Sounds like you want a siem like Wazuh. Its agent can collect journald logs from any number of systems. It also has a gui you can interact with to parse logs.
this post was submitted on 21 Nov 2024
12 points (92.9% liked)
Linux
48287 readers
636 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
tbh my go to command is just.. journalctl -fe -u service
ex :
journalctl -fe -u jellyfin
journalctl -fe -u nordvpnd
so I'd also like to know the answer to this question. my other go to is dumping journalctl to text files and parsing with grep and awk and creating my own reports with that parsed information.
I don't know of any graphical tools that let you do this, but generally, if you want to search for specific terms/times/commands or anything of that sort, piping journalctl into grep (and optionally grep into less) is pretty effective at finding stuff.
I sometimes pipe journalctl into lnav, but it never works quite as well as i really want...
lnav is pretty cool and does mostly what you are describing.
uuhhh maybe here? https://lnav.org/
I wish there was something nice like that too.
In the server world that would usually involve doing something like sending the journal data to Elasticsearch using an Elasticsearch integration. But that involves setting up an Elasticsearch server and Kibana and so on which is very unwieldy for a desktop computer. It does work pretty well though in terms of filtering. But it also stores the data internally in indexes to speed up search.
Of course journald has a seemingly simple C API but writing code is a lot of work. There are probably API bindings for various languages.
If you are on gnome,.gnome logs do most of the things you want (if I recall correctly, some years since I run gnome)