From 74a19d9d7d850851990e126086f28494d64fd824 Mon Sep 17 00:00:00 2001 From: David Lamparter Date: Thu, 1 Sep 2022 11:33:50 +0200 Subject: [PATCH] extras: allow options in journal export block Can't currently put options on captured log messages... (Also adding a nanosecond timestamp in the next commit.) --- draft-richardson-opsawg-pcapng-extras.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/draft-richardson-opsawg-pcapng-extras.md b/draft-richardson-opsawg-pcapng-extras.md index 0f8391c..9543ffc 100644 --- a/draft-richardson-opsawg-pcapng-extras.md +++ b/draft-richardson-opsawg-pcapng-extras.md @@ -137,6 +137,10 @@ Journal Export Block. / variable length, padded to 32 bits / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + n / / + / Options (variable) / + / / + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~~~~ @@ -159,6 +163,24 @@ The systemd Journal Export Block has the following fields: (trailing newline) as described in the Journal Export Format specification + If the block contains options, there MUST be at least one byte of + zero padding present to mark the end of the journal entry. This + only makes a difference if the journal entry is a multiple of four + octets long, in this case 4 bytes of zero padding MUST be appended. + Blocks without options do not contain any zero padding if the journal + entry is a multiple of 4 octets long, therefore readers MUST NOT + rely on the presence of a zero byte to terminate the entry. + + +TBD: fix cross-reference (section_opt) + +* Options: optionally, a list of options (formatted according to + the rules defined in Xsection_optX) can be present. + + +The options defined in Xsection_optX are valid within this block. +There are currently no additional options definied for Journal Export +Blocks. ## Alternative Packet Blocks (experimental)