I have a log processing tool that takes lines in stdin and does some sort of processing that I need. Currently my application does log rotation so that it archives log file according to certain schedule and I have a simple cron script that periodically checks for a new gzipped log file, feeds it to my processing tool and then deletes it.

The problem I'm now facing is that now I have a systemd unit that too emits log lines in systemd journal.

As far as I can see I can have similar approach - I can put up a cron script that would get journalctl logs for my units, and feed the lines up to a last cursor record to my tool - something like the following:

journalctl -u myunit -o cat --show-cursor -c "previously-recorded-cursor-value"

I am pretty certain that I came across some sort of existing tool some time ago that allows to do the same - take last update from journalctl, record the state, feed the lines into tool of your choice. Unfortunately my recent searches of that tool were in vain, does anybody know if such capability exists as a part of systemd installation or as some optional helper tool?

I know that journalctl has an API, but using that, perhaps, would be the least convenient option to use as all I need is a script that records cursor state and talks to journalctl in a way shown above. In a pinch, I'll write another unit that provides functionality for the above - I'm thinking of a bash script that gets invoked periodically by cron and pulls the logs as shown above and feeds log chunk to the tool of my choice.

  • You can use journalctl -f to permanently tail the journal and pipe it to your program. Or if you are running rsyslogd you can have it match lines from your Unit and send them to a file or a program. – meuh May 18 at 8:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.