Feat: New journal_header

docs/shared_parsers_catalog/journalctl.rst

@@ -0,0 +1,3 @@
+.. automodule:: insights.parsers.journalctl
+   :members:
+   :show-inheritance:

insights/parsers/journal_all.py

@@ -5,11 +5,19 @@
 
 from .. import Syslog, parser
 from insights.specs import Specs
+from insights.util import deprecated
 
 
 @parser(Specs.journal_all)
 class JournalAll(Syslog):
     """
+
+    .. warning::
+
+        This parser is deprecated, please use
+        :py:class:`insights.parsers.journalctl.JournalSinceBoot` instead.
+
+
     Read the ``/sos_commands/logs/journalctl_--no-pager`` file.  Uses the
     ``Syslog`` class parser functionality - see the base class for more details.
 
@@ -41,4 +49,13 @@ class JournalAll(Syslog):
         >>> msgs.daemon_start # Token set if matching lines present in logs
         True
     """
+
+    def __init__(self, context):
+        deprecated(
+            JournalAll,
+            "Please use the :class:`insights.parsers.auditctl.AuditdStatus` instead.",
+            "3.1.25"
+        )
+        super(JournalAll, self).__init__(context)
+
     pass

insights/parsers/journal_since_boot.py

@@ -5,11 +5,19 @@
 
 from .. import Syslog, parser
 from insights.specs import Specs
+from insights.util import deprecated
 
 
 @parser(Specs.journal_since_boot)
 class JournalSinceBoot(Syslog):
     """
+
+    .. warning::
+
+        This parser is deprecated, please use
+        :py:class:`insights.parsers.journalctl.JournalSinceBoot` instead.
+
+
     Read the ``/sos_commands/logs/journalctl_--no-pager_--boot`` file.  Uses
     the ``Syslog`` class parser functionality - see the base class for more
     details.
@@ -42,4 +50,13 @@ class JournalSinceBoot(Syslog):
         >>> msgs.daemon_start # Token set if matching lines present in logs
         True
     """
+
+    def __init__(self, context):
+        deprecated(
+            JournalSinceBoot,
+            "Please use the :class:`insights.parsers.auditctl.AuditdStatus` instead.",
+            "3.1.25"
+        )
+        super(JournalSinceBoot, self).__init__(context)
+
     pass

insights/parsers/journalctl.py

@@ -0,0 +1,154 @@
+"""
+JournalCtl - command ``journalctl xxx``
+=======================================
+
+This module contains the following parsers:
+
+JournalAll - file ``/sos_commands/logs/journalctl_--no-pager``
+--------------------------------------------------------------
+JournalctlHeader - command ``/usr/bin/journalctl --header``
+-----------------------------------------------------------
+JournalSinceBoot - file ``/sos_commands/logs/journalctl_--no-pager_--boot``
+---------------------------------------------------------------------------
+
+"""
+
+
+from insights.core.plugins import parser
+from insights.core import CommandParser, LegacyItemAccess
+from insights.parsers import SkipException, get_active_lines
+from insights.specs import Specs
+from .. import Syslog
+
+
+@parser(Specs.journal_all)
+class JournalAll(Syslog):
+    """
+    Read the ``/sos_commands/logs/journalctl_--no-pager`` file.  Uses the
+    ``Syslog`` class parser functionality - see the base class for more details.
+
+    Sample log lines::
+
+        -- Logs begin at Wed 2017-02-08 15:18:00 CET, end at Tue 2017-09-19 09:25:27 CEST. --
+        May 18 15:13:34 lxc-rhel68-sat56 jabberd/sm[11057]: session started: [email protected]/superclient
+        May 18 15:13:36 lxc-rhel68-sat56 wrapper[11375]: --> Wrapper Started as Daemon
+        May 18 15:13:36 lxc-rhel68-sat56 wrapper[11375]: Launching a JVM...
+        May 18 15:24:28 lxc-rhel68-sat56 yum[11597]: Installed: lynx-2.8.6-27.el6.x86_64
+        May 18 15:36:19 lxc-rhel68-sat56 yum[11954]: Updated: sos-3.2-40.el6.noarch
+
+    .. note::
+        Because journal timestamps by default have no year,
+        the year of the logs will be inferred from the year in your timestamp.
+        This will also work around December/January crossovers.
+
+    Examples:
+        >>> type(JournalAll)
+        <class 'insights.parsers.journalctl.JournalAll'>
+        >>> len(JournalAll.lines)
+        10
+        >>> bona_list = JournalAll.get('(root) LIST (root)')
+        >>> bona_list[0].get('message')
+        '(root) LIST (root)'
+    """
+    pass
+
+
+@parser(Specs.journalctl_header)
+class JournalctlHeader(LegacyItemAccess, CommandParser):
+    """
+    This command shows internal header information of the journal fields accessed.
+
+    Sample Output::
+
+        File Path: /run/log/journal/6bdaf92aa0754b53acbb1dbff7127e2b/system.journal
+        File ID: b1390ea69aa747e9ac5c597835c3c562
+        Machine ID: 6bdaf92aa0754b53acbb1dbff7127e2b
+        Boot ID: 082ada53f8184c4896c73101ad793eb5
+        Sequential Number ID: 435b0e30f47a46d8a2a2f9a42eae0aaf
+        State: ONLINE
+        Compatible Flags:
+        Incompatible Flags: COMPRESSED-LZ4
+        Header size: 240
+        Arena size: 8388368
+        Data Hash Table Size: 19904
+        Field Hash Table Size: 333
+        Rotate Suggested: no
+        Head Sequential Number: 74388 (12294)
+        Tail Sequential Number: 81647 (13eef)
+        Head Realtime Timestamp: Mon 2022-08-15 12:01:10 CST (5e63fae9e6e58)
+        Tail Realtime Timestamp: Wed 2022-08-17 18:38:48 CST (5e66d7852bb3e)
+        Tail Monotonic Timestamp: 1month 2w 3d 14h 19min 3.733s (3c647d7ce0f)
+        Objects: 19073
+        Entry Objects: 7260
+        Data Objects: 9297
+        Data Hash Table Fill: 46.7%
+        Field Objects: 52
+        Field Hash Table Fill: 15.6%
+        Tag Objects: 0
+        Entry Array Objects: 2462
+        Disk usage: 8.0M
+
+    Examples:
+        >>> type(journalctl_header)
+        <class 'insights.parsers.journalctl.JournalctlHeader'>
+        >>> journalctl_header.data[0]['File Path']
+        '/run/log/journal/6bdaf92aa0754b53acbb1dbff7127e2b/system.journal'
+        >>> journalctl_header.data[0]['File ID']
+        'b1390ea69aa747e9ac5c597835c3c562'
+
+    Attributes:
+        data (list): List of Dictionary, which containing each of the key:value pairs from the command output.
+
+    Raises:
+        SkipException: raised if data is invalid.
+    """
+
+    def parse_content(self, content):
+        body = {}
+        self.data = []
+
+        for line in get_active_lines(content):
+            if ':' in line:
+                key, value = [item.strip() for item in line.split(":", 1)]
+                if key in body:
+                    self.data.append(body)
+                    body = {}
+                body[key] = value
+
+        if body:
+            self.data.append(body)
+        else:
+            raise SkipException("Unrecognised Output")
+
+
+@parser(Specs.journal_since_boot)
+class JournalSinceBoot(Syslog):
+    """
+    Read the ``/sos_commands/logs/journalctl_--no-pager_--boot`` file.  Uses
+    the ``Syslog`` class parser functionality - see the base class for more
+    details.
+
+    Sample log lines::
+
+        -- Logs begin at Wed 2017-02-08 15:18:00 CET, end at Tue 2017-09-19 09:25:27 CEST. --
+        May 18 15:13:34 lxc-rhel68-sat56 jabberd/sm[11057]: session started: [email protected]/superclient
+        May 18 15:13:36 lxc-rhel68-sat56 wrapper[11375]: --> Wrapper Started as Daemon
+        May 18 15:13:36 lxc-rhel68-sat56 wrapper[11375]: Launching a JVM...
+        May 18 15:24:28 lxc-rhel68-sat56 yum[11597]: Installed: lynx-2.8.6-27.el6.x86_64
+        May 18 15:36:19 lxc-rhel68-sat56 yum[11954]: Updated: sos-3.2-40.el6.noarch
+
+    Note:
+        Because journal timestamps by default have no year,
+        the year of the logs will be inferred from the year in your timestamp.
+        This will also work around December/January crossovers.
+
+    Examples:
+        >>> type(JournalSinceBoot)
+        <class 'insights.parsers.journalctl.JournalSinceBoot'>
+        >>> len(JournalSinceBoot.lines)
+        10
+        >>> bona_list = JournalSinceBoot.get('(root) LIST (root)')
+        >>> bona_list[0].get('message')
+        '(root) LIST (root)'
+    """
+    pass

insights/specs/__init__.py

@@ -285,6 +285,7 @@ class Specs(SpecSet):
     jboss_version = RegistryPoint(multi_output=True)
     journal_all = RegistryPoint(filterable=True)
     journal_since_boot = RegistryPoint(filterable=True)
+    journalctl_header = RegistryPoint(filterable=True)
     katello_service_status = RegistryPoint(filterable=True)
     kdump_conf = RegistryPoint()
     kerberos_kdc_log = RegistryPoint(filterable=True)

insights/specs/default.py

@@ -292,6 +292,7 @@ class DefaultSpecs(Specs):
     ipv6_neigh = simple_command("/sbin/ip -6 neighbor show nud all")
     ironic_inspector_log = first_file(["/var/log/containers/ironic-inspector/ironic-inspector.log", "/var/log/ironic-inspector/ironic-inspector.log"])
     iscsiadm_m_session = simple_command("/usr/sbin/iscsiadm -m session")
+    journalctl_header = simple_command("/usr/bin/journalctl --header")
     kdump_conf = simple_file("/etc/kdump.conf")
     kernel_config = glob_file("/boot/config-*")
     kernel_crash_kexec_post_notifiers = simple_file("/sys/module/kernel/parameters/crash_kexec_post_notifiers")

insights/specs/insights_archive.py

@@ -106,6 +106,7 @@ class InsightsArchiveSpecs(Specs):
     ipv4_neigh = simple_file("insights_commands/ip_-4_neighbor_show_nud_all")
     ipv6_neigh = simple_file("insights_commands/ip_-6_neighbor_show_nud_all")
     iscsiadm_m_session = simple_file("insights_commands/iscsiadm_-m_session")
+    journalctl_header = simple_file("insights_commands/journalctl_--header")
     keystone_crontab = first_file(["insights_commands/crontab_-l_-u_keystone", "var/spool/cron/keystone"])
     kpatch_list = simple_file("insights_commands/kpatch_list")
     localtime = simple_file("insights_commands/file_-L_.etc.localtime")