sebastianmeisel / journalctl-mode

Major mode to view journalctl's output in Emacs

journalctl-mode.el

Introduction

This Emacs major mode is designed for viewing the output from systemd’s journalctl within Emacs. It provides a convenient way to interact with journalctl logs, including features like fontification, chunked loading for performance, and custom keyword highlighting.

Installation

To install, place journalctl-mode.el in your load-path and add the following to your .emacs file:

(require 'journalctl-mode)

Alternatively, you can install journalctl-mode using the use-package macro with Quelpa for automatic installation from the GitHub repository:

(use-package journalctl-mode
  :ensure t)

Define a global key

It might be a good idea to define a global key to journalctl with:

(global-set-key (kbd "C-c t") 'journalctl)

or with use-package:

(use-package journalctl-mode
  :ensure t
  :bind (("C-c t" . journalctl)))

Features

• Fontification: Customize the appearance of log levels with faces.
• Chunked Loading: Load journalctl output in manageable chunks for better performance.
• Keyword Highlighting: Define custom keywords for error, warning, and other log levels.
• Follow Mode: Simulate tail -f functionality to keep up with new log entries.

Usage

Once installed, journalctl-mode can be invoked with M-x journalctl. The mode provides a transient interface for journalctl command-line options, allowing for dynamic and flexible log viewing.

Customization

Customize the mode to your liking by setting the following variables:

• journalctl-chunk-size: Number of lines per chunk (default 250).
• journalctl-error-keywords: List of keywords to highlight as errors.
• journalctl-warn-keywords: List of keywords to highlight as warnings.
• journalctl-starting-keywords: Keywords for starting processes.
• journalctl-finished-keywords: Keywords for finished processes.
• journalctl-follow-freq: Frequency for updating in follow mode.
• journalctl-follow-lines: Number of lines to show in follow mode.
• journalctl-default-options: List of default options for journalctl on start.

Key Bindings

Key	Action
n	Load next chunk of journalctl output
p	Load previous chunk of journalctl output
C-v	Scroll up in the buffer
M-v	Scroll down in the buffer
q	Quit journalctl mode

Other Packages

There is another package journalctl (rather than journalctl-mode) by James Ferguson that fetches and interleaves JSON data using multiple simultaneous asynchronous journalctl queries, while mine offers a UI for query-building and chunked synchronous data loading.

License

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.

Support

For support, feedback, or to contribute to the project, please visit the homepage at https://github.com/SebastianMeisel/journalctl-mode.

Acknowledgements

Thanks to all contributors and users for their support and feedback which continue to improve this mode.

journalctl-mode's Issues

Show failed units when listing units

First of all, thank you very much for creating this package, I've been wanting something like this for a long time.

The reason that I most often have to look at my systemd units is that one of them has failed (most often because I am experimenting with a new unit). Unfortunately, failed units are not listed on my system when I use journalctl-unit or journalctl-user-unit. I believe this is because list-units by default outputs an initial column with a ● symbol for failed units, and your parsing removes these lines:

journalctl-mode/journalctl-mode.el

Line 284 in c5bca1a

(shell-command-to-string "systemctl list-units --all --quiet | awk '{print $1}' | head -n -7 | sed -ne '2,$p'| sed -e '/●/d'") "[\n]" t " ") nil t))))))

It might have been a deliberate decision to exclude failed units from the list, but I'd ask you to consider changing this as failing units are most often the ones that are interesting to examine.

There is an option for turning off the ● symbol in list-units's output (see man systemctl(1)):

       --plain
           When used with list-dependencies, list-units or list-machines, the
           output is printed as a list instead of a tree, and the bullet
           circles are omitted.

The following change seems to do the trick for me:

modified   journalctl-mode.el
@@ -275,13 +275,17 @@ If BOOT is provided it is the number of the boot-log to be shown."
 		     (shell-command-to-string "journalctl --list-boots") "[\n]" t " ")) nil t))))))
     (journalctl (concat "-b '" boot-log "'"))))
 
+(defvar journalctl-list-units-format
+ "systemctl list-units --all --quiet --plain %s | awk '{print $1}' | head -n -7 | sed -ne '2,$p'"
+  "Format string for listing units, accepting a single substitution for additional options.")
+
 ;;;###autoload
 (defun journalctl-unit (&optional unit)
   "Select and show journal for UNIT."
   (interactive)
   (let ((unit (or unit (car (split-string
 				 (completing-read "unit: " (split-string
-		     (shell-command-to-string "systemctl list-units --all --quiet | awk '{print $1}' | head -n -7 | sed -ne '2,$p'| sed -e '/●/d'") "[\n]" t " ") nil t))))))
+		     (shell-command-to-string (format journalctl-list-units-format "")) "[\n]" t " ") nil t))))))
     (journalctl (concat "--unit='" unit "'"))))
 
 ;;;###autoload
@@ -290,7 +294,7 @@ If BOOT is provided it is the number of the boot-log to be shown."
   (interactive)
   (let ((unit (or unit (car (split-string
 				 (completing-read "unit: " (split-string
-		     (shell-command-to-string "systemctl list-units --all --user --quiet | awk '{print $1}' | head -n -7 | sed -ne '2,$p'| sed -e '/●/d'") "[\n]" t " ") nil t))))))
+		     (shell-command-to-string (format journalctl-list-units-format "--user")) "[\n]" t " ") nil t))))))
     (journalctl (concat "--user-unit='" unit "'"))))
 

*journalctl* buffer is not read-only

journalctl buffer should either be read-only, or not bind single letters to commands (q, n, p, etc). It's too easy to mistake n for C-n and so on.

read-only is better in this case. I'd lookup examples of other modes that do this kind of log inspection.

Thanks a lot, a very useful mode otherwise.

Slow "journalctl | wc -l"

Hi, I was trying out this neat package and noticed that M-x journalctl froze my emacs until I aborted with C-g. After a bit of investigating I noticed that during M-x journalctl it spawned a journalctl | wc -l command that was using up one cpu core and blocking emacs. I guess (journalctl--run '("")) ends up invoking that and takes forever to finish. I managed to work around this by vacuuming my logs from about 1 GB to 100 MB, but even then it takes a moment to count all the lines. Perhaps this behaviour could be fine tuned a bit so that it doesn't try to consume the whole log contents and instead defaults to something like journalctl --boot?

describe-key on various journalctl-mode keys shows bytecodes

as an example, C-h c +s shows '+ s runs the command ... binary chars

journalctl-user-unit broken

The function journalctl-user-unit does not work. The Function adds the option "--user-unit". The Function journalctl-parse-options does check if journalctl-list-of-options contains "user-unit", but it only contains "userunit" so the option is removed.

--grep=... fails in journalctl-mode?

at least running journalctl -g from the shell gives different results than from within jurnalctl-mode

Add priority function

Add function to add “--priority” option and map appropriate keys.

Submit to melpa

Feature request: allow the user to edit the `systemd.journal-fields`

From man journalctl, DESCRIPTION section:

If one or more match arguments are passed, the output is filtered accordingly. A match is in the format "FIELD=VALUE", e.g. "_SYSTEMD_UNIT=httpd.service", referring to the components of a structured journal entry. See systemd.journal-fields(7) for a list of well-known fields.

N.b. even if journalctl-mode evolves such that it implements all systemd.journal-fields via transient infixes, systemd may evolve to provide more systemd.journal-fields; in that case this option would be useful in the timespan where journactl-mode hasn't caught up. Because at no point in the future can it be guaranteed that this situation will stop happening, this feature would never cease to be potentially useful.

Please update license version in header, conflicts with LICENSE file

Please update the permission statement. I recommend you use the standard permission statement:

;; This file is free software: you can redistribute it and/or modify
;; it under the terms of the GNU General Public License as published
;; by the Free Software Foundation, either version 3 of the License,
;; or (at your option) any later version.
;;
;; This file is distributed in the hope that it will be useful,
;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;; GNU General Public License for more details.
;;
;; You should have received a copy of the GNU General Public License
;; along with this file.  If not, see <https://www.gnu.org/licenses/>.

Additionally it would be nice if you could add a license header, for easier parsing:

;; SPDX-License-Identifier: GPL-3.0-or-later

Thanks!

This will allow us to continue to distribute this package on Melpa.

/cc @riscy

List all units

There might be an interest to look at loaded but inactive units.

Is it possible to put --reverse flag by default?

I use journalctl-mode to read failed units and I always use reverse flag to start from latest events. Is it possible to activate this flag always, without manual interaction?

[transient] First chunk has only one line if choose unit filter

version: Emacs 29.1 with pgtk support

Every time I filter by specific unit, system or user only one line is rendering in *journalctl* buffer.
Without filtering it contains 250 lines

My setup

(use-package journalctl-mode
  :vc (:fetcher github :repo SebastianMeisel/journalctl-mode :rev "transient")
  :bind (
  ("C-c t" . journalctl)
  :map evil-normal-state-map
  ("gtt" . journalctl)
  )
)

journalctl-unit

Add function to choose a systemd unit and apply the value to “--unit” parameter.

Bind journalctl-transient to a key

As a keyboard only user, it's useful to bind journalctl-transient to a key -- perhaps recommend that in the commentary section?

Reverse boot-list

It is more convenient to start with last boot.

please fix autoload

journalctl-mode needs to generate an autoload for command journalctl; at present only generates one for journalctl-mode. Nice package by the way, makes journalctl comprehensible!

Add funtions for "--since" and "--until"

Add functions journalctl-add-since and journalctl-add-until.

journalctl transient under Emacs 30

Note: when running under emacs 30 (git @Head) journalctl-transient doesn't get defined unless you explicitly load the source journactl.el after reloading transient -- suspect incorrect macro compilation

Autoload for documented function

Hello,

Could you add autoloads for the function that are mentionned in the README:

• journalctl
• journalctl-boot
• journalctl-unit
• journalctl-user-unit

Without it I have to manually load the could before I can use those. Thank you!

journalctl-user-unit

It would also be nice to have a journalctl-unit equivalent for user units (unfortunately, there are separate --unit and --user-unit switches, so it's a bit messy.

Support to edit current parameters.

Define function to edit the value of journalctl-current-params.

tail/follow option

Thanks for the awesome package!

Is there a way to follow updates to a unit's journal entries, like I would get if I ran the command journalctl -u unit -f?