1

I have been using monit for some time. One of the checks I had was to make sure that my mail server wasn't being abused. I use milter-limit to limit the rate of sending - and it logs to syslog. Prior to bookworm, I was able to have it scan the syslog file for specific content. I have not seen anything that allows me to do that with the systemd journal - is there a way?

Investigating, it seems that logcheck or journalcheck could be used to create a script for monit to run and check the output but maybe I am missing an easier option?

2 Answers 2

2

If you need text logs, install a traditional syslog daemon – both syslog-ng and rsyslog can be configured to pull messages from the systemd journal (in two different ways, even) and from there you can operate as before.

With syslog-ng this is part of the default configuration; Debian's standard rsyslog also has set up the 'imjournal' input module by default, and it's how older Debian versions used to provide both log formats at once.

(Both of the aforementioned programs read messages from .journal files, so they can filter by journal metadata like unit name; you don't need to enable ForwardToSyslog for them to work.)

You can also roll a custom .service that just does a journalctl --follow > system.log (perhaps with -u or other filter options) but this won't have log rotation, etc., so it's only there as a "zero dependencies DIY" option.

A periodic command-based "journalctl | grep" check isn't actually a bad option – it might not be as performant as with plain text files, but journalctl does explicitly support restarting from last checkpoint using --cursor-file=; I use this to have cron email me all error (-p err) messages hourly/daily.

journalctl -u postfix -t postfix/anvil --cursor-file=/var/lib/monit_postfix_cursor
1
  • Some good info here to add to the to-do list, possibly for enhancing monit to remote servers. Using the cursor file and grepping for the phrase I think is the way to go. I have a script already that runs an sql command and returns an exit code based on the results. I should be able to do the same for this monitoring as well.
    – Bryan
    Commented Jul 26 at 17:22
2

The Systemd journal is not a text file, but consists of several binary files. Therefore, Monit cannot search the files for messages.

maybe I am missing an easier option?

A script to export/analyse the Systemd Journal is currently the only way to do this. Lutz

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .