sdjournal1

Usage

Overview

sdjournal is an extcap tool that allows one to capture systemd journal entries. It can be used to correlate system events with network traffic.

Supported interfaces:

Options

--help

Print program arguments.

--version

Print program version.

--extcap-interfaces

List available interfaces.

--extcap-interface=<interface>

Use specified interfaces.

--extcap-dlts

List DLTs of specified interface.

--extcap-config

List configuration options of specified interface.

--capture

Start capturing from specified interface and write raw packet data to the location specified by --fifo.

--fifo=<path to file or pipe>

--start-from=<entry count>

Examples

To see program arguments:

sdjournal --help

To see program version:

sdjournal --version

To see interfaces:

sdjournal --extcap-interfaces

Only one interface (sdjournal) is supported.

Example output

interface {value=sdjournal}{display=systemd journal capture}

To see interface DLTs:

sdjournal --extcap-interface=sdjournal --extcap-dlts

Example output

dlt {number=147}{name=sdjournal}{display=USER0}

To see interface configuration options:

sdjournal --extcap-interface=sdjournal --extcap-config

Example output

arg {number=0}{call=--start-from}{display=Starting position}{type=string}
    {tooltip=The journal starting position. Values with a leading "+" start from the beginning, similar to the "tail" command}

To capture:

sdjournal --extcap-interface=sdjournal --fifo=/tmp/sdjournal.pcap --capture

To capture all entries since the system was booted:

sdjournal --extcap-interface=sdjournal --fifo=/tmp/sdjournal.pcap --capture --start-from +0

Notes

sdjournal is part of the Wireshark distribution. The latest version of Wireshark can be found at <https://www.wireshark.org>.

HTML versions of the Wireshark project man pages are available at <https://www.wireshark.org/docs/man-pages>.