offer sources of journal directories

* fixes

* overloaded libc fstat64() call to speed up libsystemd

* do not just copy unset values, there is a flag that tracks them

* optimize facets_row_finished()

* use container name in ND_JOURNAL_PROCESS

* fix compatibility with versions of libsystemd without sd_journal_open_files_fd()

* added more statistics about the time spent per journal file

* optimize facets_row_finished()

* optimize facets_rows_begin()

* tuning

* progress reporting

* fix journal seek to precisely match log timestamps

* support remote sources and namespaces

* jf_is_mine() as function

* fixes

* fixes 2

* fixes 3

* added debug

* fixed log

* added source for fqs

* fix all source names

* fix jf_is_mine() to return a value

* add rows_useful to journal files

* sorted list of all sources

* make hostname visible by default

* rename sources

* increase number of columns

* updated apps_groups.conf

* support view only transformations

* add support for slicing

* add support for older versions of systemd

* cleanup

* added ordering of key values

* convert remote IPs to hostnames

* fix for hostname resolution

* standardize the source name length

* added versions

* added sources pills and info

* fix plural

* better formatting for durations

* support dynamic unset value

* fix sorting

* errno to still show numeric values

* maintain a used hashes registry

* fixed severity

* updated function help message with all current parameters accepted

* remove internal error

* always return null as empty values in data

* add default sd_journal_open flags

* validate anchor

* fix compiler warning

* calculate journal vs realtime delta per journal file

* up to 2 minutes journal vs realtime delta

* more detailed message

* do not log zero anchor

* fixed message

* fix seek to db

* request details and dump of all journal files in response

* sort files before processing them

* do not sort if fewer than 2 files

* documentation

* added documentation about performance

* added field transformations documentation and annotated _CAP_EFFECTIVE

* updated docs

* updated docs

* annotated SOURCE_REALTIME_TIMESTAMP

* updated docs

* workaround for old systems

* updated docs

* updated docs

* updated docs

* updated docs

* more fields to show by default

* filter data-only query by libsystemd on slice mode

* better tail

* restore operation of full queries

* updated docs

* updated docs

* added smart field _BOOT_ID to automatically extract the timestamp of the first message of this boot_id

* do not seek to anchor on full queries

* added tail and delta

* alphabetical sort on calculated columns

* simplify sorting of facet values

* fix sorting of transformed values

* simplify code

* numeric values for capabilities that do not exist in old systems

* do not log if directories do not exist or are not directories

1 files changed, 10 insertions, 0 deletions

diff --git a/configure.ac b/configure.ac
index f75dfa2ac9..5db1b9f21c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1141,6 +1141,16 @@ fi
 AC_MSG_RESULT([${enable_plugin_systemd_journal}])
 AM_CONDITIONAL([ENABLE_PLUGIN_SYSTEMD_JOURNAL], [test "${enable_plugin_systemd_journal}" = "yes"])
 
+AC_CHECK_LIB([systemd], [sd_journal_open_files_fd], [have_sd_journal_open_files_fd=yes], [have_sd_journal_open_files_fd=no])
+if test "${have_sd_journal_open_files_fd}" = "yes"; then
+    AC_DEFINE([HAVE_SD_JOURNAL_OPEN_FILES_FD], [1], [sd_journal_open_files_fd usability])
+fi
+
+AC_CHECK_LIB([systemd], [sd_journal_restart_fields], [have_sd_journal_restart_fields=yes], [have_sd_journal_restart_fields=no])
+if test "${have_sd_journal_restart_fields}" = "yes"; then
+    AC_DEFINE([HAVE_SD_JOURNAL_RESTART_FIELDS], [1], [sd_journal_restart_fields usability])
+fi
+
 AC_MSG_NOTICE([OPTIONAL_SYSTEMD_LIBS is set to: ${OPTIONAL_SYSTEMD_LIBS}])
 
 if test "${enable_plugin_systemd_journal}" = "yes"; then