systemd-journal-remote

Index · Directives · Python · libudev · gudev systemd 215

## Name

systemd-journal-remote — Stream journal messages over the network

## Synopsis

`systemd-journal-remote` [OPTIONS...] [-o/--output=DIR|FILE] [SOURCES...]

## Description

`systemd-journal-remote` is a command to receive serialized journal events and store them to the journal. Input streams must be in the Journal Export Format , i.e. like the output from journalctl --output=export.

## Sources

Sources can be either "active" (systemd-journal-remote requests and pulls the data), or "passive" (systemd-journal-remote waits for a connection and then receives events pushed by the other side).

systemd-journal-remote can read more than one event stream at a time. They will be interleaved in the output file. In case of "active" connections, each "source" is one stream, and in case of "passive" connections, each connection can result in a separate stream. Sockets can be configured in "accept" mode (i.e. only one connection), or "listen" mode (i.e. multiple connections, each resulting in a stream).

When there are no more connections, and no more can be created (there are no listening sockets), then systemd-journal-remote will exit.

Active sources can be specified in the following ways:

  When `-` is given as a positional argument, events will be read from standard input. Other positional arguments will be treated as filenames to open and read from.

`--url=`ADDRESS``

  With the `--url=`ADDRESS`` option, events will be retrieved using HTTP from `ADDRESS`. This URL should refer to the root of a remote systemd-journal-gatewayd(8) instance (e.g. http://some.host:19531/ or https://some.host:19531/).

Passive sources can be specified in the following ways:

`--listen-raw=`ADDRESS``

  `ADDRESS` must be an address suitable for `ListenStream=` (cf. systemd.socket(5)). systemd-journal-remote will listen on this socket for connections. Each connection is expected to be a stream of journal events.

`--listen-http=`ADDRESS``, `--listen-https=`ADDRESS``

  `ADDRESS` must be either a negative integer, in which case it will be interpreted as the (negated) file descriptor number, or an address suitable for `ListenStream=` (c.f. systemd.socket(5)). In the first case, matching file descriptor must be inherited through `$LISTEN_FDS`/`$LISTEN_PID`. In the second case, an HTTP or HTTPS server will be spawned on this port, respectively for `--listen-http` and `--listen-https`. Currenntly, only POST requests to `/upload` with "`Content-Type: application/vnd.fdo.journal`" are supported.

`$LISTEN_FDS`

  systemd-journal-remote supports the `$LISTEN_FDS`/`$LISTEN_PID` protocol. Open sockets inherited through socket activation behave like those opened with `--listen-raw=` described above, unless they are specified as an argument in `--listen-http=-`n`` or `--listen-https=-`n`` above. In the latter case, an HTTP or HTTPS server will be spawned using this descriptor and connections must be made over the HTTP protocol.

## Sinks

The location of the output journal can be specified with `-o` or `--output=`.

`--output=`FILE``

  Will write to this journal. The filename must end with `.journal`. The file will be created if it does not exist. If necessary (journal file full, or corrupted), the file will be renamed following normal journald rules and a new journal file will be created in its stead.

`--output=`DIR``

  Will create journal files underneath directory `DIR`. The directory must exist. If necessary (journal files over size, or corrupted), journal files will be rotated following normal journald rules. Names of files underneath `DIR` will be generated using the rules described below.

If `--output=` is not used, the output directory `/var/log/journal/`machine-id`/` will be used, where `machine-id` is the identifier of the current system (see machine-id(5)). In case the output file is not specified, journal files will be created underneath the selected directory. Files will be called `remote-`variable`.journal`, where the `variable` part is generated based on what passive and active sources are specified. It is recommended to give a full output filename.

In case of "active" sources, if the hostname is known, it will be used in the `variable` part. Otherwise, local address and port number will be used, or "`stdin`" for events passed over standard input, and "`multiple`" if more than one source is specified.

## Options

The following options are understood:

`--help`, `-h`

  Print a short help text and exit.

`--version`

  Print a short version string and exit.

`--compress`, `--no-compress`

  Compress or not, respectively, the data in the journal using XZ.

`--seal`, `--no-seal`

  Periodically sign or not, respectively, the data in the journal using Forward Secure Sealing.

`--getter=`PROG --option1 --option2``

  Program to invoke to retrieve data. The journal event stream must be generated on standard output.

  Examples:

      --getter='curl "-HAccept: application/vnd.fdo.journal" https://some.host:19531/'

      --getter='wget --header="Accept: application/vnd.fdo.journal" -O- https://some.host:19531/'

## Examples

Copy local journal events to a different journal directory:

    journalctl -o export | systemd-journal-remote -o /tmp/dir -

Retrieve events from a remote systemd-journal-gatewayd(8) instance and store them in `/var/log/journal/some.host/remote-some~host.journal`:

    systemd-journal-remote --url http://some.host:19531/

## See Also

journalctl(1), systemd-journald.service(8), systemd-journal-gatewayd.service(8).