Linux – Forward systemd journal messages/Collect systemd journal messages

arch-linuxjournaldlinuxsystemd

How can I collect systemd journal events (pull) or forward systemd journal events (push)?

I want to have something like forwarded event log (http://windows.tips.net/T012878_What_is_the_Purpose_of_the_Forwarded_Events_Event_Log.html) but under Linux.

I'm using ArchLinux but not sure this matters.

Should I forward journal to syslog and then collect syslog? Will I loose any info by doing so? Can I collect journal messages without syslog daemon?

Best Answer

Forwarding messages to legacy software like syslog gives you nothing but overhead.

Instead you can implement both models using native journald features.

Push model:

(log source) systemd-journal-upload -> systemd-journal-remote (log collector)

Pull model:

(log source) systemd-journal-gatewayd <- systemd-journal-remote (log collector)

The arrow shows who initiates the connection. HTTPS is used as a transport so it's secure.

The more information can be obtained from:

http://www.freedesktop.org/software/systemd/man/systemd-journal-remote.html

http://www.freedesktop.org/software/systemd/man/systemd-journal-upload.html

and so on.

Related Topic