1SYSTEMD-JOURNAL-REMOTE(8) systemd-journal-remote SYSTEMD-JOURNAL-REMOTE(8)
2
6 systemd-journal-remote - Receive journal messages over the network
7
9 systemd-journal-remote [OPTIONS...] [-o/--output=DIR|FILE] [SOURCES...]
10
12 systemd-journal-remote is a command to receive serialized journal
13 events and store them to the journal. Input streams are in the Journal
14 Export Format[1], i.e. like the output from journalctl --output=export.
15 For transport over the network, this serialized stream is usually
16 carried over an HTTPS connection.
17
19 Sources can be either "active" (systemd-journal-remote requests and
20 pulls the data), or "passive" (systemd-journal-remote waits for a
21 connection and then receives events pushed by the other side).
22 systemd-journal-remote can read more than one event stream at a time.
24 They will be interleaved in the output file. In case of "active"
25 connections, each "source" is one stream, and in case of "passive"
26 connections, each connection can result in a separate stream. Sockets
27 can be configured in "accept" mode (i.e. only one connection), or
28 "listen" mode (i.e. multiple connections, each resulting in a stream).
29 When there are no more connections, and no more can be created (there
31 are no listening sockets), then systemd-journal-remote will exit.
32 Active sources can be specified in the following ways:
34 When - is given as a positional argument, events will be read from
36 standard input. Other positional arguments will be treated as
37 filenames to open and read from.
38 --url=ADDRESS
40 With the --url=ADDRESS option, events will be retrieved using HTTP
41 from ADDRESS. This URL should refer to the root of a remote
42 systemd-journal-gatewayd(8) instance (e.g. http://some.host:19531/
43 or https://some.host:19531/).
44 Passive sources can be specified in the following ways:
46 --listen-raw=ADDRESS
48 ADDRESS must be an address suitable for ListenStream= (cf.
49 systemd.socket(5)). systemd-journal-remote will listen on this
50 socket for connections. Each connection is expected to be a stream
51 of journal events.
52 --listen-http=ADDRESS, --listen-https=ADDRESS
54 ADDRESS must be either a negative integer, in which case it will be
55 interpreted as the (negated) file descriptor number, or an address
56 suitable for ListenStream= (c.f. systemd.socket(5)). In the first
57 case, matching file descriptor must be inherited through
58 $LISTEN_FDS/$LISTEN_PID. In the second case, an HTTP or HTTPS
59 server will be spawned on this port, respectively for --listen-http
60 and --listen-https. Currenntly, only POST requests to /upload with
61 "Content-Type: application/vnd.fdo.journal" are supported.
62 $LISTEN_FDS
64 systemd-journal-remote supports the $LISTEN_FDS/$LISTEN_PID
65 protocol. Open sockets inherited through socket activation behave
66 like those opened with --listen-raw= described above, unless they
67 are specified as an argument in --listen-http=-n or
68 --listen-https=-n above. In the latter case, an HTTP or HTTPS
69 server will be spawned using this descriptor and connections must
70 be made over the HTTP protocol.
71
73 The location of the output journal can be specified with -o or
74 --output=. For "active" sources, this option is required.
75 --output=FILE
77 Will write to this journal file. The filename must end with
78 .journal. The file will be created if it does not exist. If
79 necessary (journal file full, or corrupted), the file will be
80 renamed following normal journald rules and a new journal file will
81 be created in its stead.
82 --output=DIR
84 Will create journal files underneath directory DIR. The directory
85 must exist. If necessary (journal files over size, or corrupted),
86 journal files will be rotated following normal journald rules.
87 Names of files underneath DIR will be generated using the rules
88 described below.
89 If --output= is not used, the output directory /var/log/journal/remote/
91 will be used. In case the output file is not specified, journal files
92 will be created underneath the selected directory. Files will be called
93 remote-hostname.journal, where the hostname part is the escaped
94 hostname of the source endpoint of the connection, or the numerical
95 address if the hostname cannot be determined.
96 In case of "active" sources, the output file name must always be given
98 explicitly.
99
101 The following options are understood:
102 --split-mode
104 One of none or host. For the first, only one output journal file is
105 used. For the latter, a separate output file is used, based on the
106 hostname of the other endpoint of a connection.
107 In case of "active" sources, the output file name must always be
109 given explicitly and only none is allowed.
110 --compress, --no-compress
112 Compress or not, respectively, the data in the journal using XZ.
113 --seal, --no-seal
115 Periodically sign or not, respectively, the data in the journal
116 using Forward Secure Sealing.
117 --getter=PROG --option1 --option2
119 Program to invoke to retrieve data. The journal event stream must
120 be generated on standard output.
121 Examples:
123 --getter='curl "-HAccept: application/vnd.fdo.journal" https://some.host:19531/'
125 --getter='wget --header="Accept: application/vnd.fdo.journal" -O- https://some.host:19531/'
127 -h, --help
129 Print a short help text and exit.
130 --version
132 Print a short version string and exit.
133
135 Copy local journal events to a different journal directory:
136 journalctl -o export | systemd-journal-remote -o /tmp/dir -
138 Retrieve events from a remote systemd-journal-gatewayd(8) instance and
141 store them in /var/log/journal/some.host/remote-some~host.journal:
142 systemd-journal-remote --url http://some.host:19531/
144
148 systemd-journal-upload(8), journalctl(1), systemd-journald.service(8),
149 systemd-journal-gatewayd.service(8)journal-remote.conf(5)
150
152 1. Journal Export Format
153 http://www.freedesktop.org/wiki/Software/systemd/export
154 2. http://some.host:19531/
156 3. https://some.host:19531/
158systemd 219 SYSTEMD-JOURNAL-REMOTE(8)