bat for reading the systemd journal

[har7an]

Hi,

I really like bat and I think it has a lot of great features. However I often find myself reading the systemd journal via journalctl and I think it would be nice to have some highlighting for that, too. The next-best thing at the moment seems to be bat -l syslog. Now this makes reading the journal a lot nicer already, but journalctl in its default output does some special line handling depending on a lines "severity". From the man page:

When outputting to a tty, lines are colored according to priority: lines of level ERROR
and higher are colored red; lines of level NOTICE and higher are highlighted; lines of
level DEBUG are colored lighter grey; other lines are displayed normally.

This makes spotting warnings and errors very easy. I find that bat has no equivalent yet, or am I missing something? I wonder if it would be possible to implement a separate highlighting for systemd that extends syslog and imitates journalctls behavior? Maybe the lines could be printed bold, or with highlighted background?

As for how journalctl knows which lines are warnings or errors, I do not know. This seems to be a rather critical issue in implementing this. But do you think this would generally be feasible?

On a related note, maybe this then also qualifies for a shell wrapper in bat-extras, something like batjournal that overrides the systemd pager? At the moment I cannot use bat as a pager to journalctl, or at least I don't know how. This doesn't work:

$ PAGER="bat -l syslog" journalctl -b

because it falls back to using less, even if I specify the full path to bat...

[keith-hall]

special line handling depending on a lines "severity"

We had a request to highlight lines in log files differently, based on severity (identified by the line containing the text "warn" / "error" / "fatal" etc, so the solution for that could perhaps help with this feature request. See #2152

[har7an]

@keith-hall Good to know, that may be a starting point. Looking through my journal however, it recognizes lines such as this:

Jun 07 10:52:20 gnome-shell[2299]: meta_window_set_stack_position_no_sync: assertion 'window->stack_position >= 0' failed

as warnings, it recognizes certain messages from audit and highlights these in blue:

Jun 07 08:35:27 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0

and more, but none of these carry any obvious markers or keywords afaict. I'll see if I can find more information about how journalctl knows what to color.

[sedlund]

This doesn't work:

$ PAGER="bat -l syslog" journalctl -b

because it falls back to using less, even if I specify the full path to bat...

I'm guessing because you are calling journalctl with sudo.

journalctl will disallow this behavior as it would allow running arbitrary elevated commands because bat forks a process (it processes the text and forks to less). The man page details it.

You can force it to by setting SYSTEMD_PAGERSECURE=true

As noted above journalctl colors on priority:

When outputting to a tty, lines are colored according to priority: lines of level ERROR and higher are colored red; lines of level NOTICE and higher are highlighted; lines of level DEBUG are colored lighter grey; other lines are displayed normally.

This output will not be rendered correctly in bat, see:

• Issue handling text with escape sequences already embedded #2185

This can be rectified by disabling colors with SYSTEMD_COLORS=false.

To test you can try:

SYSTEMD_PAGERSECURE=true SYSTEMD_COLORS=false SYSTEMD_PAGER="$(which bat) --language syslog --plain" journalctl

• The journalctl coloring / highlighting is based on the log level priority number of the entry.
• The default output hides this.
• If you use journalctl -o json you can see the priorities 0-6 of each entry.

For bat to achieve this, it may have to take this raw json and reconstruct the log output (duplicating journalctl functionality). To that end, I think improving the coloring output to systemd is the better route.

For myself, I stuck with default systemd pager as I found the highlighting based on priority to be more useful.

[gomeology]

create a function
jctl(){
journalctl $@ | bat -l syslog -p}

[Crestanzio]

You have to set $SYSTEMD_PAGERSECURE to true and instead to $PAGER you have to set $SYSTEMD_PAGER because is overridden. Also because but is confused with $SYSTEMD_COLORS you must disable it in order to not display random ANSI code:

SYSTEMD_COLORS="false"
SYSTEMD_PAGERSECURE="true"
SYSTEMD_PAGER="bat -l syslog -p"

resources from man journalctl

$SYSTEMD_PAGER
   Pager to use when --no-pager is not given; overrides $PAGER.
   If neither $SYSTEMD_PAGER nor $PAGER are set, a set of
   well-known pager implementations are tried in turn, including
   less(1) and more(1), until one is found. If no pager
   implementation is discovered no pager is invoked. Setting
   this environment variable to an empty string or the value
   "cat" is equivalent to passing --no-pager.

   Note: if $SYSTEMD_PAGERSECURE is not set, $SYSTEMD_PAGER (as
   well as $PAGER) will be silently ignored.
   
$SYSTEMD_PAGERSECURE
   Takes a boolean argument. When true, the "secure" mode of the
   pager is enabled; if false, disabled. If $SYSTEMD_PAGERSECURE
   is not set at all, secure mode is enabled if the effective
   UID is not the same as the owner of the login session, see
   geteuid(2) and sd_pid_get_owner_uid(3). In secure mode,
   LESSSECURE=1 will be set when invoking the pager, and the
   pager shall disable commands that open or create new files or
   start new subprocesses. When $SYSTEMD_PAGERSECURE is not set
   at all, pagers which are not known to implement secure mode
   will not be used. (Currently only less(1) implements secure
   mode.)