Re: Filtering all systemd user service logs

Hi Thomas,

On Fri, Apr 29, 2022 at 11:31:22AM +0200, Thomas Preisner wrote:
> So far, I've been using the following source configuration:
> 
> source src
> {
>     internal();
>     system();
>     udp();
>     udp6();
> };

Usually on debian, the system() source resolves to some scl magic including
systemd-journal() source driver. This one should collect systemd macros,
resulting in things like the following:

   "_SYSTEMD_UNIT":"xinetd.service","_SYSTEMD_SLICE":"system.slice","_SYSTEMD_CGROUP":"/system.slice/xinetd.service","_SOURCE_REALTIME_TIMESTAMP":"1651475094855675"

Although I haven't checked, I guess there is a field holding the information
wether or not it's a user or system service. You can check that either using
syslog-ng and outputting everything as json, or using journald:

    journalctl -f -o json

If you find a macro that would let you separate the user from the system
journal messages, you can then simply use a filter, of an if-else block.

Fabien

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq