[log-annotations] add :annotate command

pull/1179/head
Tim Stack 10 months ago
parent 1b31d7401a
commit a16a8cf3fa

@ -30,6 +30,12 @@ Features:
the logs for a container (e.g. `docker://my-container`) or
files within a container (e.g.
`docker://my-serv/var/log/dpkg.log`).
* Added an `:annotate` command that can trigger a call-out
to a script to analyze a log message and generate an
annotation that is attached to the message. The script
is executed asynchronously, so it will not block input
and the result is saved in the session. Annotations are
defined in the `/log/annotations` configuration property.
* Added the SQLite JSON functions to the online help.
* Added `config get` and `config blame` management CLI
commands to get the current configuration and the file

@ -749,7 +749,7 @@
"title": "/log/watch-expressions",
"type": "object",
"patternProperties": {
"([\\w\\-]+)": {
"([\\w\\.\\-]+)": {
"description": "A log message watch expression",
"title": "/log/watch-expressions/<watch_name>",
"type": "object",
@ -769,6 +769,37 @@
}
},
"additionalProperties": false
},
"annotations": {
"title": "/log/annotations",
"type": "object",
"patternProperties": {
"([\\w\\.\\-]+)": {
"title": "/log/annotations/<annotation_name>",
"type": "object",
"properties": {
"description": {
"title": "/log/annotations/<annotation_name>/description",
"description": "A description of this annotation",
"type": "string"
},
"condition": {
"title": "/log/annotations/<annotation_name>/condition",
"description": "The SQLite expression to execute for a log message that determines whether or not this annotation is applicable. The expression is evaluated the same way as a filter expression",
"type": "string",
"minLength": 1
},
"handler": {
"title": "/log/annotations/<annotation_name>/handler",
"description": "The script to execute to generate the annotation content. A JSON object with the log message content will be sent to the script on the standard input",
"type": "string",
"minLength": 1
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false

@ -262,10 +262,44 @@ From there, you can create a SQLite trigger on the :code:`lnav_events` table
that will examine the event contents and perform an action. See the
:ref:`Events` section for more information on handling events.
Annotations (v0.12.0+)
^^^^^^^^^^^^^^^^^^^^^^
Annotations are content generated by a script for a given log message and
displayed along with the message, like comments and tags. Since the script
is run asynchronously, it can do complex analysis without delaying loading
or interrupting the viewing experience. An annotation is defined by a
condition and a handler in the **lnav** configuration. The condition is
tested against a log message to determine if the annotation is applicable.
If it is, the handler script will be executed for that log message when
the user runs the :ref:`:annotation<annotation>` command.
Conditions are SQLite expressions like the ones passed to
:ref:`:filter-expr<filter_expr>` where the expression is appended to
:code:`SELECT 1 WHERE`. The expression can use bound variables that
correspond to the columns that would be in the format table and are
prefixed by a colon (:code:`:`). For example, the standard
:code:`log_opid` table column can be access by using :code:`:log_opid`.
.. note:: The expression is executed with bound variables because it
can be applied to log messages from multiple formats. Writing an
expression that could handle different formats would be more
challenging. In this approach, variables for log message fields
that are not part of a format will evaluate to :code:`NULL`.
Handlers are executable script files that should be co-located with
the configuration file that defined the annotation. The handler will
be executed and a JSON object with log message data fed in on the
standard input. The handler should then generate the annotation
content on the standard output. The output is treated as Markdown,
so the content can be styled as desired.
Reference
^^^^^^^^^
.. jsonschema:: ../schemas/config-v1.schema.json#/properties/log/properties/watch-expressions/patternProperties/([\w\-]+)
.. jsonschema:: ../schemas/config-v1.schema.json#/properties/log/properties/watch-expressions/patternProperties/([\w\.\-]+)
.. jsonschema:: ../schemas/config-v1.schema.json#/properties/log/properties/annotations/patternProperties/([\w\.\-]+)
.. _tuning:

@ -105,6 +105,8 @@ The following columns are builtin and included in a :code:`SELECT *`:
an :code:`UPDATE` or the :ref:`:comment<comment>` command.
:log_tags: A JSON list of tags for the message. This column can be changed
by an :code:`UPDATE` or the :ref:`:tag<tag>` command.
:log_annotations: A JSON object of annotations for this message.
This column is populated by the :ref:`:annotate<annotate>` command.
:log_filters: A JSON list of filter IDs that matched this message
The following columns are builtin and are hidden, so they will *not* be

@ -208,7 +208,7 @@ add_custom_command(
DEPENDS bin2c ${BUILTIN_LNAV_SCRIPTS})
list(APPEND GEN_SRCS builtin-scripts.h builtin-scripts.cc)
set(BUILTIN_SH_SCRIPTS scripts/dump-pid.sh scripts/pcap_log-converter.sh)
set(BUILTIN_SH_SCRIPTS scripts/com.vmware.btresolver.py scripts/dump-pid.sh scripts/pcap_log-converter.sh)
set(BUILTIN_SH_SCRIPT_PATHS ${BUILTIN_SH_SCRIPTS})
@ -378,6 +378,7 @@ add_library(
lnav_commands.cc
lnav_config.cc
lnav_util.cc
log.annotate.cc
log.watch.cc
log_accel.cc
log_actions.cc
@ -489,6 +490,8 @@ add_library(
lnav_config.hh
lnav_config_fwd.hh
lnav_util.hh
log.annotate.hh
log.annotate.cfg.hh
log.watch.hh
log_actions.hh
log_data_helper.hh

@ -237,6 +237,8 @@ noinst_HEADERS = \
lnav_config.hh \
lnav_config_fwd.hh \
lnav_util.hh \
log.annotate.hh \
log.annotate.cfg.hh \
log.watch.hh \
log_accel.hh \
log_actions.hh \
@ -419,6 +421,7 @@ libdiag_a_SOURCES = \
lnav_commands.cc \
lnav_config.cc \
lnav_util.cc \
log.annotate.cc \
log.watch.cc \
log_accel.cc \
log_actions.cc \

@ -427,6 +427,24 @@ public:
return *this;
}
template<typename S>
attr_line_t& insert(size_t index,
const std::pair<S, string_attr_pair>& value)
{
size_t start_len = this->al_string.length();
this->insert(index, std::move(value.first));
line_range lr{
(int) index,
(int) (index + (this->al_string.length() - start_len)),
};
this->al_attrs.emplace_back(lr, value.second);
return *this;
}
template<typename... Args>
attr_line_t& add_header(Args... args)
{

@ -141,6 +141,25 @@ auto_fd::operator=(int fd)
return *this;
}
Result<void, std::string>
auto_fd::write_fully(string_fragment sf)
{
while (!sf.empty()) {
auto rc = write(this->af_fd, sf.data(), sf.length());
if (rc < 0) {
return Err(
fmt::format(FMT_STRING("failed to write {} bytes to FD {}"),
sf.length(),
this->af_fd));
}
sf = sf.substr(rc);
}
return Ok();
}
Result<auto_pipe, std::string>
auto_pipe::for_child_fd(int child_fd)
{

@ -36,6 +36,7 @@
#include <fcntl.h>
#include "base/intern_string.hh"
#include "base/result.h"
/**
@ -158,6 +159,8 @@ public:
*/
void reset(int fd = -1);
Result<void, std::string> write_fully(string_fragment sf);
void close_on_exec() const;
void non_blocking() const;
@ -170,6 +173,25 @@ class auto_pipe {
public:
static Result<auto_pipe, std::string> for_child_fd(int child_fd);
template<typename... ARGS>
static Result<std::array<auto_pipe, sizeof...(ARGS)>, std::string>
for_child_fds(ARGS... args)
{
std::array<auto_pipe, sizeof...(ARGS)> retval;
size_t index = 0;
for (const auto child_fd : {args...}) {
auto open_res = for_child_fd(child_fd);
if (open_res.isErr()) {
return Err(open_res.unwrapErr());
}
retval[index++] = open_res.unwrap();
}
return Ok(std::move(retval));
}
explicit auto_pipe(int child_fd = -1, int child_flags = O_RDONLY);
int open();

@ -32,10 +32,16 @@
#include "bookmarks.hh"
#include "base/itertools.hh"
#include "bookmarks.json.hh"
#include "config.h"
std::unordered_set<std::string> bookmark_metadata::KNOWN_TAGS;
typed_json_path_container<logmsg_annotations> logmsg_annotations_handlers = {
yajlpp::pattern_property_handler("(?<annotation_id>.*)")
.for_field(&logmsg_annotations::la_pairs),
};
void
bookmark_metadata::add_tag(const std::string& tag)
{
@ -61,7 +67,7 @@ bool
bookmark_metadata::empty() const
{
return this->bm_name.empty() && this->bm_comment.empty()
&& this->bm_tags.empty();
&& this->bm_tags.empty() && this->bm_annotations.la_pairs.empty();
}
void
@ -69,6 +75,7 @@ bookmark_metadata::clear()
{
this->bm_comment.clear();
this->bm_tags.clear();
this->bm_annotations.la_pairs.clear();
}
nonstd::optional<bookmark_type_t*>

@ -34,17 +34,22 @@
#include <algorithm>
#include <map>
#include <unordered_set>
#include <string>
#include <unordered_set>
#include <vector>
#include "base/lnav_log.hh"
struct logmsg_annotations {
std::map<std::string, std::string> la_pairs;
};
struct bookmark_metadata {
static std::unordered_set<std::string> KNOWN_TAGS;
std::string bm_name;
std::string bm_comment;
logmsg_annotations bm_annotations;
std::vector<std::string> bm_tags;
void add_tag(const std::string& tag);

@ -0,0 +1,39 @@
/**
* Copyright (c) 2023, Timothy Stack
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of Timothy Stack nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ''AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef lnav_bookmarks_json_hh
#define lnav_bookmarks_json_hh
#include "bookmarks.hh"
#include "yajlpp/yajlpp_def.hh"
extern typed_json_path_container<logmsg_annotations>
logmsg_annotations_handlers;
#endif

@ -33,6 +33,7 @@
#include "base/humanize.time.hh"
#include "base/snippet_highlighters.hh"
#include "config.h"
#include "log.annotate.hh"
#include "log_format_ext.hh"
#include "log_vtab_impl.hh"
#include "md2attr_line.hh"
@ -41,10 +42,14 @@
#include "vtab_module.hh"
#include "vtab_module_json.hh"
using namespace md4cpp::literals;
using namespace lnav::roles::literals;
json_string extract(const char* str);
void
field_overlay_source::build_field_lines(const listview_curses& lv)
field_overlay_source::build_field_lines(const listview_curses& lv,
vis_line_t row)
{
auto& lss = this->fos_lss;
auto& vc = view_colors::singleton();
@ -57,7 +62,7 @@ field_overlay_source::build_field_lines(const listview_curses& lv)
return;
}
content_line_t cl = lss.at(lv.get_selection());
content_line_t cl = lss.at(row);
std::shared_ptr<logfile> file = lss.find(cl);
auto ll = file->begin() + cl;
auto format = file->get_format();
@ -72,13 +77,13 @@ field_overlay_source::build_field_lines(const listview_curses& lv)
display = display || this->fos_contexts.top().c_show;
}
this->build_meta_line(lv, this->fos_lines, lv.get_top());
this->build_meta_line(lv, this->fos_lines, row);
if (!display) {
return;
}
if (!this->fos_log_helper.parse_line(lv.get_selection())) {
if (!this->fos_log_helper.parse_line(row)) {
return;
}
@ -450,6 +455,23 @@ field_overlay_source::build_meta_line(const listview_curses& lv,
{
auto line_meta_opt = this->fos_lss.find_bookmark_metadata(row);
auto file_and_line = this->fos_lss.find_line_with_file(row);
if (file_and_line && !file_and_line->second->is_continued()) {
auto applicable_anno = lnav::log::annotate::applicable(row);
if (!applicable_anno.empty()
&& (!line_meta_opt
|| line_meta_opt.value()->bm_annotations.la_pairs.empty()))
{
auto anno_msg = attr_line_t(" ")
.append(":memo:"_emoji)
.append(" Annotations available, use ")
.append(":annotate"_quoted_code)
.append(" to apply them to this line");
dst.emplace_back(anno_msg);
}
}
if (!line_meta_opt) {
return;
}
@ -527,6 +549,61 @@ field_overlay_source::build_meta_line(const listview_curses& lv,
}
dst.emplace_back(al);
}
if (!line_meta.bm_annotations.la_pairs.empty()) {
for (const auto& anno_pair : line_meta.bm_annotations.la_pairs) {
attr_line_t al;
md2attr_line mdal;
dst.push_back(
attr_line_t()
.append(filename_width, ' ')
.appendf(FMT_STRING(" \u251c {}:"), anno_pair.first)
.with_attr_for_all(VC_ROLE.value(role_t::VCR_COMMENT)));
auto parse_res = md4cpp::parse(anno_pair.second, mdal);
if (parse_res.isOk()) {
al.append(parse_res.unwrap());
} else {
log_error("%d: cannot convert annotation to markdown: %s",
(int) row,
parse_res.unwrapErr().c_str());
al.append(anno_pair.second);
}
auto anno_lines = al.rtrim().split_lines();
if (anno_lines.back().empty()) {
anno_lines.pop_back();
}
for (size_t lpc = 0; lpc < anno_lines.size(); lpc++) {
auto& anno_line = anno_lines[lpc];
if (lpc == 0 && anno_line.empty()) {
continue;
}
// anno_line.with_attr_for_all(VC_ROLE.value(role_t::VCR_COMMENT));
anno_line.insert(0,
lpc == anno_lines.size() - 1
? " \u2570 "_comment
: " \u2502 "_comment);
anno_line.insert(0, filename_width, ' ');
if (tc != nullptr) {
auto hl = tc->get_highlights();
auto hl_iter
= hl.find({highlight_source_t::PREVIEW, "search"});
if (hl_iter != hl.end()) {
hl_iter->second.annotate(anno_line, filename_width);
}
}
dst.emplace_back(anno_line);
}
}
}
if (dst.size() > 30) {
dst.resize(30);
}
}
void
@ -550,7 +627,9 @@ field_overlay_source::list_value_for_overlay(const listview_curses& lv,
attr_line_t& value_out)
{
if (y == 0) {
this->build_field_lines(lv);
this->fos_meta_lines.clear();
this->fos_meta_lines_row = -1_vl;
this->build_field_lines(lv, row);
return false;
}

@ -48,13 +48,20 @@ public:
void add_key_line_attrs(int key_size, bool last_line = false);
void reset() override
{
this->fos_lines.clear();
this->fos_meta_lines.clear();
this->fos_meta_lines_row = -1_vl;
}
bool list_value_for_overlay(const listview_curses& lv,
int y,
int bottom,
vis_line_t row,
attr_line_t& value_out) override;
void build_field_lines(const listview_curses& lv);
void build_field_lines(const listview_curses& lv, vis_line_t row);
void build_meta_line(const listview_curses& lv,
std::vector<attr_line_t>& dst,
vis_line_t row);

@ -206,35 +206,24 @@ sql_shell_exec(const char* cmd,
options = parse_res.unwrap();
}
auto in_pipe_res = auto_pipe::for_child_fd(STDIN_FILENO);
if (in_pipe_res.isErr()) {
throw lnav::console::user_message::error("cannot open input pipe")
.with_reason(in_pipe_res.unwrapErr());
auto child_fds_res
= auto_pipe::for_child_fds(STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO);
if (child_fds_res.isErr()) {
throw lnav::console::user_message::error("cannot open child pipes")
.with_reason(child_fds_res.unwrapErr());
}
auto in_pipe = in_pipe_res.unwrap();
auto out_pipe_res = auto_pipe::for_child_fd(STDOUT_FILENO);
if (out_pipe_res.isErr()) {
throw lnav::console::user_message::error("cannot open output pipe")
.with_reason(out_pipe_res.unwrapErr());
}
auto out_pipe = out_pipe_res.unwrap();
auto err_pipe_res = auto_pipe::for_child_fd(STDERR_FILENO);
if (err_pipe_res.isErr()) {
throw lnav::console::user_message::error("cannot open error pipe")
.with_reason(err_pipe_res.unwrapErr());
}
auto err_pipe = err_pipe_res.unwrap();
auto child_pid_res = lnav::pid::from_fork();
if (child_pid_res.isErr()) {
throw lnav::console::user_message::error("cannot fork()")
.with_reason(child_pid_res.unwrapErr());
}
auto child_fds = child_fds_res.unwrap();
auto child_pid = child_pid_res.unwrap();
in_pipe.after_fork(child_pid.in());
out_pipe.after_fork(child_pid.in());
err_pipe.after_fork(child_pid.in());
for (auto& child_fd : child_fds) {
child_fd.after_fork(child_pid.in());
}
if (child_pid.in_child()) {
const char* args[] = {
@ -256,64 +245,56 @@ sql_shell_exec(const char* cmd,
_exit(EXIT_FAILURE);
}
auto out_reader = std::async(std::launch::async, [&out_pipe]() {
auto buffer = auto_buffer::alloc(4096);
while (true) {
if (buffer.available() < 4096) {
buffer.expand_by(4096);
auto out_reader = std::async(
std::launch::async, [out_fd = std::move(child_fds[1].read_end())]() {
auto buffer = auto_buffer::alloc(4096);
while (true) {
if (buffer.available() < 4096) {
buffer.expand_by(4096);
}
auto rc
= read(out_fd, buffer.next_available(), buffer.available());
if (rc < 0) {
break;
}
if (rc == 0) {
break;
}
buffer.resize_by(rc);
}
auto rc = read(out_pipe.read_end(),
buffer.next_available(),
buffer.available());
if (rc < 0) {
break;
}
if (rc == 0) {
break;
return buffer;
});
auto err_reader = std::async(
std::launch::async, [err_fd = std::move(child_fds[2].read_end())]() {
auto buffer = auto_buffer::alloc(4096);
while (true) {
if (buffer.available() < 4096) {
buffer.expand_by(4096);
}
auto rc
= read(err_fd, buffer.next_available(), buffer.available());
if (rc < 0) {
break;
}
if (rc == 0) {
break;
}
buffer.resize_by(rc);
}
buffer.resize_by(rc);
}
return buffer;
});
auto err_reader = std::async(std::launch::async, [&err_pipe]() {
auto buffer = auto_buffer::alloc(4096);
while (true) {
if (buffer.available() < 4096) {
buffer.expand_by(4096);
}
auto rc = read(err_pipe.read_end(),
buffer.next_available(),
buffer.available());
if (rc < 0) {
break;
}
if (rc == 0) {
break;
}
buffer.resize_by(rc);
}
return buffer;
});
return buffer;
});
if (input) {
auto sf = input.value();
while (!sf.empty()) {
auto rc = write(in_pipe.write_end(), sf.data(), sf.length());
if (rc < 0) {
break;
}
sf = sf.substr(rc);
}
in_pipe.close();
child_fds[0].write_end().write_fully(input.value());
}
child_fds[0].close();
auto retval = blob_auto_buffer{out_reader.get()};

@ -49,6 +49,19 @@
----
.. _annotate:
:annotate
^^^^^^^^^
Analyze the focused log message and attach annotations
**See Also**
:ref:`comment`, :ref:`tag`
----
.. _append_to:
:append-to *path*
@ -96,7 +109,7 @@
Clear the comment attached to the top log line
**See Also**
:ref:`comment`, :ref:`tag`
:ref:`annotate`, :ref:`comment`, :ref:`tag`
----
@ -190,7 +203,7 @@
:comment This is where it all went wrong
**See Also**
:ref:`clear_comment`, :ref:`tag`
:ref:`annotate`, :ref:`clear_comment`, :ref:`tag`
----
@ -370,7 +383,7 @@
:delete-tags #BUG123 #needs-review
**See Also**
:ref:`comment`, :ref:`tag`
:ref:`annotate`, :ref:`comment`, :ref:`tag`
----
@ -1362,7 +1375,7 @@
:tag #BUG123 #needs-review
**See Also**
:ref:`comment`, :ref:`delete_tags`, :ref:`untag`
:ref:`annotate`, :ref:`comment`, :ref:`delete_tags`, :ref:`untag`
----
@ -1440,7 +1453,7 @@
:untag #BUG123 #needs-review
**See Also**
:ref:`comment`, :ref:`tag`
:ref:`annotate`, :ref:`comment`, :ref:`tag`
----

@ -105,6 +105,8 @@ class list_overlay_source {
public:
virtual ~list_overlay_source() = default;
virtual void reset() {}
virtual bool list_value_for_overlay(const listview_curses& lv,
int y,
int bottom,

@ -116,6 +116,7 @@
#include "log_vtab_impl.hh"
#include "logfile.hh"
#include "logfile_sub_source.hh"
#include "md4cpp.hh"
#include "piper.looper.hh"
#include "readline_curses.hh"
#include "readline_highlighters.hh"
@ -170,6 +171,7 @@
using namespace std::literals::chrono_literals;
using namespace lnav::roles::literals;
using namespace md4cpp::literals;
static std::vector<std::string> DEFAULT_FILES;
static auto intern_lifetime = intern_string::get_table_lifetime();
@ -707,28 +709,40 @@ make it easier to navigate through files quickly.
.append("\n ")
.append("\u2022"_list_glyph)
.append(" Format files are read from:")
.append("\n \U0001F4C2 ")
.append("\n ")
.append(":open_file_folder:"_emoji)
.append(" ")
.append(lnav::roles::file("/etc/lnav"))
.append("\n \U0001F4C2 ")
.append("\n ")
.append(":open_file_folder:"_emoji)
.append(" ")
.append(lnav::roles::file(SYSCONFDIR "/lnav"))
.append("\n ")
.append("\u2022"_list_glyph)
.append(" Configuration, session, and format files are stored in:\n")
.append(" \U0001F4C2 ")
.append(" ")
.append(":open_file_folder:"_emoji)
.append(" ")
.append(lnav::roles::file(lnav::paths::dotlnav().string()))
.append("\n\n ")
.append("\u2022"_list_glyph)
.append(" Local copies of remote files, files extracted from\n")
.append(" archives, execution output, and so on are stored in:\n")
.append(" \U0001F4C2 ")
.append(" ")
.append(":open_file_folder:"_emoji)
.append(" ")
.append(lnav::roles::file(lnav::paths::workdir().string()))
.append("\n\n")
.append("Documentation"_h1)
.append(": https://docs.lnav.org\n")
.append("Contact"_h1)
.append("\n")
.append(" \U0001F4AC https://github.com/tstack/lnav/discussions\n")
.appendf(FMT_STRING(" \U0001F4EB {}\n"), PACKAGE_BUGREPORT)
.append(" ")
.append(":speech_balloon:"_emoji)
.append(" https://github.com/tstack/lnav/discussions\n")
.append(" ")
.append(":mailbox:"_emoji)
.appendf(FMT_STRING(" {}\n"), PACKAGE_BUGREPORT)
.append("Version"_h1)
.appendf(FMT_STRING(": {}"), VCS_PACKAGE_STRING);

@ -62,6 +62,7 @@
#include "lnav_commands.hh"
#include "lnav_config.hh"
#include "lnav_util.hh"
#include "log.annotate.hh"
#include "log_data_helper.hh"
#include "log_data_table.hh"
#include "log_search_table.hh"
@ -599,6 +600,40 @@ com_relative_goto(exec_context& ec,
return Ok(retval);
}
static Result<std::string, lnav::console::user_message>
com_annotate(exec_context& ec,
std::string cmdline,
std::vector<std::string>& args)
{
std::string retval;
if (args.empty()) {
} else if (!ec.ec_dry_run) {
auto* tc = *lnav_data.ld_view_stack.top();
auto* lss = dynamic_cast<logfile_sub_source*>(tc->get_sub_source());
if (lss != nullptr) {
auto sel = tc->get_selection();
auto applicable_annos = lnav::log::annotate::applicable(sel);
if (applicable_annos.empty()) {
return ec.make_error(
"no annotations available for this log message");
}
auto apply_res = lnav::log::annotate::apply(sel, applicable_annos);
if (apply_res.isErr()) {
return Err(apply_res.unwrapErr());
}
} else {
return ec.make_error(
":annotate is only supported for the LOG view");
}
}
return Ok(retval);
}
static Result<std::string, lnav::console::user_message>
com_mark(exec_context& ec, std::string cmdline, std::vector<std::string>& args)
{
@ -1419,24 +1454,42 @@ com_save_to(exec_context& ec,
tc->set_word_wrap(wrapped);
} else {
auto* los = tc->get_overlay_source();
auto* fos = dynamic_cast<field_overlay_source*>(los);
std::vector<attr_line_t> rows(1);
attr_line_t ov_al;
size_t count = 0;
if (fos != nullptr) {
fos->fos_contexts.push(field_overlay_source::context{
"",
false,
false,
});
}
los->reset();
for (auto iter = all_user_marks.begin(); iter != all_user_marks.end();
iter++, count++)
{
if (ec.ec_dry_run && count > 10) {
break;
}
auto y = 0_vl;
while (los != nullptr
&& los->list_value_for_overlay(
*tc, y, tc->get_inner_height(), *iter, ov_al))
{
write_line_to(outfile, ov_al);
++y;
}
tc->listview_value_for_rows(*tc, *iter, rows);
++y;
if (anonymize) {
rows[0].al_attrs.clear();
rows[0].al_string = ta.next(rows[0].al_string);
}
write_line_to(outfile, rows[0]);
auto y = 1_vl;
while (los != nullptr
&& los->list_value_for_overlay(
*tc, y, tc->get_inner_height(), *iter, ov_al))
@ -1447,6 +1500,10 @@ com_save_to(exec_context& ec,
line_count += 1;
}
if (fos != nullptr) {
fos->fos_contexts.pop();
}
}
fflush(outfile);
@ -4214,8 +4271,15 @@ com_sh(exec_context& ec, std::string cmdline, std::vector<std::string>& args)
log_info("executing: %s", carg.c_str());
auto out_pipe_res = auto_pipe::for_child_fd(STDOUT_FILENO);
auto err_pipe_res = auto_pipe::for_child_fd(STDERR_FILENO);
auto child_fds_res
= auto_pipe::for_child_fds(STDOUT_FILENO, STDERR_FILENO);
if (child_fds_res.isErr()) {
auto um = lnav::console::user_message::error(
"unable to create child pipes")
.with_reason(child_fds_res.unwrapErr());
ec.add_error_context(um);
return Err(um);
}
auto child_res = lnav::pid::from_fork();
if (child_res.isErr()) {
auto um
@ -4225,12 +4289,11 @@ com_sh(exec_context& ec, std::string cmdline, std::vector<std::string>& args)
return Err(um);
}
auto out_pipe = out_pipe_res.unwrap();
auto err_pipe = err_pipe_res.unwrap();
auto child_fds = child_fds_res.unwrap();
auto child = child_res.unwrap();
out_pipe.after_fork(child.in());
err_pipe.after_fork(child.in());
for (auto& child_fd : child_fds) {
child_fd.after_fork(child.in());
}
if (child.in_child()) {
auto dev_null = open("/dev/null", O_RDONLY | O_CLOEXEC);
@ -4271,8 +4334,8 @@ com_sh(exec_context& ec, std::string cmdline, std::vector<std::string>& args)
.fo_name;
auto create_piper_res
= lnav::piper::create_looper(display_name,
std::move(out_pipe.read_end()),
std::move(err_pipe.read_end()));
std::move(child_fds[0].read_end()),
std::move(child_fds[1].read_end()));
if (create_piper_res.isErr()) {
auto um
@ -5179,6 +5242,17 @@ readline_context::command_t STD_COMMANDS[] = {
{"To move 10 percent back in the view", "-10%"},
})
.with_tags({"navigation"})},
{
"annotate",
com_annotate,
help_text(":annotate")
.with_summary(
"Analyze the focused log message and attach annotations")
.with_tags({"metadata"}),
},
{"mark",
com_mark,

@ -102,6 +102,9 @@ static auto uh = injector::bind<lnav::url_handler::config>::to_instance(
static auto lsc = injector::bind<logfile_sub_source_ns::config>::to_instance(
+[]() { return &lnav_config.lc_log_source; });
static auto annoc = injector::bind<lnav::log::annotate::config>::to_instance(
+[]() { return &lnav_config.lc_log_annotations; });
static auto tssc = injector::bind<top_status_source_cfg>::to_instance(
+[]() { return &lnav_config.lc_top_status_cfg; });
@ -1238,7 +1241,7 @@ static const struct json_path_container log_source_watch_expr_handlers = {
};
static const struct json_path_container log_source_watch_handlers = {
yajlpp::pattern_property_handler("(?<watch_name>[\\w\\-]+)")
yajlpp::pattern_property_handler("(?<watch_name>[\\w\\.\\-]+)")
.with_synopsis("<name>")
.with_description("A log message watch expression")
.with_obj_provider<logfile_sub_source_ns::watch_expression,
@ -1262,10 +1265,51 @@ static const struct json_path_container log_source_watch_handlers = {
.with_children(log_source_watch_expr_handlers),
};
static const struct json_path_container annotation_handlers = {
yajlpp::property_handler("description")
.with_synopsis("<text>")
.with_description("A description of this annotation")
.for_field(&lnav::log::annotate::annotation_def::a_description),
yajlpp::property_handler("condition")
.with_synopsis("<SQL-expression>")
.with_description(
"The SQLite expression to execute for a log message that "
"determines whether or not this annotation is applicable. The "
"expression is evaluated the same way as a filter expression")
.with_min_length(1)
.for_field(&lnav::log::annotate::annotation_def::a_condition),
yajlpp::property_handler("handler")
.with_synopsis("<script>")
.with_description("The script to execute to generate the annotation "
"content. A JSON object with the log message content "
"will be sent to the script on the standard input")
.with_min_length(1)
.for_field(&lnav::log::annotate::annotation_def::a_handler),
};
static const struct json_path_container annotations_handlers = {
yajlpp::pattern_property_handler(R"((?<annotation_name>[\w\.\-]+))")
.with_obj_provider<lnav::log::annotate::annotation_def, _lnav_config>(
[](const yajlpp_provider_context& ypc, _lnav_config* root) {
auto* retval = &(root->lc_log_annotations
.a_definitions[ypc.get_substr_i(0)]);
return retval;
})
.with_path_provider<_lnav_config>(
[](struct _lnav_config* cfg, std::vector<std::string>& paths_out) {
for (const auto& iter : cfg->lc_log_annotations.a_definitions) {
paths_out.emplace_back(iter.first.to_string());
}
})
.with_children(annotation_handlers),
};
static const struct json_path_container log_source_handlers = {
yajlpp::property_handler("watch-expressions")
.with_description("Log message watch expressions")
.with_children(log_source_watch_handlers),
yajlpp::property_handler("annotations").with_children(annotations_handlers),
};
static const struct json_path_container url_scheme_handlers = {

@ -45,6 +45,7 @@
#include "file_vtab.cfg.hh"
#include "ghc/filesystem.hpp"
#include "lnav_config_fwd.hh"
#include "log.annotate.cfg.hh"
#include "log_level.hh"
#include "logfile.cfg.hh"
#include "logfile_sub_source.cfg.hh"
@ -117,6 +118,7 @@ struct _lnav_config {
sysclip::config lc_sysclip;
lnav::url_handler::config lc_url_handlers;
logfile_sub_source_ns::config lc_log_source;
lnav::log::annotate::config lc_log_annotations;
};
extern struct _lnav_config lnav_config;

@ -0,0 +1,406 @@
/**
* Copyright (c) 2023, Timothy Stack
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of Timothy Stack nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ''AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <future>
#include "log.annotate.hh"
#include "base/auto_fd.hh"
#include "base/auto_pid.hh"
#include "base/fs_util.hh"
#include "base/paths.hh"
#include "line_buffer.hh"
#include "lnav.hh"
#include "log_data_helper.hh"
#include "md4cpp.hh"
#include "readline_highlighters.hh"
#include "yajlpp/yajlpp.hh"
namespace lnav {
namespace log {
namespace annotate {
struct compiled_cond_expr {
auto_mem<sqlite3_stmt> cce_stmt{sqlite3_finalize};
bool cce_enabled{true};
};
struct expressions : public lnav_config_listener {
void reload_config(error_reporter& reporter) override
{
auto& lnav_db = injector::get<auto_sqlite3&>();
if (lnav_db.in() == nullptr) {
log_warning("db not initialized yet!");
return;
}
const auto& cfg = injector::get<const config&>();
this->e_cond_exprs.clear();
for (const auto& pair : cfg.a_definitions) {
if (pair.second.a_handler.pp_value.empty()) {
auto um
= lnav::console::user_message::error(
"no handler specified for annotation")
.with_reason("Every annotation requires a handler");
reporter(&pair.second.a_handler, um);
continue;
}
auto stmt_str = fmt::format(FMT_STRING("SELECT 1 WHERE {}"),
pair.second.a_condition);
compiled_cond_expr cce;
log_info("preparing annotation condition expression: %s",
stmt_str.c_str());
auto retcode = sqlite3_prepare_v2(lnav_db,
stmt_str.c_str(),
stmt_str.size(),
cce.cce_stmt.out(),
nullptr);
if (retcode != SQLITE_OK) {
auto sql_al = attr_line_t(pair.second.a_condition)
.with_attr_for_all(SA_PREFORMATTED.value())
.with_attr_for_all(
VC_ROLE.value(role_t::VCR_QUOTED_CODE));
readline_sqlite_highlighter(sql_al, -1);
intern_string_t cond_expr_path = intern_string::lookup(
fmt::format(FMT_STRING("/log/annotations/{}/condition"),
pair.first));
auto snippet = lnav::console::snippet::from(
source_location(cond_expr_path), sql_al);
auto um = lnav::console::user_message::error(
"SQL expression is invalid")
.with_reason(sqlite3_errmsg(lnav_db))
.with_snippet(snippet);
reporter(&pair.second.a_condition, um);
continue;
}
this->e_cond_exprs.emplace(pair.first, std::move(cce));
}
}
void unload_config() override { this->e_cond_exprs.clear(); }
std::map<intern_string_t, compiled_cond_expr> e_cond_exprs;
};
static expressions exprs;
std::vector<intern_string_t>
applicable(vis_line_t vl)
{
std::vector<intern_string_t> retval;
auto& lss = lnav_data.ld_log_source;
auto cl = lss.at(vl);
auto ld = lss.find_data(cl);
log_data_helper ldh(lss);
ldh.parse_line(vl, true);
for (auto& expr : exprs.e_cond_exprs) {
if (!expr.second.cce_enabled) {
continue;
}
auto eval_res
= lss.eval_sql_filter(expr.second.cce_stmt.in(), ld, ldh.ldh_line);
if (eval_res.isErr()) {
log_error("eval failed: %s",
eval_res.unwrapErr().to_attr_line().get_string().c_str());
expr.second.cce_enabled = false;
} else {
if (eval_res.unwrap()) {
retval.emplace_back(expr.first);
}
}
}
return retval;
}
Result<void, lnav::console::user_message>
apply(vis_line_t vl, std::vector<intern_string_t> annos)
{
const auto& cfg = injector::get<const config&>();
auto& lss = lnav_data.ld_log_source;
auto cl = lss.at(vl);
auto ld = lss.find_data(cl);
auto lf = (*ld)->get_file();
logmsg_annotations la;
log_data_helper ldh(lss);
if (!ldh.parse_line(vl, true)) {
log_error("failed to parse line %d", vl);
return Err(lnav::console::user_message::error("Failed to parse line"));
}
auto line_number = content_line_t{ldh.ldh_line_index - ldh.ldh_y_offset};
lss.set_user_mark(&textview_curses::BM_META,
content_line_t{ldh.ldh_source_line - ldh.ldh_y_offset});
yajlpp_gen gen;
{
auto bm_opt = lss.find_bookmark_metadata(vl);
yajlpp_map root(gen);
root.gen("log_line");
root.gen((int64_t) vl);
root.gen("log_tags");
{
yajlpp_array tag_array(gen);
if (bm_opt) {
const auto& bm = *(bm_opt.value());
for (const auto& tag : bm.bm_tags) {
tag_array.gen(tag);
}
}
}
root.gen("log_path");
root.gen(lf->get_filename());
root.gen("log_format");
root.gen(lf->get_format_name());
root.gen("log_format_regex");
root.gen(lf->get_format()->get_pattern_name(line_number));
root.gen("log_msg");
root.gen(ldh.ldh_line_values.lvv_sbr.to_string_fragment());
for (const auto& val : ldh.ldh_line_values.lvv_values) {
root.gen(val.lv_meta.lvm_name);
switch (val.lv_meta.lvm_kind) {
case value_kind_t::VALUE_NULL:
root.gen();
break;
case value_kind_t::VALUE_INTEGER:
root.gen(val.lv_value.i);
break;
case value_kind_t::VALUE_FLOAT:
root.gen(val.lv_value.d);
break;
case value_kind_t::VALUE_BOOLEAN:
root.gen(val.lv_value.i ? true : false);
break;
default:
root.gen(val.to_string());
break;
}
}
}
for (const auto& anno : annos) {
auto iter = cfg.a_definitions.find(anno);
if (iter == cfg.a_definitions.end()) {
log_error("unknown annotation: %s", anno.c_str());
continue;
}
la.la_pairs[anno.to_string()] = "Loading...";
auto child_fds_res = auto_pipe::for_child_fds(
STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO);
if (child_fds_res.isErr()) {
auto um
= lnav::console::user_message::error("unable to create pipes")
.with_reason(child_fds_res.unwrapErr());
return Err(um);
}
auto child_res = lnav::pid::from_fork();
if (child_res.isErr()) {
auto um
= lnav::console::user_message::error("unable to fork() child")
.with_reason(child_res.unwrapErr());
return Err(um);
}
auto child_fds = child_fds_res.unwrap();
auto child = child_res.unwrap();
for (auto& child_fd : child_fds) {
child_fd.after_fork(child.in());
}
if (child.in_child()) {
const char* exec_args[] = {
getenv_opt("SHELL").value_or("bash"),
"-c",
iter->second.a_handler.pp_value.c_str(),
nullptr,
};
std::vector<ghc::filesystem::path> path_v;
auto src_path
= ghc::filesystem::path(
iter->second.a_handler.pp_location.sl_source.to_string())
.parent_path();
path_v.push_back(src_path);
path_v.push_back(lnav::paths::dotlnav() / "formats/default");
auto path_var = lnav::filesystem::build_path(path_v);
log_debug("annotate PATH: %s", path_var.c_str());
setenv("PATH", path_var.c_str(), 1);
execvp(exec_args[0], (char**) exec_args);
_exit(EXIT_FAILURE);
}
auto out_reader = std::async(
std::launch::async,
[out_fd = std::move(child_fds[1].read_end())]() mutable {
std::string retval;
file_range last_range;
line_buffer lb;
lb.set_fd(out_fd);
while (true) {
auto load_res = lb.load_next_line(last_range);
if (load_res.isErr()) {
log_error("unable to load next line: %s",
load_res.unwrapErr().c_str());
break;
}
auto li = load_res.unwrap();
if (li.li_file_range.empty()) {
break;
}
auto read_res = lb.read_range(li.li_file_range);
if (read_res.isErr()) {
log_error("unable to read next line: %s",
load_res.unwrapErr().c_str());
break;
}
auto sbr = read_res.unwrap();
retval.append(sbr.get_data(), sbr.length());
last_range = li.li_file_range;
}
return retval;
});
auto err_reader = std::async(
std::launch::async,
[err_fd = std::move(child_fds[2].read_end()),
handler = iter->second.a_handler.pp_value]() mutable {
std::string retval;
file_range last_range;
line_buffer lb;
lb.set_fd(err_fd);
while (true) {
auto load_res = lb.load_next_line(last_range);
if (load_res.isErr()) {
log_error("unable to load next line: %s",
load_res.unwrapErr().c_str());
break;
}
auto li = load_res.unwrap();
if (li.li_file_range.empty()) {
break;
}
auto read_res = lb.read_range(li.li_file_range);
if (read_res.isErr()) {
log_error("unable to read next line: %s",
load_res.unwrapErr().c_str());
break;
}
auto sbr = read_res.unwrap();
retval.append(sbr.get_data(), sbr.length());
sbr.rtrim(is_line_ending);
log_debug("%s: %.*s",
handler.c_str(),
sbr.length(),
sbr.get_data());
last_range = li.li_file_range;
}
return retval;
});
auto write_res
= child_fds[0].write_end().write_fully(gen.to_string_fragment());
if (write_res.isErr()) {
log_error("bah %s", write_res.unwrapErr().c_str());
}
child_fds[0].write_end().reset();
auto finalizer = [anno,
out_reader1 = out_reader.share(),
err_reader1 = err_reader.share(),
lf,
line_number,
handler = iter->second.a_handler.pp_value](
auto& fc,
auto_pid<process_state::finished>& child) mutable {
auto& line_anno
= lf->get_bookmark_metadata()[line_number].bm_annotations;
auto content = out_reader1.get();
if (!child.was_normal_exit()) {
content.append(fmt::format(
FMT_STRING(
"\n\n\u2718 annotation handler \u201c{}\u201d failed "
"with signal {}:\n\n<pre>\n{}\n</pre>\n"),
handler,
child.term_signal(),
err_reader1.get()));
} else if (child.exit_status() != 0) {
content.append(fmt::format(
FMT_STRING(
"\n\n<span "
"class=\"-lnav_log-level-styles_error\">"
"\u2718 annotation handler \u201c{}\u201d exited "
"with status {}:</span>\n\n<pre>{}</pre>"),
handler,
child.exit_status(),
md4cpp::escape_html(err_reader1.get())));
}
line_anno.la_pairs[anno.to_string()] = content;
lnav_data.ld_views[LNV_LOG].reload_data();
lnav_data.ld_views[LNV_LOG].set_needs_update();
};
lnav_data.ld_child_pollers.emplace_back(child_poller{
(*ld)->get_file_ptr()->get_filename(),
std::move(child),
std::move(finalizer),
});
}
lf->get_bookmark_metadata()[line_number].bm_annotations = la;
return Ok();
}
} // namespace annotate
} // namespace log
} // namespace lnav

@ -0,0 +1,57 @@
/**
* Copyright (c) 2023, Timothy Stack
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of Timothy Stack nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ''AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef lnav_log_annotate_cfg_hh
#define lnav_log_annotate_cfg_hh
#include <map>
#include <string>
#include "base/intern_string.hh"
#include "yajlpp/yajlpp.hh"
namespace lnav {
namespace log {
namespace annotate {
struct annotation_def {
std::string a_description;
std::string a_condition;
positioned_property<std::string> a_handler;
};
struct config {
std::map<intern_string_t, annotation_def> a_definitions;
};
} // namespace annotate
} // namespace log
} // namespace lnav
#endif

@ -0,0 +1,53 @@
/**
* Copyright (c) 2023, Timothy Stack
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of Timothy Stack nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ''AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef lnav_log_annotate_hh
#define lnav_log_annotate_hh
#include <string>
#include "base/lnav.console.hh"
#include "base/result.h"
#include "log.annotate.cfg.hh"
#include "vis_line.hh"
namespace lnav {
namespace log {
namespace annotate {
std::vector<intern_string_t> applicable(vis_line_t vl);
Result<void, lnav::console::user_message> apply(
vis_line_t vl, std::vector<intern_string_t> annos);
} // namespace annotate
} // namespace log
} // namespace lnav
#endif

@ -63,6 +63,7 @@ log_data_helper::parse_line(content_line_t line, bool allow_middle)
}
this->ldh_line = ll;
if (!ll->is_message()) {
log_warning("failed to parse line %d", line);
this->ldh_parser.reset();
this->ldh_scanner.reset();
this->ldh_namer.reset();

@ -33,6 +33,7 @@
#include "base/itertools.hh"
#include "base/lnav_log.hh"
#include "base/string_util.hh"
#include "bookmarks.json.hh"
#include "config.h"
#include "hasher.hh"
#include "lnav_util.hh"
@ -63,6 +64,7 @@ static const char* LOG_COLUMNS = R"( (
log_mark BOOLEAN, -- True if the log message was marked
log_comment TEXT, -- The comment for this message
log_tags TEXT, -- A JSON list of tags for this message
log_annotations TEXT, -- A JSON object of annotations for this messages
log_filters TEXT, -- A JSON list of filter IDs that matched this message
-- BEGIN Format-specific fields:
)";
@ -773,6 +775,22 @@ vt_column(sqlite3_vtab_cursor* cur, sqlite3_context* ctx, int col)
break;
}
case VT_COL_LOG_ANNOTATIONS: {
auto line_meta_opt
= vt->lss->find_bookmark_metadata(vc->log_cursor.lc_curr_line);
if (!line_meta_opt
|| line_meta_opt.value()->bm_annotations.la_pairs.empty())
{
sqlite3_result_null(ctx);
} else {
const auto& meta = *(line_meta_opt.value());
to_sqlite(ctx,
logmsg_annotations_handlers.to_json_string(
meta.bm_annotations));
}
break;
}
case VT_COL_FILTERS: {
const auto& filter_mask
= (*ld)->ld_filter_state.lfo_filter_state.tfs_mask;

@ -52,6 +52,7 @@ enum {
VT_COL_MARK,
VT_COL_LOG_COMMENT,
VT_COL_LOG_TAGS,
VT_COL_LOG_ANNOTATIONS,
VT_COL_FILTERS,
VT_COL_MAX
};

@ -38,6 +38,7 @@
#include "base/ansi_vars.hh"
#include "base/itertools.hh"
#include "base/string_util.hh"
#include "bookmarks.json.hh"
#include "bound_tags.hh"
#include "command_executor.hh"
#include "config.h"
@ -1530,6 +1531,26 @@ logfile_sub_source::eval_sql_filter(sqlite3_stmt* stmt,
}
continue;
}
if (strcmp(name, ":log_annotations") == 0) {
const auto& bm = lf->get_bookmark_metadata();
auto line_number
= static_cast<uint32_t>(std::distance(lf->cbegin(), ll));
auto bm_iter = bm.find(line_number);
if (bm_iter != bm.end()
&& !bm_iter->second.bm_annotations.la_pairs.empty())
{
const auto& meta = bm_iter->second;
auto anno_str = logmsg_annotations_handlers.to_string(
meta.bm_annotations);
sqlite3_bind_text(stmt,
lpc + 1,
anno_str.c_str(),
anno_str.length(),
SQLITE_TRANSIENT);
}
continue;
}
if (strcmp(name, ":log_tags") == 0) {
const auto& bm = lf->get_bookmark_metadata();
auto line_number
@ -1996,6 +2017,21 @@ logfile_sub_source::meta_grepper::grep_value_for_line(vis_line_t line,
value_out.append(tag);
value_out.append("\x1c");
}
value_out.append("\x1c");
for (const auto& pair : bm.bm_annotations.la_pairs) {
value_out.append(pair.first);
value_out.append("\x1c");
md2attr_line mdal;
auto parse_res = md4cpp::parse(pair.second, mdal);
if (parse_res.isOk()) {
value_out.append(parse_res.unwrap().get_string());
} else {
value_out.append(pair.second);
}
value_out.append("\x1c");
}
}
return !this->lmg_done;

@ -791,8 +791,16 @@ md2attr_line::text(MD_TEXTTYPE tt, const string_fragment& sf)
auto load_res = doc.load_string(html_span.c_str());
if (!load_res) {
log_error("failed to parse: %s",
log_error("XML parsing failure at %d: %s",
load_res.offset,
load_res.description());
auto sf = string_fragment::from_str(html_span);
auto error_line = sf.find_boundaries_around(
load_res.offset, string_fragment::tag1{'\n'});
log_error(" %.*s",
error_line.length(),
error_line.data());
} else {
last_block.erase(
this->ml_html_starts.back().second);

@ -120,6 +120,38 @@ get_emoji_map()
return retval;
}
std::string
escape_html(const std::string& content)
{
std::string retval;
retval.reserve(content.size());
for (auto ch : content) {
switch (ch) {
case '"':
retval.append("&quot;");
break;
case '\'':
retval.append("&apos;");
break;
case '<':
retval.append("&lt;");
break;
case '>':
retval.append("&gt;");
break;
case '&':
retval.append("&amp;");
break;
default:
retval.push_back(ch);
break;
}
}
return retval;
}
struct parse_userdata {
event_handler& pu_handler;
std::string pu_error_msg;

@ -139,6 +139,23 @@ const xml_entity_map& get_xml_entity_map();
const emoji_map& get_emoji_map();
std::string escape_html(const std::string& content);
namespace literals {
inline std::string operator"" _emoji(const char* str, std::size_t len)
{
const auto& em = get_emoji_map();
const auto key = std::string(str, len);
auto iter = em.em_shortname2emoji.find(key);
assert(iter != em.em_shortname2emoji.end());
return iter->second.get().e_value;
}
} // namespace literals
} // namespace md4cpp
#endif

@ -10,6 +10,15 @@
"mode": "top"
}
},
"log": {
"annotations": {
"com.vmware.vmacore.backtrace": {
"description": "Convert a vmacore backtrace into human-readable text",
"condition": ":log_body LIKE '%[context]%[/context]%'",
"handler": "com.vmware.btresolver.py"
}
}
},
"tuning": {
"archive-manager": {
"min-free-space": 33554432,

@ -0,0 +1,57 @@
#!/usr/bin/env python3
import sys
import html
import time
import json
import urllib.request
sys.stderr.write("reading stdin\n")
inj = json.load(sys.stdin)
sys.stderr.write("reading stdin done\n")
if False:
print("Hello, World!")
sys.exit()
RESOLVING_SERVICE_URL = "http://btresolver.eng.vmware.com:80/"
DEFAULT_TIMEOUT = 10
req_url = "%s%s" % (RESOLVING_SERVICE_URL, "async_resolve_text_bts")
log_msg = inj['log_msg']
index = log_msg.find('[context]')
if index != -1:
log_msg = log_msg[index:]
body = json.dumps([log_msg])
req = urllib.request.Request(req_url, body.encode('utf-8'))
resp = urllib.request.urlopen(req, timeout=DEFAULT_TIMEOUT)
resolve_content = json.loads(resp.read())
sys.stderr.write("resolve %s\n" % resolve_content)
if not resolve_content['success']:
print(resolve_content['errorString'])
sys.exit(1)
time.sleep(0.5)
delay = 1
done = False
while not done:
get_url = "%s%s" % (RESOLVING_SERVICE_URL, "get_task")
body = resolve_content['returnValue']['TaskIds'][0]
get_req = urllib.request.Request(get_url, body.encode('utf-8'))
get_resp = urllib.request.urlopen(get_req, timeout=DEFAULT_TIMEOUT)
get_content = json.loads(get_resp.read())
sys.stderr.write("get %s\n" % get_content)
if get_content['returnValue']['state'] == 'RUNNING':
if get_content['returnValue']['exception'] is None:
time.sleep(delay)
if delay < 10:
delay = delay * 2
else:
print("<pre>\n%s</pre>" % html.escape(get_content['returnValue']['exception']))
done = True
elif get_content['returnValue']['state'] == 'COMPLETED':
print("<pre>\n%s</pre>" % html.escape(get_content['returnValue']['output']))
done = True

@ -10,6 +10,7 @@ BUILTIN_LNAVSCRIPTS = \
$()
BUILTIN_SHSCRIPTS = \
$(srcdir)/scripts/com.vmware.btresolver.py \
$(srcdir)/scripts/dump-pid.sh \
$(srcdir)/scripts/pcap_log-converter.sh \
$()

@ -44,6 +44,7 @@
#include "base/isc.hh"
#include "base/opt_util.hh"
#include "base/paths.hh"
#include "bookmarks.json.hh"
#include "command_executor.hh"
#include "config.h"
#include "hasher.hh"
@ -74,6 +75,7 @@ CREATE TABLE IF NOT EXISTS bookmarks (
access_time datetime DEFAULT CURRENT_TIMESTAMP,
comment text DEFAULT '',
tags text DEFAULT '',
annotations text DEFAULT NULL,
PRIMARY KEY (log_time, log_format, log_hash, session_time)
);
@ -126,6 +128,7 @@ static const char* NETLOC_LRU_STMT
static const char* UPGRADE_STMTS[] = {
R"(ALTER TABLE bookmarks ADD COLUMN comment text DEFAULT '';)",
R"(ALTER TABLE bookmarks ADD COLUMN tags text DEFAULT '';)",
R"(ALTER TABLE bookmarks ADD COLUMN annotations text DEFAULT NULL;)",
};
static const size_t MAX_SESSIONS = 8;
@ -372,6 +375,24 @@ scan_sessions()
void
load_time_bookmarks()
{
static const char* BOOKMARK_STMT = R"(
SELECT
log_time,
log_format,
log_hash,
session_time,
part_name,
access_time,
comment,
tags,
annotations,
session_time=? AS same_session
FROM bookmarks WHERE
log_time BETWEEN ? AND ? AND
log_format = ?
ORDER BY same_session DESC, session_time DESC
)";
logfile_sub_source& lss = lnav_data.ld_log_source;
auto_sqlite3 db;
auto db_path = lnav::paths::dotlnav() / LOG_METADATA_NAME;
@ -425,16 +446,7 @@ load_time_bookmarks()
}
}
if (sqlite3_prepare_v2(
db.in(),
"SELECT log_time, log_format, log_hash, session_time, part_name, "
"access_time, comment,"
" tags, session_time=? as same_session FROM bookmarks WHERE "
" log_time between ? and ? and log_format = ? "
" ORDER BY same_session DESC, session_time DESC",
-1,
stmt.out(),
nullptr)
if (sqlite3_prepare_v2(db.in(), BOOKMARK_STMT, -1, stmt.out(), nullptr)
!= SQLITE_OK)
{
log_error("could not prepare bookmark select statement -- %s",
@ -494,6 +506,7 @@ load_time_bookmarks()
= (const char*) sqlite3_column_text(stmt.in(), 6);
const char* tags
= (const char*) sqlite3_column_text(stmt.in(), 7);
const auto annotations = sqlite3_column_text(stmt.in(), 8);
int64_t mark_time = sqlite3_column_int64(stmt.in(), 3);
struct timeval log_tv;
struct exttm log_tm;
@ -595,6 +608,33 @@ load_time_bookmarks()
}
meta = true;
}
if (annotations != nullptr
&& annotations[0] != '\0')
{
static const intern_string_t SRC
= intern_string::lookup("annotations");
const auto anno_sf
= string_fragment::from_c_str(annotations);
auto parse_res = logmsg_annotations_handlers
.parser_for(SRC)
.of(anno_sf);
if (parse_res.isErr()) {
log_error(
"unable to parse annotations JSON -- "
"%s",
parse_res.unwrapErr()[0]
.to_attr_line()
.get_string()
.c_str());
} else {
lss.set_user_mark(&textview_curses::BM_META,
line_cl);
bm_meta[line_number].bm_annotations
= parse_res.unwrap();
meta = true;
}
}
if (!meta) {
marked_session_lines.push_back(line_cl);
lss.set_user_mark(&textview_curses::BM_USER,
@ -937,7 +977,7 @@ save_user_bookmarks(sqlite3* db,
return;
}
} else {
bookmark_metadata& line_meta = *(line_meta_opt.value());
const auto& line_meta = *(line_meta_opt.value());
if (line_meta.empty()) {
continue;
}
@ -989,6 +1029,25 @@ save_user_bookmarks(sqlite3* db,
log_error("could not bind tags -- %s", sqlite3_errmsg(db));
return;
}
if (!line_meta.bm_annotations.la_pairs.empty()) {
auto anno_str = logmsg_annotations_handlers.to_string(
line_meta.bm_annotations);
if (sqlite3_bind_text(stmt,
8,
anno_str.c_str(),
anno_str.length(),
SQLITE_TRANSIENT)
!= SQLITE_OK)
{
log_error("could not bind annotations -- %s",
sqlite3_errmsg(db));
return;
}
} else {
sqlite3_bind_null(stmt, 8);
}
}
if (sqlite3_step(stmt) != SQLITE_DONE) {
@ -1103,8 +1162,8 @@ save_time_bookmarks()
if (sqlite3_prepare_v2(db.in(),
"REPLACE INTO bookmarks"
" (log_time, log_format, log_hash, session_time, "
"part_name, comment, tags)"
" VALUES (?, ?, ?, ?, ?, ?, ?)",
"part_name, comment, tags, annotations)"
" VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
-1,
stmt.out(),
nullptr)

@ -379,6 +379,7 @@ dist_noinst_DATA = \
vt52_curses_output.1 \
xpath_tui.0 \
configs/installed/hw-url-handler.json \
configs/installed/hw-url-handler.json \
configs/installed/hw-url-handler.lnav \
formats/collision/format.json \
formats/customlevel/format.json \

@ -0,0 +1,14 @@
{
"$schema": "https://lnav.org/schemas/config-v1.schema.json",
"log": {
"annotations": {
"org.lnav.test.no-handler": {
"description": "annotation without a handler"
},
"org.lnav.test.no-condition": {
"description": "annotation without a condition",
"handler": "my-handler"
}
}
}
}

@ -0,0 +1,12 @@
{
"$schema": "https://lnav.org/schemas/config-v1.schema.json",
"log": {
"annotations": {
"org.lnav.test": {
"description": "test annotation",
"condition": ":c_ip IS NOT NULL AND $TEST_ANNO = '1'",
"handler": "anno-test.sh"
}
}
}
}

@ -0,0 +1,3 @@
#!/usr/bin/env bash
echo 'Hello, <span style="color: #f00">World</span>!'

@ -350,6 +350,8 @@ EXPECTED_FILES = \
$(srcdir)/%reldir%/test_logfile.sh_c18e14a26d8261c9f72747118a469266121d5459.out \
$(srcdir)/%reldir%/test_logfile.sh_e840b674cd65936a72bd64b1dac1524d16fe44c3.err \
$(srcdir)/%reldir%/test_logfile.sh_e840b674cd65936a72bd64b1dac1524d16fe44c3.out \
$(srcdir)/%reldir%/test_meta.sh_039c1f127c087ec2c6a23a0ecec4df7992cbc8b4.err \
$(srcdir)/%reldir%/test_meta.sh_039c1f127c087ec2c6a23a0ecec4df7992cbc8b4.out \
$(srcdir)/%reldir%/test_meta.sh_154047fb52e4831aabf7d36512247bad6a6a2cf7.err \
$(srcdir)/%reldir%/test_meta.sh_154047fb52e4831aabf7d36512247bad6a6a2cf7.out \
$(srcdir)/%reldir%/test_meta.sh_3c9b5940f7533c5fc3d4956a6efce50a9e7132d4.err \
@ -644,6 +646,8 @@ EXPECTED_FILES = \
$(srcdir)/%reldir%/test_sql_fs_func.sh_469380561dccd79c7249562067107c330838eaad.out \
$(srcdir)/%reldir%/test_sql_fs_func.sh_54b004f301907860d360434b37fd6c81fcc12f99.err \
$(srcdir)/%reldir%/test_sql_fs_func.sh_54b004f301907860d360434b37fd6c81fcc12f99.out \
$(srcdir)/%reldir%/test_sql_fs_func.sh_5a69557a4e14e33e4a213932accbcd4803c947b4.err \
$(srcdir)/%reldir%/test_sql_fs_func.sh_5a69557a4e14e33e4a213932accbcd4803c947b4.out \
$(srcdir)/%reldir%/test_sql_fs_func.sh_73df81c6889d1f06fb3f3b6bf30c6046b3f52c8b.err \
$(srcdir)/%reldir%/test_sql_fs_func.sh_73df81c6889d1f06fb3f3b6bf30c6046b3f52c8b.out \
$(srcdir)/%reldir%/test_sql_fs_func.sh_74ca242a126316bcb82ccefd9369f9e43b7fd2e1.err \

@ -4011,6 +4011,18 @@
"log": {
"watch-expressions": {
},
"annotations": {
"com.vmware.vmacore.backtrace": {
"description": "Convert a vmacore backtrace into human-readable text",
"condition": ":log_body LIKE '%[context]%[/context]%'",
"handler": "com.vmware.btresolver.py"
},
"org.lnav.test": {
"description": "test annotation",
"condition": ":c_ip IS NOT NULL AND $TEST_ANNO = '1'",
"handler": "anno-test.sh"
}
}
},
"global": {

@ -11,38 +11,44 @@
/global/keymap_def_scroll_horiz -> default-keymap.json:6
/global/keymap_def_text_view -> default-keymap.json:10
/global/keymap_def_zoom -> default-keymap.json:12
/tuning/archive-manager/cache-ttl -> root-config.json:16
/tuning/archive-manager/min-free-space -> root-config.json:15
/tuning/clipboard/impls/MacOS/find/read -> root-config.json:44
/tuning/clipboard/impls/MacOS/find/write -> root-config.json:43
/tuning/clipboard/impls/MacOS/general/read -> root-config.json:40
/tuning/clipboard/impls/MacOS/general/write -> root-config.json:39
/tuning/clipboard/impls/MacOS/test -> root-config.json:37
/tuning/clipboard/impls/NeoVim/general/read -> root-config.json:72
/tuning/clipboard/impls/NeoVim/general/write -> root-config.json:71
/tuning/clipboard/impls/NeoVim/test -> root-config.json:69
/tuning/clipboard/impls/Wayland/general/read -> root-config.json:51
/tuning/clipboard/impls/Wayland/general/write -> root-config.json:50
/tuning/clipboard/impls/Wayland/test -> root-config.json:48
/tuning/clipboard/impls/Windows/general/write -> root-config.json:78
/tuning/clipboard/impls/Windows/test -> root-config.json:76
/tuning/clipboard/impls/X11-xclip/general/read -> root-config.json:58
/tuning/clipboard/impls/X11-xclip/general/write -> root-config.json:57
/tuning/clipboard/impls/X11-xclip/test -> root-config.json:55
/tuning/clipboard/impls/tmux/general/read -> root-config.json:65
/tuning/clipboard/impls/tmux/general/write -> root-config.json:64
/tuning/clipboard/impls/tmux/test -> root-config.json:62
/tuning/piper/max-size -> root-config.json:30
/tuning/piper/rotations -> root-config.json:31
/tuning/piper/ttl -> root-config.json:32
/tuning/remote/ssh/command -> root-config.json:20
/tuning/remote/ssh/config/BatchMode -> root-config.json:22
/tuning/remote/ssh/config/ConnectTimeout -> root-config.json:23
/tuning/remote/ssh/start-command -> root-config.json:25
/tuning/remote/ssh/transfer-command -> root-config.json:26
/tuning/url-scheme/docker/handler -> root-config.json:85
/log/annotations/com.vmware.vmacore.backtrace/condition -> root-config.json:17
/log/annotations/com.vmware.vmacore.backtrace/description -> root-config.json:16
/log/annotations/com.vmware.vmacore.backtrace/handler -> root-config.json:18
/log/annotations/org.lnav.test/condition -> {test_dir}/configs/installed/anno-test.json:7
/log/annotations/org.lnav.test/description -> {test_dir}/configs/installed/anno-test.json:6
/log/annotations/org.lnav.test/handler -> {test_dir}/configs/installed/anno-test.json:8
/tuning/archive-manager/cache-ttl -> root-config.json:25
/tuning/archive-manager/min-free-space -> root-config.json:24
/tuning/clipboard/impls/MacOS/find/read -> root-config.json:53
/tuning/clipboard/impls/MacOS/find/write -> root-config.json:52
/tuning/clipboard/impls/MacOS/general/read -> root-config.json:49
/tuning/clipboard/impls/MacOS/general/write -> root-config.json:48
/tuning/clipboard/impls/MacOS/test -> root-config.json:46
/tuning/clipboard/impls/NeoVim/general/read -> root-config.json:81
/tuning/clipboard/impls/NeoVim/general/write -> root-config.json:80
/tuning/clipboard/impls/NeoVim/test -> root-config.json:78
/tuning/clipboard/impls/Wayland/general/read -> root-config.json:60
/tuning/clipboard/impls/Wayland/general/write -> root-config.json:59
/tuning/clipboard/impls/Wayland/test -> root-config.json:57
/tuning/clipboard/impls/Windows/general/write -> root-config.json:87
/tuning/clipboard/impls/Windows/test -> root-config.json:85
/tuning/clipboard/impls/X11-xclip/general/read -> root-config.json:67
/tuning/clipboard/impls/X11-xclip/general/write -> root-config.json:66
/tuning/clipboard/impls/X11-xclip/test -> root-config.json:64
/tuning/clipboard/impls/tmux/general/read -> root-config.json:74
/tuning/clipboard/impls/tmux/general/write -> root-config.json:73
/tuning/clipboard/impls/tmux/test -> root-config.json:71
/tuning/piper/max-size -> root-config.json:39
/tuning/piper/rotations -> root-config.json:40
/tuning/piper/ttl -> root-config.json:41
/tuning/remote/ssh/command -> root-config.json:29
/tuning/remote/ssh/config/BatchMode -> root-config.json:31
/tuning/remote/ssh/config/ConnectTimeout -> root-config.json:32
/tuning/remote/ssh/start-command -> root-config.json:34
/tuning/remote/ssh/transfer-command -> root-config.json:35
/tuning/url-scheme/docker/handler -> root-config.json:94
/tuning/url-scheme/hw/handler -> {test_dir}/configs/installed/hw-url-handler.json:6
/tuning/url-scheme/piper/handler -> root-config.json:88
/tuning/url-scheme/piper/handler -> root-config.json:97
/ui/clock-format -> root-config.json:4
/ui/default-colors -> root-config.json:6
/ui/dim-text -> root-config.json:5

@ -8,6 +8,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"c_ip": "192.168.202.254",
"cs_method": "GET",
@ -30,6 +31,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"c_ip": "192.168.202.254",
"cs_method": "GET",
@ -52,6 +54,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"c_ip": "192.168.202.254",
"cs_method": "GET",

@ -711,6 +711,12 @@ For support questions, email:
:annotate
══════════════════════════════════════════════════════════════════════
Analyze the focused log message and attach annotations
See Also
:comment, :tag
:append-to path
══════════════════════════════════════════════════════════════════════
Append marked lines in the current view to the given file
@ -740,7 +746,7 @@ For support questions, email:
══════════════════════════════════════════════════════════════════════
Clear the comment attached to the top log line
See Also
:comment, :tag
:annotate, :comment, :tag
:clear-filter-expr
══════════════════════════════════════════════════════════════════════
@ -787,7 +793,7 @@ For support questions, email:
Parameter
text The comment text
See Also
:clear-comment, :tag
:annotate, :clear-comment, :tag
Example
#1 To add the comment 'This is where it all went wrong' to the top line:
:comment This is where it all went wrong 
@ -906,7 +912,7 @@ For support questions, email:
Parameter
tag The tags to delete
See Also
:comment, :tag
:annotate, :comment, :tag
Example
#1 To remove the tags '#BUG123' and '#needs-review' from all log lines:
:delete-tags #BUG123 #needs-review 
@ -1538,7 +1544,7 @@ For support questions, email:
Parameter
tag The tags to attach
See Also
:comment, :delete-tags, :untag
:annotate, :comment, :delete-tags, :untag
Example
#1 To add the tags '#BUG123' and '#needs-review' to the top line:
:tag #BUG123 #needs-review 
@ -1585,7 +1591,7 @@ For support questions, email:
Parameter
tag The tags to detach
See Also
:comment, :tag
:annotate, :comment, :tag
Example
#1 To remove the tags '#BUG123' and '#needs-review' from the top line:
:untag #BUG123 #needs-review 

@ -1,3 +1,3 @@
{"log_line":0,"log_part":null,"log_time":"2009-07-20 22:59:26.000","log_idle_msecs":0,"log_level":"info","log_mark":0,"log_comment":null,"log_tags":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/cgi/tramp","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":134,"sc_status":200,"cs_host":null}
{"log_line":1,"log_part":null,"log_time":"2009-07-20 22:59:29.000","log_idle_msecs":3000,"log_level":"error","log_mark":0,"log_comment":null,"log_tags":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkboot.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":46210,"sc_status":404,"cs_host":null}
{"log_line":2,"log_part":null,"log_time":"2009-07-20 22:59:29.000","log_idle_msecs":0,"log_level":"info","log_mark":0,"log_comment":null,"log_tags":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkernel.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":78929,"sc_status":200,"cs_host":null}
{"log_line":0,"log_part":null,"log_time":"2009-07-20 22:59:26.000","log_idle_msecs":0,"log_level":"info","log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/cgi/tramp","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":134,"sc_status":200,"cs_host":null}
{"log_line":1,"log_part":null,"log_time":"2009-07-20 22:59:29.000","log_idle_msecs":3000,"log_level":"error","log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkboot.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":46210,"sc_status":404,"cs_host":null}
{"log_line":2,"log_part":null,"log_time":"2009-07-20 22:59:29.000","log_idle_msecs":0,"log_level":"info","log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkernel.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":78929,"sc_status":200,"cs_host":null}

@ -55,6 +55,21 @@
✘ error: invalid JSON
reason: parse error: premature EOF
 --> {test_dir}/bad-config2/formats/invalid-config/config.truncated.json:3
✘ error: missing value for property “/log/annotations/org.lnav.test.no-condition/condition”
reason: SQL expression is invalid
 |  reason: incomplete input
 |   --> /log/annotations/org.lnav.test.no-condition/condition
 = help: Property Synopsis
/log/annotations/org.lnav.test.no-condition/condition <SQL-expression>
Description
The SQLite expression to execute for a log message that determines whether or not this annotation is applicable. The expression is evaluated the same way as a filter expression
✘ error: missing value for property “/log/annotations/org.lnav.test.no-handler/handler”
reason: no handler specified for annotation
 |  reason: Every annotation requires a handler
 = help: Property Synopsis
/log/annotations/org.lnav.test.no-handler/handler <script>
Description
The script to execute to generate the annotation content. A JSON object with the log message content will be sent to the script on the standard input
✘ error: invalid value for property “/ui/theme-defs/invalid-theme/styles/text/color”
reason: invalid color -- “InvalidColor”
 |  reason: Unknown color: 'InvalidColor'. See https://jonasjacek.github.io/colors/ for a list of supported color names

@ -1,9 +1,9 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters
0,<NULL>,2016-06-30 12:00:01.000,0,trace,0,<NULL>,<NULL>,<NULL>
1,<NULL>,2016-06-30 12:00:02.000,1000,debug,0,<NULL>,<NULL>,<NULL>
2,<NULL>,2016-06-30 12:00:03.000,1000,debug2,0,<NULL>,<NULL>,<NULL>
3,<NULL>,2016-06-30 12:00:04.000,1000,debug3,0,<NULL>,<NULL>,<NULL>
4,<NULL>,2016-06-30 12:00:05.000,1000,info,0,<NULL>,<NULL>,<NULL>
5,<NULL>,2016-06-30 12:00:06.000,1000,warning,0,<NULL>,<NULL>,<NULL>
6,<NULL>,2016-06-30 12:00:07.000,1000,fatal,0,<NULL>,<NULL>,<NULL>
7,<NULL>,2016-06-30 12:00:08.000,1000,info,0,<NULL>,<NULL>,<NULL>
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters
0,<NULL>,2016-06-30 12:00:01.000,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>
1,<NULL>,2016-06-30 12:00:02.000,1000,debug,0,<NULL>,<NULL>,<NULL>,<NULL>
2,<NULL>,2016-06-30 12:00:03.000,1000,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>
3,<NULL>,2016-06-30 12:00:04.000,1000,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>
4,<NULL>,2016-06-30 12:00:05.000,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>
5,<NULL>,2016-06-30 12:00:06.000,1000,warning,0,<NULL>,<NULL>,<NULL>,<NULL>
6,<NULL>,2016-06-30 12:00:07.000,1000,fatal,0,<NULL>,<NULL>,<NULL>,<NULL>
7,<NULL>,2016-06-30 12:00:08.000,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>

@ -1,14 +1,14 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,@fields/user,@fields/trace#
0,<NULL>,2013-09-06 20:00:48.124,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
2,<NULL>,2013-09-06 20:00:49.124,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
4,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,steve@example.com,<NULL>
7,<NULL>,2013-09-06 22:00:59.124,10000,debug5,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
9,<NULL>,2013-09-06 22:00:59.124,0,debug4,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
11,<NULL>,2013-09-06 22:00:59.124,0,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
13,<NULL>,2013-09-06 22:00:59.124,0,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
15,<NULL>,2013-09-06 22:00:59.124,0,debug,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
17,<NULL>,2013-09-06 22:01:49.124,50000,stats,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
19,<NULL>,2013-09-06 22:01:49.124,0,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
21,<NULL>,2013-09-06 22:01:49.124,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
23,<NULL>,2013-09-06 22:01:49.124,0,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
25,<NULL>,2013-09-06 22:01:49.124,0,fatal,0,<NULL>,<NULL>,<NULL>,<NULL>,line:1
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,@fields/user,@fields/trace#
0,<NULL>,2013-09-06 20:00:48.124,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
2,<NULL>,2013-09-06 20:00:49.124,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
4,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,steve@example.com,<NULL>
7,<NULL>,2013-09-06 22:00:59.124,10000,debug5,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
9,<NULL>,2013-09-06 22:00:59.124,0,debug4,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
11,<NULL>,2013-09-06 22:00:59.124,0,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
13,<NULL>,2013-09-06 22:00:59.124,0,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
15,<NULL>,2013-09-06 22:00:59.124,0,debug,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
17,<NULL>,2013-09-06 22:01:49.124,50000,stats,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
19,<NULL>,2013-09-06 22:01:49.124,0,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
21,<NULL>,2013-09-06 22:01:49.124,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
23,<NULL>,2013-09-06 22:01:49.124,0,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
25,<NULL>,2013-09-06 22:01:49.124,0,fatal,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,line:1

@ -8,6 +8,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -23,6 +24,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -38,6 +40,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -53,6 +56,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -68,6 +72,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -83,6 +88,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -98,6 +104,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -113,6 +120,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -128,6 +136,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -143,6 +152,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -158,6 +168,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -173,6 +184,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": null,
"obj": null,
@ -188,6 +200,7 @@
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"arr": [
"hi",

@ -1,4 +1,4 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,user,cl
0,<NULL>,2013-09-06 20:00:49.124,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,com.exmaple.foo
1,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,steve@example.com,com.exmaple.foo
3,<NULL>,2013-09-06 22:01:49.124,60000,error,0,<NULL>,<NULL>,<NULL>,<NULL>,com.exmaple.foo
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,user,cl
0,<NULL>,2013-09-06 20:00:49.124,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,com.exmaple.foo
1,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,steve@example.com,com.exmaple.foo
3,<NULL>,2013-09-06 22:01:49.124,60000,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,com.exmaple.foo

@ -1,14 +1,14 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,arr,obj,lvl,user
0,<NULL>,2013-09-06 20:00:48.124,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,TRACE,<NULL>
2,<NULL>,2013-09-06 20:00:49.124,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,INFO,<NULL>
4,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,INFO,steve@example.com
7,<NULL>,2013-09-06 22:00:59.124,10000,debug5,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG5,<NULL>
9,<NULL>,2013-09-06 22:00:59.124,0,debug4,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG4,<NULL>
11,<NULL>,2013-09-06 22:00:59.124,0,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG3,<NULL>
13,<NULL>,2013-09-06 22:00:59.124,0,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG2,<NULL>
15,<NULL>,2013-09-06 22:00:59.124,0,debug,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG,<NULL>
17,<NULL>,2013-09-06 22:01:49.124,50000,stats,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,STATS,<NULL>
19,<NULL>,2013-09-06 22:01:49.124,0,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,WARNING,<NULL>
21,<NULL>,2013-09-06 22:01:49.124,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,ERROR,<NULL>
23,<NULL>,2013-09-06 22:01:49.124,0,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,CRITICAL,<NULL>
25,<NULL>,2013-09-06 22:01:49.124,0,fatal,0,<NULL>,<NULL>,<NULL>,"[""hi"", {""sub1"": true}]","{ ""field1"" : ""hi"", ""field2"": 2 }",FATAL,<NULL>
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,arr,obj,lvl,user
0,<NULL>,2013-09-06 20:00:48.124,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,TRACE,<NULL>
2,<NULL>,2013-09-06 20:00:49.124,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,INFO,<NULL>
4,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,INFO,steve@example.com
7,<NULL>,2013-09-06 22:00:59.124,10000,debug5,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG5,<NULL>
9,<NULL>,2013-09-06 22:00:59.124,0,debug4,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG4,<NULL>
11,<NULL>,2013-09-06 22:00:59.124,0,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG3,<NULL>
13,<NULL>,2013-09-06 22:00:59.124,0,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG2,<NULL>
15,<NULL>,2013-09-06 22:00:59.124,0,debug,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG,<NULL>
17,<NULL>,2013-09-06 22:01:49.124,50000,stats,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,STATS,<NULL>
19,<NULL>,2013-09-06 22:01:49.124,0,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,WARNING,<NULL>
21,<NULL>,2013-09-06 22:01:49.124,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,ERROR,<NULL>
23,<NULL>,2013-09-06 22:01:49.124,0,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,CRITICAL,<NULL>
25,<NULL>,2013-09-06 22:01:49.124,0,fatal,0,<NULL>,<NULL>,<NULL>,<NULL>,"[""hi"", {""sub1"": true}]","{ ""field1"" : ""hi"", ""field2"": 2 }",FATAL,<NULL>

@ -1,4 +1,4 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3
0,<NULL>,2017-03-24 20:06:26.240,0,info,0,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>
1,<NULL>,2017-03-24 20:12:47.764,381524,critical,0,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>
2,<NULL>,2017-03-24 20:15:31.694,163930,warning,0,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}"
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3
0,<NULL>,2017-03-24 20:06:26.240,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>
1,<NULL>,2017-03-24 20:12:47.764,381524,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>
2,<NULL>,2017-03-24 20:15:31.694,163930,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}"

@ -1,4 +1,4 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3
0,<NULL>,2017-03-24 16:06:26.240,0,info,0,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>
1,<NULL>,2017-03-24 16:12:47.764,381524,critical,0,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>
2,<NULL>,2017-03-24 16:15:31.694,163930,warning,0,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}"
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3
0,<NULL>,2017-03-24 16:06:26.240,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>
1,<NULL>,2017-03-24 16:12:47.764,381524,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>
2,<NULL>,2017-03-24 16:15:31.694,163930,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}"

@ -1,3 +1,3 @@
log_line log_part log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters col_0 col_1
0 <NULL> 2021-05-19 08:00:01.000 0 info 0 <NULL> <NULL> <NULL> 1 /abc/def
2 <NULL> 2021-05-19 08:00:03.000 2000 info 0 <NULL> <NULL> <NULL> 3 /ghi/jkl
log_line log_part log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters col_0 col_1
0 <NULL> 2021-05-19 08:00:01.000 0 info 0 <NULL> <NULL> <NULL> <NULL> 1 /abc/def
2 <NULL> 2021-05-19 08:00:03.000 2000 info 0 <NULL> <NULL> <NULL> <NULL> 3 /ghi/jkl

@ -0,0 +1,7 @@
192.168.202.254 - - [20/Jul/2009:22:59:26 +0000] "GET /vmw/cgi/tramp HTTP/1.0" 200 134 "-" "gPXE/0.9.7"
 ├ org.lnav.test:
 ╰ Hello, World!
192.168.202.254 - - [20/Jul/2009:22:59:29 +0000] "GET /vmw/vSphere/default/vmkboot.gz HTTP/1.0" 404 46210 "-" "gPXE/0.9.7"
📝 Annotations available, use :annotate to apply them to this line
192.168.202.254 - - [20/Jul/2009:22:59:29 +0000] "GET /vmw/vSphere/default/vmkernel.gz HTTP/1.0" 200 78929 "-" "gPXE/0.9.7"
📝 Annotations available, use :annotate to apply them to this line

@ -1,5 +1,5 @@
192.168.202.254 - - [20/Jul/2009:22:59:26 +0000] "GET /vmw/cgi/tramp HTTP/1.0" 200 134 "-" "gPXE/0.9.7"
192.168.202.254 - - [20/Jul/2009:22:59:29 +0000] "GET /vmw/vSphere/default/vmkboot.gz HTTP/1.0" 404 46210 "-" "gPXE/0.9.7"
Hello, World!
└ #foo
192.168.202.254 - - [20/Jul/2009:22:59:29 +0000] "GET /vmw/vSphere/default/vmkboot.gz HTTP/1.0" 404 46210 "-" "gPXE/0.9.7"
192.168.202.254 - - [20/Jul/2009:22:59:29 +0000] "GET /vmw/vSphere/default/vmkernel.gz HTTP/1.0" 200 78929 "-" "gPXE/0.9.7"

@ -1,2 +1,2 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters  c_ip cs_bytes cs_method cs_uri_query  cs_uri_stem cs_username cs_vars cs_version s_app s_core s_pid s_req s_runtime s_switches s_worker_reqs sc_bytes sc_header_bytes sc_headers sc_status 
 0  <NULL> 2016-03-13 22:49:12.000  0 info   0  <NULL>  <NULL>  <NULL> 127.0.0.1  696 POST   <NULL> /update_metrics     38 HTTP/1.1  0   3  88185  1  0.129  1  1  47  378  9    200
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters  c_ip cs_bytes cs_method cs_uri_query  cs_uri_stem cs_username cs_vars cs_version s_app s_core s_pid s_req s_runtime s_switches s_worker_reqs sc_bytes sc_header_bytes sc_headers sc_status 
 0  <NULL> 2016-03-13 22:49:12.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL> 127.0.0.1  696 POST   <NULL> /update_metrics        38 HTTP/1.1  0  3  88185  1  0.129  1  1  47  378  9    200

@ -1,2 +1,2 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,col_0,TTY,PWD,USER,COMMAND
0,<NULL>,2007-11-03 09:47:02.000,0,info,0,<NULL>,<NULL>,[1],veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>,timstack,pts/6,/auto/wstimstack/rpms/lbuild/test,root,/usr/bin/tail /var/log/messages
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,col_0,TTY,PWD,USER,COMMAND
0,<NULL>,2007-11-03 09:47:02.000,0,info,0,<NULL>,<NULL>,<NULL>,[1],veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>,timstack,pts/6,/auto/wstimstack/rpms/lbuild/test,root,/usr/bin/tail /var/log/messages

@ -1,3 +1,3 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters log_msg_format 
  1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL>
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL>  
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format 
  1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL> <NULL>
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL>  <NULL>  

@ -1,5 +1,5 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters  c_ip cs_method cs_referer cs_uri_query  cs_uri_stem cs_user_agent cs_username cs_version sc_bytes sc_status cs_host  log_unique_path 
  0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL> 192.168.202.254 GET - <NULL> /vmw/cgi/tramp gPXE/0.9.7 - HTTP/1.0  134 200 <NULL> logfile_access_log.0
   1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL> 192.168.202.254 GET - <NULL> /vmw/vSphere/default/vmkboot.gz gPXE/0.9.7 - HTTP/1.0  46210 404 <NULL> logfile_access_log.0
  2  <NULL> 2009-07-20 22:59:29.000  0 info   0  <NULL>  <NULL>  <NULL> 192.168.202.254 GET  -   <NULL> /vmw/vSphere/default/vmkernel.gz gPXE/0.9.7  -  HTTP/1.0   78929  200  <NULL> logfile_access_log.0 
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL> 10.112.81.15  <NULL>  -   <NULL> <NULL>  -  -  <NULL>   0  400  <NULL> logfile_access_log.1 
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters  c_ip cs_method cs_referer cs_uri_query  cs_uri_stem cs_user_agent cs_username cs_version sc_bytes sc_status cs_host  log_unique_path 
  0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 192.168.202.254 GET - <NULL> /vmw/cgi/tramp gPXE/0.9.7 - HTTP/1.0  134 200 <NULL> logfile_access_log.0
   1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL> <NULL> 192.168.202.254 GET - <NULL> /vmw/vSphere/default/vmkboot.gz gPXE/0.9.7 - HTTP/1.0  46210 404 <NULL> logfile_access_log.0
  2  <NULL> 2009-07-20 22:59:29.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL> 192.168.202.254 GET  -   <NULL> /vmw/vSphere/default/vmkernel.gz gPXE/0.9.7  -  HTTP/1.0   78929  200  <NULL> logfile_access_log.0 
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL>  <NULL> 10.112.81.15  <NULL>  -   <NULL> <NULL>  -  -  <NULL>   0  400  <NULL> logfile_access_log.1 

@ -1,5 +1,5 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters log_msg_format log_format 
0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL> access_log
  1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL> access_log
 2  <NULL> 2009-07-20 22:59:29.000  0 info   0  <NULL>  <NULL>  <NULL>   access_log 
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL>   access_log 
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format log_format 
0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL> <NULL> access_log
  1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL> <NULL> access_log
 2  <NULL> 2009-07-20 22:59:29.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>   access_log 
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL>  <NULL>   access_log 

@ -1,3 +1,3 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters log_msg_format 
0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL>
2 <NULL> 2009-07-20 22:59:29.000  0 info 0 <NULL> <NULL> <NULL>
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format 
0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL> <NULL>
2 <NULL> 2009-07-20 22:59:29.000  0 info 0 <NULL> <NULL> <NULL> <NULL>

@ -1,5 +1,5 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters log_msg_format 
0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL>
  1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL>
 2  <NULL> 2009-07-20 22:59:29.000  0 info   0  <NULL>  <NULL>  <NULL>  
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL>   
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format 
0 <NULL> 2009-07-20 22:59:26.000  0 info 0 <NULL> <NULL> <NULL> <NULL>
  1 <NULL> 2009-07-20 22:59:29.000  3000 error 0 <NULL> <NULL> <NULL> <NULL>
 2  <NULL> 2009-07-20 22:59:29.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  
 3  <NULL> 2013-02-15 06:00:31.000  112777262000 error   0  <NULL>  <NULL>  <NULL>  <NULL>   

@ -1,27 +1,27 @@
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,match_index,content
2,<NULL>,2022-08-16 00:32:15.000,199000,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.cdscheduler""}"
2,<NULL>,2022-08-16 00:32:15.000,199000,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
5,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.install""}"
5,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" sharing output destination ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,2,"{""value"":""/var/log/asl""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,3,"{""value"":"" with ASL Module ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,4,"{""value"":""com.apple.asl""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,6,"{""value"":""com.apple.asl""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,8,"{""value"":""com.apple.authd""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,9,"{""value"":"".""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" sharing output destination ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,2,"{""value"":""/var/log/system.log""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,3,"{""value"":"" with ASL Module ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,4,"{""value"":""com.apple.asl""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,6,"{""value"":""com.apple.asl""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,8,"{""value"":""com.apple.authd""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,9,"{""value"":"".""}"
14,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
14,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,match_index,content
2,<NULL>,2022-08-16 00:32:15.000,199000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.cdscheduler""}"
2,<NULL>,2022-08-16 00:32:15.000,199000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
5,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.install""}"
5,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" sharing output destination ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,2,"{""value"":""/var/log/asl""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,3,"{""value"":"" with ASL Module ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,4,"{""value"":""com.apple.asl""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,6,"{""value"":""com.apple.asl""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,8,"{""value"":""com.apple.authd""}"
8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,9,"{""value"":"".""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" sharing output destination ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,2,"{""value"":""/var/log/system.log""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,3,"{""value"":"" with ASL Module ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,4,"{""value"":""com.apple.asl""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,6,"{""value"":""com.apple.asl""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,8,"{""value"":""com.apple.authd""}"
11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,9,"{""value"":"".""}"
14,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
14,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"

@ -1,2 +1,2 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters  comp  opid  tid  user  item prc reason  req  sid  src  sub vpxa_update  line  file match_index  lro_id  entity  operation  SessionId  SessionSubId 
 2  <NULL> 2022-06-02 11:58:12.376  182 info   0  <NULL>  <NULL>  <NULL> <NULL> e3979f6 45709 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846064 SessionManager vim.SessionManager.sessionIsActive 52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters  comp  opid  tid  user  item prc reason  req  sid  src  sub vpxa_update  line  file match_index  lro_id  entity  operation  SessionId  SessionSubId 
 2  <NULL> 2022-06-02 11:58:12.376  182 info   0  <NULL>  <NULL>  <NULL>  <NULL> <NULL> e3979f6 45709 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846064 SessionManager vim.SessionManager.sessionIsActive 52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866

@ -1,12 +1,12 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters match_index  name 
 2  <NULL> 2022-08-16 00:32:15.000  199000 info   0  <NULL>  <NULL>  <NULL>  0 com.apple.cdscheduler
5 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> 0 com.apple.install
 8  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  0 com.apple.authd 
 8  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  1 com.apple.asl 
8 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> 2 com.apple.asl
8 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> 3 com.apple.authd
 11  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  0 com.apple.authd 
 11  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  1 com.apple.asl 
11 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> 2 com.apple.asl
11 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> 3 com.apple.authd
 14  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  0 com.apple.authd 
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters match_index  name 
 2  <NULL> 2022-08-16 00:32:15.000  199000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  0 com.apple.cdscheduler
5 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 0 com.apple.install
 8  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  0 com.apple.authd 
 8  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  1 com.apple.asl 
8 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 2 com.apple.asl
8 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 3 com.apple.authd
 11  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  0 com.apple.authd 
 11  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  1 com.apple.asl 
11 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 2 com.apple.asl
11 <NULL> 2022-08-16 00:32:15.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 3 com.apple.authd
 14  <NULL> 2022-08-16 00:32:15.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  0 com.apple.authd 

@ -1,4 +1,4 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters match_index user pid cpu_pct mem_pct vsz rss tty stat start_time cpu_time  cmd  cmd_name cmd_args 
0 <NULL> 2022-06-02 00:01:01.000  0 info 0 <NULL> <NULL> <NULL> 1 root 2  0  0  0  0 ? S Jun01 0:00 [kthreadd] [kthreadd] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  1 root  2  0  0  0  0 ?  S  Jun01  0:00  [kthreadd] [kthreadd]  <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  1 root  2  0  0  0  0 ?  S  Jun01  0:00  [kthreadd] [kthreadd]  <NULL> 
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters match_index user pid cpu_pct mem_pct vsz rss tty stat start_time cpu_time  cmd  cmd_name cmd_args 
0 <NULL> 2022-06-02 00:01:01.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 1 root 2  0  0  0  0 ? S Jun01 0:00 [kthreadd] [kthreadd] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  1 root  2  0  0  0  0 ?  S  Jun01  0:00  [kthreadd] [kthreadd]  <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  1 root  2  0  0  0  0 ?  S  Jun01  0:00  [kthreadd] [kthreadd]  <NULL> 

@ -1,24 +1,24 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters match_index user pid cpu_pct mem_pct  vsz rss tty stat start_time cpu_time  cmd  cmd_name  cmd_args 
 0  <NULL> 2022-06-02 00:01:01.000  0 info   0  <NULL>  <NULL>  <NULL>  0 root  1  0  0 158392 7792 ?  Ss  Jun01  0:14  /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd --switched-root --system --deserialize 16
0 <NULL> 2022-06-02 00:01:01.000  0 info 0 <NULL> <NULL> <NULL> 1 root 2  0  0  0  0 ? S Jun01 0:00 [kthreadd] [kthreadd] <NULL>
 0  <NULL> 2022-06-02 00:01:01.000  0 info   0  <NULL>  <NULL>  <NULL>  2 root  3  0  0  0  0 ?  I<  Jun01  0:00  [rcu_gp]  [rcu_gp]  <NULL> 
 0  <NULL> 2022-06-02 00:01:01.000  0 info   0  <NULL>  <NULL>  <NULL>  3 root  4  0  0  0  0 ?  I<  Jun01  0:00  [rcu_par_gp]  [rcu_par_gp]  <NULL> 
0 <NULL> 2022-06-02 00:01:01.000  0 info 0 <NULL> <NULL> <NULL> 4 root 6  0  0  0  0 ? I< Jun01 0:00 [kworker/0:0H-kblockd] [kworker/0:0H-kblockd] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  0 root  1  0  0 158392 7792 ?  Ss  Jun01  0:14  /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd  --switched-root --system --deserialize 16
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  1 root  2  0  0  0  0 ?  S  Jun01  0:00  [kthreadd]  [kthreadd]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  2 root  3  0  0  0  0 ?  I<  Jun01  0:00  [rcu_gp]  [rcu_gp]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> 3 root 4  0  0  0  0 ? I< Jun01 0:00 [rcu_par_gp] [rcu_par_gp] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> 4 root 6  0  0  0  0 ? I< Jun01 0:00 [kworker/0:0H-kblockd] [kworker/0:0H-kblockd] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  5 root  8  0  0  0  0 ?  I<  Jun01  0:00  [mm_percpu_wq]  [mm_percpu_wq]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  6 root  9  0  0  0  0 ?  S  Jun01  0:00  [ksoftirqd/0]  [ksoftirqd/0]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> 7 root 10  0  0  0  0 ? I Jun01 0:23 [rcu_sched] [rcu_sched] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> 8 root 11  0  0  0  0 ? I Jun01 0:00 [rcu_bh] [rcu_bh] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  9 root  12  0  0  0  0 ?  S  Jun01  0:00  [migration/0]  [migration/0]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  10 root  14  0  0  0  0 ?  S  Jun01  0:00  [cpuhp/0]  [cpuhp/0]  <NULL> 
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  0 root  1  0  0 158392 7792 ?  Ss  Jun01  0:14  /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd  --switched-root --system --deserialize 16
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL> <NULL> <NULL> 1 root 2  0  0  0  0 ? S Jun01 0:00 [kthreadd] [kthreadd] <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  2 root  3  0  0  0  0 ?  I<  Jun01  0:00  [rcu_gp]  [rcu_gp]  <NULL> 
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  3 root  4  0  0  0  0 ?  I<  Jun01  0:00  [rcu_par_gp]  [rcu_par_gp]  <NULL> 
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL> <NULL> <NULL> 4 root 6  0  0  0  0 ? I< Jun01 0:00 [kworker/0:0H-kblockd] [kworker/0:0H-kblockd] <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL> <NULL> <NULL> 5 root 8  0  0  0  0 ? I< Jun01 0:00 [mm_percpu_wq] [mm_percpu_wq] <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  6 root  9  0  0  0  0 ?  S  Jun01  0:00  [ksoftirqd/0]  [ksoftirqd/0]  <NULL> 
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters match_index user pid cpu_pct mem_pct  vsz rss tty stat start_time cpu_time  cmd  cmd_name  cmd_args 
 0  <NULL> 2022-06-02 00:01:01.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  0 root  1  0  0 158392 7792 ?  Ss  Jun01  0:14  /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd --switched-root --system --deserialize 16
0 <NULL> 2022-06-02 00:01:01.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 1 root 2  0  0  0  0 ? S Jun01 0:00 [kthreadd] [kthreadd] <NULL>
 0  <NULL> 2022-06-02 00:01:01.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  2 root  3  0  0  0  0 ?  I<  Jun01  0:00  [rcu_gp]  [rcu_gp]  <NULL> 
 0  <NULL> 2022-06-02 00:01:01.000  0 info   0  <NULL>  <NULL>  <NULL>  <NULL>  3 root  4  0  0  0  0 ?  I<  Jun01  0:00  [rcu_par_gp]  [rcu_par_gp]  <NULL> 
0 <NULL> 2022-06-02 00:01:01.000  0 info 0 <NULL> <NULL> <NULL> <NULL> 4 root 6  0  0  0  0 ? I< Jun01 0:00 [kworker/0:0H-kblockd] [kworker/0:0H-kblockd] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  0 root  1  0  0 158392 7792 ?  Ss  Jun01  0:14  /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd  --switched-root --system --deserialize 16
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  1 root  2  0  0  0  0 ?  S  Jun01  0:00  [kthreadd]  [kthreadd]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  2 root  3  0  0  0  0 ?  I<  Jun01  0:00  [rcu_gp]  [rcu_gp]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> <NULL> 3 root 4  0  0  0  0 ? I< Jun01 0:00 [rcu_par_gp] [rcu_par_gp] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> <NULL> 4 root 6  0  0  0  0 ? I< Jun01 0:00 [kworker/0:0H-kblockd] [kworker/0:0H-kblockd] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  5 root  8  0  0  0  0 ?  I<  Jun01  0:00  [mm_percpu_wq]  [mm_percpu_wq]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  6 root  9  0  0  0  0 ?  S  Jun01  0:00  [ksoftirqd/0]  [ksoftirqd/0]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> <NULL> 7 root 10  0  0  0  0 ? I Jun01 0:23 [rcu_sched] [rcu_sched] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL> <NULL> <NULL> <NULL> 8 root 11  0  0  0  0 ? I Jun01 0:00 [rcu_bh] [rcu_bh] <NULL>
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  9 root  12  0  0  0  0 ?  S  Jun01  0:00  [migration/0]  [migration/0]  <NULL> 
 12  <NULL> 2022-06-02 00:02:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  10 root  14  0  0  0  0 ?  S  Jun01  0:00  [cpuhp/0]  [cpuhp/0]  <NULL> 
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  0 root  1  0  0 158392 7792 ?  Ss  Jun01  0:14  /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd  --switched-root --system --deserialize 16
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL> <NULL> <NULL> <NULL> 1 root 2  0  0  0  0 ? S Jun01 0:00 [kthreadd] [kthreadd] <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  2 root  3  0  0  0  0 ?  I<  Jun01  0:00  [rcu_gp]  [rcu_gp]  <NULL> 
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  3 root  4  0  0  0  0 ?  I<  Jun01  0:00  [rcu_par_gp]  [rcu_par_gp]  <NULL> 
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL> <NULL> <NULL> <NULL> 4 root 6  0  0  0  0 ? I< Jun01 0:00 [kworker/0:0H-kblockd] [kworker/0:0H-kblockd] <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL> <NULL> <NULL> <NULL> 5 root 8  0  0  0  0 ? I< Jun01 0:00 [mm_percpu_wq] [mm_percpu_wq] <NULL>
 30  <NULL> 2022-06-02 00:03:01.000  60000 info   0  <NULL>  <NULL>  <NULL>  <NULL>  6 root  9  0  0  0  0 ?  S  Jun01  0:00  [ksoftirqd/0]  [ksoftirqd/0]  <NULL> 

@ -1,6 +1,6 @@
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_filters  comp  opid  tid  user  item prc reason  req  sid  src  sub vpxa_update  line  file match_index  lro_id  entity  operation  SessionId  SessionSubId  log_body 
0 <NULL> 2022-06-02 11:58:12.193  0 info 0 <NULL> <NULL> <NULL> <NULL> 7e1280cf 45715 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro <NULL> <NULL> <NULL> 0 lro-846063 SessionManager vim.SessionManager.sessionIsActive 528e6e0c-246d-58b5-3234-278c6e0c5d0d 52c289ac-2563-48d5-8a8e-f178da022c0d [VpxLRO] -- BEGIN lro-846063 -- SessionManager -- vim.Sessio⋯8b5-3234-278c6e0c5d0d(52c289ac-2563-48d5-8a8e-f178da022c0d)
 2  <NULL> 2022-06-02 11:58:12.376  182 info   0  <NULL>  <NULL>  <NULL> <NULL> e3979f6  45709 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846064 SessionManager  vim.SessionManager.sessionIsActive  52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866 [VpxLRO] -- BEGIN lro-846064 -- SessionManager -- vim.Sessio⋯287-b4e4-344192c6a01d(523e0a4b-6e83-6bcd-9342-22502dd89866)
 4  <NULL> 2022-06-02 11:58:12.623  246 info   0  <NULL>  <NULL>  <NULL> <NULL> l3wrhr4o-cbf-h5:70001034-60 47524 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846066 ChangeLogCollector vim.cdc.ChangeLogCollector.waitForChanges 526861fc-0c28-1930-ae5e-d8c2772bf8c2 52a7a308-9646-c054-f1e7-16131c1a7db6 [VpxLRO] -- BEGIN lro-846066 -- ChangeLogCollector -- vim.c⋯1930-ae5e-d8c2772bf8c2(52a7a308-9646-c054-f1e7-16131c1a7db6) 
 6  <NULL> 2022-06-02 11:58:12.736  113 info   0  <NULL>  <NULL>  <NULL> <NULL> 499b440  48432 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846067 SessionManager  vim.SessionManager.sessionIsActive  521fe9f6-d061-11a2-ac86-badb3c071373 524cba9b-2cc4-9b70-32e4-421452a404d7 [VpxLRO] -- BEGIN lro-846067 -- SessionManager -- vim.Sessio⋯1a2-ac86-badb3c071373(524cba9b-2cc4-9b70-32e4-421452a404d7) 
 8  <NULL> 2022-06-02 11:58:12.740  4 info 0 <NULL> <NULL> <NULL> <NULL> 55a419df 48035 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro <NULL> <NULL> <NULL> 0 lro-846068 SessionManager vim.SessionManager.sessionIsActive 52585600-b0bc-76b1-c4d5-4d7708671c5e 523b68ba-e312-9909-a3ca-39cc86aaf206 [VpxLRO] -- BEGIN lro-846068 -- SessionManager -- vim.Sessio⋯6b1-c4d5-4d7708671c5e(523b68ba-e312-9909-a3ca-39cc86aaf206)
log_line log_part  log_time log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters  comp  opid  tid  user  item prc reason  req  sid  src  sub vpxa_update  line  file match_index  lro_id  entity  operation  SessionId  SessionSubId  log_body 
0 <NULL> 2022-06-02 11:58:12.193  0 info 0 <NULL> <NULL> <NULL> <NULL> <NULL> 7e1280cf 45715 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro <NULL> <NULL> <NULL> 0 lro-846063 SessionManager vim.SessionManager.sessionIsActive 528e6e0c-246d-58b5-3234-278c6e0c5d0d 52c289ac-2563-48d5-8a8e-f178da022c0d [VpxLRO] -- BEGIN lro-846063 -- SessionManager -- vim.Sessio⋯8b5-3234-278c6e0c5d0d(52c289ac-2563-48d5-8a8e-f178da022c0d)
 2  <NULL> 2022-06-02 11:58:12.376  182 info   0  <NULL>  <NULL>  <NULL>  <NULL> <NULL> e3979f6  45709 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846064 SessionManager  vim.SessionManager.sessionIsActive  52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866 [VpxLRO] -- BEGIN lro-846064 -- SessionManager -- vim.Sessio⋯287-b4e4-344192c6a01d(523e0a4b-6e83-6bcd-9342-22502dd89866)
 4  <NULL> 2022-06-02 11:58:12.623  246 info   0  <NULL>  <NULL>  <NULL>  <NULL> <NULL> l3wrhr4o-cbf-h5:70001034-60 47524 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846066 ChangeLogCollector vim.cdc.ChangeLogCollector.waitForChanges 526861fc-0c28-1930-ae5e-d8c2772bf8c2 52a7a308-9646-c054-f1e7-16131c1a7db6 [VpxLRO] -- BEGIN lro-846066 -- ChangeLogCollector -- vim.c⋯1930-ae5e-d8c2772bf8c2(52a7a308-9646-c054-f1e7-16131c1a7db6) 
 6  <NULL> 2022-06-02 11:58:12.736  113 info   0  <NULL>  <NULL>  <NULL>  <NULL> <NULL> 499b440  48432 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro  <NULL> <NULL> <NULL>  0 lro-846067 SessionManager  vim.SessionManager.sessionIsActive  521fe9f6-d061-11a2-ac86-badb3c071373 524cba9b-2cc4-9b70-32e4-421452a404d7 [VpxLRO] -- BEGIN lro-846067 -- SessionManager -- vim.Sessio⋯1a2-ac86-badb3c071373(524cba9b-2cc4-9b70-32e4-421452a404d7) 
 8   <NULL> 2022-06-02 11:58:12.740  4 info 0 <NULL> <NULL> <NULL> <NULL> <NULL> 55a419df 48035 <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro <NULL> <NULL> <NULL> 0 lro-846068 SessionManager vim.SessionManager.sessionIsActive 52585600-b0bc-76b1-c4d5-4d7708671c5e 523b68ba-e312-9909-a3ca-39cc86aaf206 [VpxLRO] -- BEGIN lro-846068 -- SessionManager -- vim.Sessio⋯6b1-c4d5-4d7708671c5e(523b68ba-e312-9909-a3ca-39cc86aaf206)

@ -108,3 +108,8 @@ run_cap_test ${lnav_test} -n -f- \
This is `markdown` now!
EOF
export TEST_ANNO=1
run_cap_test ${lnav_test} -d /tmp/lnav.err -I ${test_dir} -n \
-c ':annotate' \
${test_dir}/logfile_access_log.0

@ -35,10 +35,10 @@ run_test ${lnav_test} -n \
logfile_syslog_test.2
check_output "all_logs does not work?" <<EOF
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,log_msg_format,log_msg_schema
0,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,# is up,aff2bfc3c61e7b86329b83190f0912b3
1,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,# is up,aff2bfc3c61e7b86329b83190f0912b3
2,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,# is down,506560b3c73dee057732e69a3c666718
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_msg_format,log_msg_schema
0,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,# is up,aff2bfc3c61e7b86329b83190f0912b3
1,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,# is up,aff2bfc3c61e7b86329b83190f0912b3
2,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,# is down,506560b3c73dee057732e69a3c666718
EOF
@ -342,12 +342,12 @@ run_test env TZ=UTC ${lnav_test} -n \
${test_dir}/logfile_bro_http.log.0
check_output "bro logs are not recognized?" <<EOF
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types
0,<NULL>,2011-11-03 00:19:26.452,0,info,0,<NULL>,<NULL>,<NULL>,1320279566.452687,CwFs1P2UcUdlSxD2La,192.168.2.76,52026,132.235.215.119,80,1,GET,www.reddit.com,/,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,109978,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Ftw3fJ2JJF3ntMTL2,<NULL>,text/html
1,<NULL>,2011-11-03 00:19:26.831,379,info,0,<NULL>,<NULL>,<NULL>,1320279566.831619,CJxSUgkInyKSHiju1,192.168.2.76,52030,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/E-pbDbmiBclPkDaX.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2300,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FFTf9Zdgk3YkfCKo3,<NULL>,image/jpeg
2,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,1320279566.831563,CJwUi9bdB9c1lLW44,192.168.2.76,52029,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/BP5bQfy4o-C7cF6A.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2272,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FfXtOj3o7aub4vbs2j,<NULL>,image/jpeg
3,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,1320279566.831473,CoX7zA3OJKGUOSCBY2,192.168.2.76,52027,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/SVUtep3Rhg5FTRn4.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2562,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F21Ybs3PTqS6O4Q2Zh,<NULL>,image/jpeg
4,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,1320279566.831643,CT0JIh479jXIGt0Po1,192.168.2.76,52031,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/uuy31444rLSyKdHS.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,1595,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Fdk0MZ1wQmKWAJ4WH4,<NULL>,image/jpeg
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types
0,<NULL>,2011-11-03 00:19:26.452,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.452687,CwFs1P2UcUdlSxD2La,192.168.2.76,52026,132.235.215.119,80,1,GET,www.reddit.com,/,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,109978,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Ftw3fJ2JJF3ntMTL2,<NULL>,text/html
1,<NULL>,2011-11-03 00:19:26.831,379,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831619,CJxSUgkInyKSHiju1,192.168.2.76,52030,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/E-pbDbmiBclPkDaX.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2300,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FFTf9Zdgk3YkfCKo3,<NULL>,image/jpeg
2,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831563,CJwUi9bdB9c1lLW44,192.168.2.76,52029,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/BP5bQfy4o-C7cF6A.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2272,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FfXtOj3o7aub4vbs2j,<NULL>,image/jpeg
3,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831473,CoX7zA3OJKGUOSCBY2,192.168.2.76,52027,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/SVUtep3Rhg5FTRn4.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2562,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F21Ybs3PTqS6O4Q2Zh,<NULL>,image/jpeg
4,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831643,CT0JIh479jXIGt0Po1,192.168.2.76,52031,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/uuy31444rLSyKdHS.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,1595,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Fdk0MZ1wQmKWAJ4WH4,<NULL>,image/jpeg
EOF
run_test env TZ=UTC ${lnav_test} -n \
@ -356,8 +356,8 @@ run_test env TZ=UTC ${lnav_test} -n \
${test_dir}/logfile_bro_http.log.0
check_output "bro logs are not recognized?" <<EOF
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types
118,<NULL>,2011-11-03 00:19:49.337,18,error,0,<NULL>,<NULL>,<NULL>,1320279589.337053,CBHHuR1xFnm5C5CQBc,192.168.2.76,52074,74.125.225.76,80,1,GET,i4.ytimg.com,/vi/gDbg_GeuiSY/hqdefault.jpg,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,893,404,Not Found,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F2GiAw3j1m22R2yIg2,<NULL>,image/jpeg
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types
118,<NULL>,2011-11-03 00:19:49.337,18,error,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279589.337053,CBHHuR1xFnm5C5CQBc,192.168.2.76,52074,74.125.225.76,80,1,GET,i4.ytimg.com,/vi/gDbg_GeuiSY/hqdefault.jpg,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,893,404,Not Found,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F2GiAw3j1m22R2yIg2,<NULL>,image/jpeg
EOF
run_test ${lnav_test} -n \
@ -512,10 +512,10 @@ run_test ${lnav_test} -n \
${test_dir}/logfile_access_log.0
check_output "access_log table is not working" <<EOF
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
0,<NULL>,2009-07-20 22:59:26.000,0,info,0,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/cgi/tramp,gPXE/0.9.7,-,HTTP/1.0,134,200,<NULL>
1,<NULL>,2009-07-20 22:59:29.000,3000,error,0,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>
2,<NULL>,2009-07-20 22:59:29.000,0,info,0,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkernel.gz,gPXE/0.9.7,-,HTTP/1.0,78929,200,<NULL>
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
0,<NULL>,2009-07-20 22:59:26.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/cgi/tramp,gPXE/0.9.7,-,HTTP/1.0,134,200,<NULL>
1,<NULL>,2009-07-20 22:59:29.000,3000,error,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>
2,<NULL>,2009-07-20 22:59:29.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkernel.gz,gPXE/0.9.7,-,HTTP/1.0,78929,200,<NULL>
EOF
@ -525,8 +525,8 @@ run_test ${lnav_test} -n \
${test_dir}/logfile_access_log.0
check_output "loglevel collator is not working" <<EOF
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
1,<NULL>,2009-07-20 22:59:29.000,3000,error,0,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
1,<NULL>,2009-07-20 22:59:29.000,3000,error,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>
EOF
@ -538,11 +538,11 @@ run_test ${lnav_test} -n \
${test_dir}/logfile_syslog.0
check_output "syslog_log table is not working" <<EOF
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version
0,<NULL>,2007-11-03 09:23:38.000,0,error,0,<NULL>,<NULL>,<NULL>,veridian,<NULL>,7998,<NULL>,automount,<NULL>,automount[7998],<NULL>
1,<NULL>,2007-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,veridian,<NULL>,16442,<NULL>,automount,<NULL>,automount[16442],<NULL>
2,<NULL>,2007-11-03 09:23:38.000,0,error,0,<NULL>,<NULL>,<NULL>,veridian,<NULL>,7999,<NULL>,automount,<NULL>,automount[7999],<NULL>
3,<NULL>,2007-11-03 09:47:02.000,1404000,info,0,<NULL>,<NULL>,<NULL>,veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version
0,<NULL>,2007-11-03 09:23:38.000,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,7998,<NULL>,automount,<NULL>,automount[7998],<NULL>
1,<NULL>,2007-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,16442,<NULL>,automount,<NULL>,automount[16442],<NULL>
2,<NULL>,2007-11-03 09:23:38.000,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,7999,<NULL>,automount,<NULL>,automount[7999],<NULL>
3,<NULL>,2007-11-03 09:47:02.000,1404000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>
EOF
@ -833,6 +833,7 @@ check_output "write-json-to isn't working?" <<EOF
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"contextid": "82e87195d704585501",
"data": "http://localhost:8086|/|<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"s2daac0735bf476f4560aab81104b623bedfb0cbc0\" InResponseTo=\"84cbf2be33f6410bbe55877545a93f02\" Version=\"2.0\" IssueInstant=\"2014-06-15T01:04:52Z\" Destination=\"http://localhost:8086/api/1/rest/admin/org/530e42ccd6f45fd16d0d0717/saml/consume\"><saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://openam.vagrant.dev/openam</saml:Issuer><samlp:Status xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\">\\\\n<samlp:StatusCode xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"\\\\nValue=\"urn:oasis:names:tc:SAML:2.0:status:Success\">\\\\n</samlp:StatusCode>\\\\n</samlp:Status><saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"s2a0bee0da937e236167e99b209802056033816ac2\" IssueInstant=\"2014-06-15T01:04:52Z\" Version=\"2.0\">\\\\n<saml:Issuer>http://openam.vagrant.dev/openam</saml:Issuer><ds:Signature xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\\\\n<ds:SignedInfo>\\\\n<ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\\\\n<ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"/>\\\\n<ds:Reference URI=\"#s2a0bee0da937e236167e99b209802056033816ac2\">\\\\n<ds:Transforms>\\\\n<ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"/>\\\\n<ds:Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\\\\n</ds:Transforms>\\\\n<ds:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"/>\\\\n<ds:DigestValue>4uSmVzjovUdQd3px/RcnoxQBsqE=</ds:DigestValue>\\\\n</ds:Reference>\\\\n</ds:SignedInfo>\\\\n<ds:SignatureValue>\\\\nhm/grge36uA6j1OWif2bTcvVTwESjmuJa27NxepW0AiV5YlcsHDl7RAIk6k/CjsSero3bxGbm56m\\\\nYncOEi9F1Tu7dS0bfx+vhm/kKTPgwZctf4GWn4qQwP+KeoZywbNj9ShsYJ+zPKzXwN4xBSuPjMxP\\\\nNf5szzjEWpOndQO/uDs=\\\\n</ds:SignatureValue>\\\\n<ds:KeyInfo>\\\\n<ds:X509Data>\\\\n<ds:X509Certificate>\\\\nMIICQDCCAakCBEeNB0swDQYJKoZIhvcNAQEEBQAwZzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh\\\\nbGlmb3JuaWExFDASBgNVBAcTC1NhbnRhIENsYXJhMQwwCgYDVQQKEwNTdW4xEDAOBgNVBAsTB09w\\\\nZW5TU08xDTALBgNVBAMTBHRlc3QwHhcNMDgwMTE1MTkxOTM5WhcNMTgwMTEyMTkxOTM5WjBnMQsw\\\\nCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxMLU2FudGEgQ2xhcmExDDAK\\\\nBgNVBAoTA1N1bjEQMA4GA1UECxMHT3BlblNTTzENMAsGA1UEAxMEdGVzdDCBnzANBgkqhkiG9w0B\\\\nAQEFAAOBjQAwgYkCgYEArSQc/U75GB2AtKhbGS5piiLkmJzqEsp64rDxbMJ+xDrye0EN/q1U5Of+\\\\nRkDsaN/igkAvV1cuXEgTL6RlafFPcUX7QxDhZBhsYF9pbwtMzi4A4su9hnxIhURebGEmxKW9qJNY\\\\nJs0Vo5+IgjxuEWnjnnVgHTs1+mq5QYTA7E6ZyL8CAwEAATANBgkqhkiG9w0BAQQFAAOBgQB3Pw/U\\\\nQzPKTPTYi9upbFXlrAKMwtFf2OW4yvGWWvlcwcNSZJmTJ8ARvVYOMEVNbsT4OFcfu2/PeYoAdiDA\\\\ncGy/F2Zuj8XJJpuQRSE6PtQqBuDEHjjmOQJ0rV/r8mO1ZCtHRhpZ5zYRjhRC9eCbjx9VrFax0JDC\\\\n/FfwWigmrW0Y0Q==\\\\n</ds:X509Certificate>\\\\n</ds:X509Data>\\\\n</ds:KeyInfo>\\\\n</ds:Signature><saml:Subject>\\\\n<saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\" NameQualifier=\"http://openam.vagrant.dev/openam\">user@example.com</saml:NameID><saml:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\">\\\\n<saml:SubjectConfirmationData InResponseTo=\"84cbf2be33f6410bbe55877545a93f02\" NotOnOrAfter=\"2014-06-15T01:14:52Z\" Recipient=\"http://localhost:8086/api/1/rest/admin/org/530e42ccd6f45fd16d0d0717/saml/consume\"/></saml:SubjectConfirmation>\\\\n</saml:Subject><saml:Conditions NotBefore=\"2014-06-15T00:54:52Z\" NotOnOrAfter=\"2014-06-15T01:14:52Z\">\\\\n<saml:AudienceRestriction>\\\\n<saml:Audience>http://localhost:8086</saml:Audience>\\\\n</saml:AudienceRestriction>\\\\n</saml:Conditions>\\\\n<saml:AuthnStatement AuthnInstant=\"2014-06-15T01:00:25Z\" SessionIndex=\"s2f9b4d4b453d12b40ef3905cc959cdb40579c2301\"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></samlp:Response>",
@ -854,6 +855,7 @@ check_output "write-json-to isn't working?" <<EOF
"log_mark": 0,
"log_comment": null,
"log_tags": null,
"log_annotations": null,
"log_filters": null,
"contextid": "ec5708a7f199678a01",
"data": "vagrant|/",
@ -958,9 +960,9 @@ run_test ${lnav_test} -n -d /tmp/lnav.err \
${test_dir}/logfile_syslog_with_access_log.0
check_output "access_log not found within syslog file" <<EOF
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
1,<NULL>,2015-03-24 14:02:50.000,6927348000,info,0,<NULL>,<NULL>,<NULL>,127.0.0.1,GET,<NULL>,<NULL>,/includes/js/combined-javascript.js,<NULL>,-,HTTP/1.1,65508,200,<NULL>
2,<NULL>,2015-03-24 14:02:50.000,0,error,0,<NULL>,<NULL>,<NULL>,127.0.0.1,GET,<NULL>,<NULL>,/bad.foo,<NULL>,-,HTTP/1.1,65508,404,<NULL>
log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
1,<NULL>,2015-03-24 14:02:50.000,6927348000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,127.0.0.1,GET,<NULL>,<NULL>,/includes/js/combined-javascript.js,<NULL>,-,HTTP/1.1,65508,200,<NULL>
2,<NULL>,2015-03-24 14:02:50.000,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,127.0.0.1,GET,<NULL>,<NULL>,/bad.foo,<NULL>,-,HTTP/1.1,65508,404,<NULL>
EOF

@ -51,3 +51,5 @@ run_cap_test ./drive_sql "select joinpath('foo')"
run_cap_test ./drive_sql "select joinpath('foo', 'bar', 'baz')"
run_cap_test ./drive_sql "select joinpath('foo', 'bar', 'baz', '/root')"
run_cap_test ${lnav_test} -n -c ";SELECT shell_exec('echo hi')"

Loading…
Cancel
Save