(C) Alexander Koch
Journalcheck aims at being a simple replacement for
logcheck when using journald for system logs. It calls
journalctl to obtain all messages that have been recorded since its last
invocation, pipes the output through egrep with a given set of filters, and
passes the remaining messages to stdout. Journalcheck therefore works with
volatile system logs as well.
- systemd (
journalctl) - coreutils (
split) - grep (
egrep)
Journalcheck is best run as regular user account (no need for root privileges!).
As root: add the user account to the group 'systemd-journal', in order to authorize it to read all logs:
usermod -a -G systemd-journal UserAccountName
Then add to your crontab a line invoking journalcheck:
MAILTO=UserAccountName@localhost
# m h dom mon dow command
*/30 * * * * journalcheck
With a local MTA/MDA set up correctly, you will then receive by mail all log entries not matching the white-list. In addition to the ones shipped with journalcheck, it looks in ~/.journalcheck.d for user-defined filters.
For cron-less systems making use of systemd .timer units instead, there are example units in example. They rely on checkrun.sh for mail functionality.
Journalcheck is configurable through the following environment variables (default values in brackets):
JC_FILTERS_GLOBAL(/usr/lib/journalcheck): Directory for system-wide filtersJC_FILTERS_USER(~/.journalcheck.d): Directory for user-defined filtersJC_CURSOR_FILE(~/.journalcheck.cursor): Last run timestamp fileJC_NUM_THREADS(no. of logical CPUs): Number of worker threads to spawnJC_LOGLEVEL(0..5): Priority (loglevel) filter
As I only have a limited set of machines and applications running to derive filters from, I rely heavily on contributions in order to provide a universal filter set. Pull requests are welcome!
Journalcheck is released under the terms of the MIT License, see LICENSE file.