From: invalid@invalid.invalid   
      
   "Carlos E.R."  writes:   
   > On 2026-01-20 09:37, Richard Kettlewell wrote:   
   >> "Carlos E.R."  writes:   
   >>> On 2026-01-20 00:05, Richard Kettlewell wrote:   
   >>>> Not 100% clear what you’re asking but wouldn’t journalctl --unit=   
   >>>> with the unit(s) you care about be sufficient?   
   >>>   
   >>> No. I have to provide all units for a report. I remove those that are   
   >>> private or irrelevant, like news.   
   >> Right, so all units except the ones you don’t care about. Same thing,   
   >> just phrased differently.   
   >   
   > Using units is impossible.   
   >   
   > cer@Telcontar:~> journalctl --field=_SYSTEMD_UNIT | wc -l   
   > 5433   
   > cer@Telcontar:~>   
   >   
   > Imagine the command line listing all those five thousand units.   
      
   I don’t have any trouble imagining it and nor does journalctl, which   
   empirically accepts command lines with 5000 -u options without   
   complaint. So I don’t see any justification for calling it impossible.   
      
   > We tried several concoctions, and the command that worked best was this:   
   >   
   > journalctl --boot=-2   
   > --facility=kern,user,daemon,auth,syslog,lpr,uucp,cron,authpriv   
   ftp,12,13,14,15,local0,local1,local2,local3,local4,local5,local6,local7   
   >> journal_purged   
   >   
   > Not units, but facilities. Problem is, there is no command to say "all   
   > except...", instead you have to explicitly list all of them except   
   > those you do not want to include.   
      
   The lack of “all except” is unfortunate, agreed.   
      
   The sd_journal_... API looks fairly simple, you could probably write   
   your own program to filter entries in whatever way you like in just a   
   few lines.   
      
   > And then there is another problem, that some entries do not have a   
   > facility assigned, it got lost somewhere. They do have a facility when   
   > seen on syslog. It is a systemd bug.   
      
   Syslog facilities are an optional backward compatibility feature in   
   journald. Lots of messages won’t have one. That’s not a bug, that’s just   
   a difference between the syslog and journal data models.   
      
   If you forward all messages to a syslogd then I assume it’ll look like   
   they’ve gained a facility even if they didn’t have one originally,   
   because syslogd’s data model makes the facility non-optional.   
      
   --   
   https://www.greenend.org.uk/rjk/   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)