[systemd-devel] Store journal logs to different journals(location) based on Filters

[P.R.Dinesh]

Is it possible to store journal logs matching specific filters to different
journal files in addition to the main journal using some journald
configurations?


For eg.,  All journal logs of severity critical and above should be stored
in /var/log/critical/critial.journal in addition to the main journal.



Currently I am achieving this via combination of systemd-journal-remote and
journalctl as below

ExecStart=/lib/systemd/systemd-journal-remote
 --output=/var/log/critical/critical.journal --getter="journalctl -f
PRIORITY=3 -o export"

In this approach, I have the following disadvantages
1) For each filter output combination, I need to create additional service
2) Somethings we miss few logs, couldnt root cause it yet.
3) Also I not sure whether this would be a better  compared to the
systemd-journald directly storing them in different journal files.



Hence, I prefer a systemd-journald configuration like following

TargetFilter1="PRIORITY=2"
TargetDestination1="/var/log/critical.journal"

TargetFilter2="_UNIT=CPROCESSOR"
TargetDestination2="/var/log/cprocessor.journal"

which will store those logs matching the filters to the corresponding
destination.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20170920/426f8f64/attachment.html>