If you need text logs, install a traditional syslog daemon – both syslog-ng and rsyslog can be configured to pull messages from the systemd journal (in two different ways, even) and from there you can operate as before.
With syslog-ng this is part of the default configuration; Debian's standard rsyslog also has set up the 'imjournal' input module by default, and it's how older Debian versions used to provide both log formats at once.
(Both of the aforementioned programs read messages from .journal files, so they can filter by journal metadata like unit name; you don't need to enable ForwardToSyslog for them to work.)
You can also roll a custom .service that just does a journalctl --follow > system.log
(perhaps with -u
or other filter options) but this won't have log rotation, etc., so it's only there as a "zero dependencies DIY" option.
A periodic command-based "journalctl | grep" check isn't actually a bad option – it might not be as performant as with plain text files, but journalctl does explicitly support restarting from last checkpoint using --cursor-file=
; I use this to have cron email me all error (-p err
) messages hourly/daily.
journalctl -u postfix -t postfix/anvil --cursor-file=/var/lib/monit_postfix_cursor