From: robin_listas@es.invalid   
      
   On 2026-01-20 18:37, Richard Kettlewell wrote:   
   > "Carlos E.R."  writes:   
   >> On 2026-01-20 09:37, Richard Kettlewell wrote:   
   >>> "Carlos E.R."  writes:   
   >>>> On 2026-01-20 00:05, Richard Kettlewell wrote:   
   >>>>> Not 100% clear what you’re asking but wouldn’t journalctl --unit=   
   >>>>> with the unit(s) you care about be sufficient?   
   >>>>   
   >>>> No. I have to provide all units for a report. I remove those that are   
   >>>> private or irrelevant, like news.   
   >>> Right, so all units except the ones you don’t care about. Same thing,   
   >>> just phrased differently.   
   >>   
   >> Using units is impossible.   
   >>   
   >> cer@Telcontar:~> journalctl --field=_SYSTEMD_UNIT | wc -l   
   >> 5433   
   >> cer@Telcontar:~>   
   >>   
   >> Imagine the command line listing all those five thousand units.   
   >   
   > I don’t have any trouble imagining it and nor does journalctl, which   
   > empirically accepts command lines with 5000 -u options without   
   > complaint. So I don’t see any justification for calling it impossible.   
      
   That I have to find those thousand of units and type them.   
      
   >   
   >> We tried several concoctions, and the command that worked best was this:   
   >>   
   >> journalctl --boot=-2   
   >> --facility=kern,user,daemon,auth,syslog,lpr,uucp,cron,authpri   
   ,ftp,12,13,14,15,local0,local1,local2,local3,local4,local5,local6,local7   
   >>> journal_purged   
   >>   
   >> Not units, but facilities. Problem is, there is no command to say "all   
   >> except...", instead you have to explicitly list all of them except   
   >> those you do not want to include.   
   >   
   > The lack of “all except” is unfortunate, agreed.   
   >   
   > The sd_journal_... API looks fairly simple, you could probably write   
   > your own program to filter entries in whatever way you like in just a   
   > few lines.   
   >   
   >> And then there is another problem, that some entries do not have a   
   >> facility assigned, it got lost somewhere. They do have a facility when   
   >> seen on syslog. It is a systemd bug.   
   >   
   > Syslog facilities are an optional backward compatibility feature in   
   > journald. Lots of messages won’t have one. That’s not a bug, that’s   
   just   
   > a difference between the syslog and journal data models.   
   >   
   > If you forward all messages to a syslogd then I assume it’ll look like   
   > they’ve gained a facility even if they didn’t have one originally,   
   > because syslogd’s data model makes the facility non-optional.   
   >   
      
      
   --   
   Cheers, Carlos.   
   ES🇪🇸, EU🇪🇺;   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)