On Tue, Feb 24, 2015 at 4:50 AM, Stefan G. Weichinger <li...@xunil.at> wrote: > Am 24.02.2015 um 03:14 schrieb Canek Peláez Valdés: > >> Stefan, if you already have systemd (which I believe you do), why don't you >> compile in the support for microhttpd and use the journal? This is the >> exact scenario for which systemd-journal-gatewayd[1] was written. > > very good ... enabled it on one of my machines, looks good. > > I am unsure if it will be possible to see only postfix.service (easier)
I suspect this is trivial - it looks like something like this would work: http://.../entries?_SYSTEMD_UNIT=postfix.service (note, you might need to tweak that - I haven't used the http gateway personally and am going from the manpage) > AND only the lines relevant for the domain of the specific customer by > doing this? I think you're going to be stuck here unless they come from different machines or something like that. Obviously you can pipe the output through grep but journald will only pre-filter the output using journal fields, like facility, priority, etc. syslog only provided a few fields for clients to specify, and this is probably because in the end the data just got dumped to a text file so that it wasn't searchable by field anyway. It would be nice if they extended the syslog protocol for systemd and made it possible for clients to specify additional fields, but obviously the client would need to support this (likely sending logs over dbus or such). The http gateway seems like it is intended more as a transport mechanism with some usability for ad-hoc human viewing. It isn't a full-fledged log analysis tool. The fact that journald can output in JSON with uuids for each entry should make it far easier to parse its logs with an analysis tool, but I think all those vendors are playing catch-up. I suspect they'll support it fairly soon once they see everybody using it. From a machine parsing standpoint the fielded binary format makes a lot more sense. -- Rich
