tp: Parse JournaldEventPacket into unified LogTable (2/3)#5797
Open
staticfloat wants to merge 2 commits into
Open
tp: Parse JournaldEventPacket into unified LogTable (2/3)#5797staticfloat wants to merge 2 commits into
staticfloat wants to merge 2 commits into
Conversation
Author
|
Note that because |
staticfloat
force-pushed
the
sf/journald-part-2
branch
2 times, most recently
from
ce13c00 to
fc0360f
Compare
staticfloat
force-pushed
the
sf/journald-part-2
branch
from
fc0360f to
5bc3ed8
Compare
Author
|
Note: after rebasing my branch, Despite my best efforts to clean everything (including nuking the entire |
Member
|
#5852 will fix. |
staticfloat
force-pushed
the
sf/journald-part-2
branch
from
5bc3ed8 to
30f18b3
Compare
Add a new `linux.journald` data source to `traced_probes` that reads log
entries from the systemd journal via `libsystemd`. The library is loaded
at runtime via dlopen("libsystemd.so.0") so there is no compile-time
dependency on libsystemd.
New protos:
- `JournaldConfig` in `protos/perfetto/config/linux/journald_config.proto`
- `JournaldEventPacket` in `protos/perfetto/trace/linux/journald_event.proto`
The data source opens the journal with sd_journal_open(), and emits one
JournaldEventPacket per entry containing: timestamp, pid, priority,
tag, message, uid, comm, systemd_unit, hostname and transport.
Refactor `AndroidLogTable` into a unified `LogTable` (`log_tables.py`, exposed as `__intrinsic_logs`) that stores log entries from all sources. A new log_source STRING column identifies the origin: 'android' or 'journald'. `LogTable` is moved out of `android_tables.py` into its own `log_tables.py` since it is no longer Android-specific. New linux_probes_parser.cc parses `JournaldEventPacket` and inserts into `LogTable` with log_source='journald'. Journald-specific metadata (uid, comm, systemd_unit, hostname, transport) is stored via `ArgsTracker`. Three SQL views are provided in the prelude: - logs: all entries from all sources - android_logs: convenience alias for log_source='android' entries - journald_logs: journald entries with metadata columns via extract_arg() Diff tests updated and a new Linux diff test suite covers journald parsing.
staticfloat
force-pushed
the
sf/journald-part-2
branch
from
30f18b3 to
a7787d8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refactor AndroidLogTable into a unified LogTable (log_tables.py,
exposed as __intrinsic_logs) that stores log entries from all sources.
A new log_source STRING column identifies the origin: 'android' or
'journald'. LogTable is moved out of android_tables.py into its own
log_tables.py since it is no longer Android-specific.
New parser parses
JournaldEventPacketand inserts into LogTable with log_source='journald'. Journald-specificmetadata (uid, comm, systemd_unit, hostname, transport) is stored via ArgsTracker.
Three SQL views are provided in the prelude:
Diff tests updated and a new Linux diff test suite covers journald parsing.
This is part 2 of a split-up version of #5331 and will close #3288.
This PR was co-written by AI; while I iterated on it until the look and feel felt correct, there may be context or use cases that I am unaware of. I am open to all review comments, and will do my best to address them.