journalcheck: logcheck for journald

Posted on Wed 17 June 2015

Regarding day-to-day housekeeping of Linux systems, I'd consider log monitoring one of the most important things to do - not just as a sysadmin.

Of course you don't want to do this manually but rather use tools like logcheck for this task. They watch system logs, check entries agains a whitelist and mail you all the lines that don't match.

For me this has worked for many years, but when it came to systemd and volatile logs via journald it doesn't work anymore.

Enter a new project: journalcheck

journalcheck uses journalctl to grab system logs and egrep to match against a set of whitelist filters provided as plain files. Written in Bash, very simple but does the job.

tags: bash, coding, projects, systemd, journald, linux | category: projects