# dtFabric format specification.
---
name: systemd_journal
type: format
description: Systemd journal file format
urls: ["https://github.com/libyal/dtformats/blob/main/documentation/Systemd%20journal%20file%20format.asciidoc"]
---
name: byte
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint8
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
  units: bytes
---
name: uint32le
type: integer
attributes:
  byte_order: little-endian
  format: unsigned
  size: 4
  units: bytes
---
name: uint64
type: integer
attributes:
  format: unsigned
  size: 8
  units: bytes
---
name: systemd_journal_file_header
type: structure
attributes:
  byte_order: little-endian
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 8
  value: "LPKSHHRH"
- name: compatible_flags
  data_type: uint32
- name: incompatible_flags
  data_type: uint32
- name: state
  data_type: uint8
- name: reserved1
  type: stream
  element_data_type: byte
  elements_data_size: 7
- name: file_identifier
  type: stream
  element_data_type: byte
  elements_data_size: 16
- name: machine_identifier
  type: stream
  element_data_type: byte
  elements_data_size: 16
- name: boot_identifier
  type: stream
  element_data_type: byte
  elements_data_size: 16
- name: sequence_number_identifier
  type: stream
  element_data_type: byte
  elements_data_size: 16
- name: header_size
  data_type: uint64
- name: arena_size
  data_type: uint64
- name: data_hash_table_offset
  data_type: uint64
- name: data_hash_table_size
  data_type: uint64
- name: field_hash_table_offset
  data_type: uint64
- name: field_hash_table_size
  data_type: uint64
- name: tail_object_offset
  data_type: uint64
- name: number_of_objects
  data_type: uint64
- name: number_of_entry_objects
  data_type: uint64
- name: tail_entry_sequence_number
  data_type: uint64
- name: head_entry_sequence_number
  data_type: uint64
- name: entry_array_offset
  data_type: uint64
- name: head_entry_real_time
  data_type: uint64
- name: tail_entry_real_time
  data_type: uint64
- name: tail_entry_monotonic
  data_type: uint64
---
name: systemd_journal_data_object
type: structure
attributes:
  byte_order: little-endian
members:
- name: object_type
  data_type: uint8
- name: object_flags
  data_type: uint8
- name: reserved1
  type: stream
  element_data_type: byte
  elements_data_size: 6
- name: data_size
  data_type: uint64
- name: hash
  data_type: uint64
- name: next_hash_offset
  data_type: uint64
- name: next_field_offset
  data_type: uint64
- name: entry_offset
  data_type: uint64
- name: entry_array_offset
  data_type: uint64
- name: number_of_entries
  data_type: uint64
---
name: systemd_journal_data_object_compact
type: structure
attributes:
  byte_order: little-endian
members:
- name: object_type
  data_type: uint8
- name: object_flags
  data_type: uint8
- name: reserved1
  type: stream
  element_data_type: byte
  elements_data_size: 6
- name: data_size
  data_type: uint64
- name: hash
  data_type: uint64
- name: next_hash_offset
  data_type: uint64
- name: next_field_offset
  data_type: uint64
- name: entry_offset
  data_type: uint64
- name: entry_array_offset
  data_type: uint64
- name: number_of_entries
  data_type: uint64
- name: tail_entry_array_offset
  data_type: uint32
- name: tail_entry_array_n_entries
  data_type: uint32
---
name: systemd_journal_entry_item
type: structure
attributes:
  byte_order: little-endian
members:
- name: object_offset
  data_type: uint64
- name: hash
  data_type: uint64
---
name: systemd_journal_entry_item_compact
type: structure
attributes:
  byte_order: little-endian
members:
- name: object_offset
  data_type: uint32
---
name: systemd_journal_entry_object
type: structure
attributes:
  byte_order: little-endian
members:
- name: object_type
  data_type: uint8
- name: object_flags
  data_type: uint8
- name: reserved1
  type: stream
  element_data_type: byte
  elements_data_size: 6
- name: data_size
  data_type: uint64
- name: sequence_number
  data_type: uint64
- name: real_time
  data_type: uint64
- name: monotonic
  data_type: uint64
- name: boot_identifier
  type: stream
  element_data_type: byte
  elements_data_size: 16
- name: xor_hash
  data_type: uint64
---
name: systemd_journal_entry_array_object
type: structure
attributes:
  byte_order: little-endian
members:
- name: object_type
  data_type: uint8
- name: object_flags
  data_type: uint8
- name: reserved1
  type: stream
  element_data_type: byte
  elements_data_size: 6
- name: data_size
  data_type: uint64
- name: next_entry_array_offset
  data_type: uint64
- name: entry_object_offsets
  type: sequence
  element_data_type: uint64
  elements_data_size: systemd_journal_entry_array_object.data_size - 24
---
name: systemd_journal_entry_array_object_compact
type: structure
attributes:
  byte_order: little-endian
members:
- name: object_type
  data_type: uint8
- name: object_flags
  data_type: uint8
- name: reserved1
  type: stream
  element_data_type: byte
  elements_data_size: 6
- name: data_size
  data_type: uint64
- name: next_entry_array_offset
  data_type: uint64
- name: entry_object_offsets
  type: sequence
  element_data_type: uint32
  elements_data_size: systemd_journal_entry_array_object_compact.data_size - 24
