2

journald writes binary log files; and their format is explicitly subject to change.

The Journald Reference Guide tells us, quote:

While it can be useful to get used to journalctl to read logs, it’s by no means mandatory.

So, how can we read these files? Is there a journald reading API I missed? I couldn't find any yet.

foo
  • 1,968
  • 1
  • 23
  • 35
  • I did. With variations. Up came APIs for *writing*. That's why I finally decided to ask here. – foo May 25 '22 at 18:11

2 Answers2

2

Systemd (and journald) are written in C. They come with sd-journal.h header file and with C-API https://www.freedesktop.org/software/systemd/man/sd_journal_next.html# - sd_journal_open allows you to open logs and then read from them.

Other languages - https://www.freedesktop.org/software/systemd/python-systemd/journal.html#example-polling-for-journal-events https://github.com/nyantec/rust-journald - most probably build on top of the C api.

Moreover, journald is open source - https://github.com/systemd/systemd/blob/968680b23d1629d33deeea98b4f2b5fd106075b5/src/libsystemd/sd-journal/sd-journal.c#L1916 - and the file format is documented - https://www.freedesktop.org/wiki/Software/systemd/journal-files/ . You can re-implement your own API on top of system-specific I/O operations to read journal files.

KamilCuk
  • 120,984
  • 8
  • 59
  • 111
  • Thank you for the helpful links. The last item, though, I don't think is correct. Accessing the files directly / file format interpretation is discouraged; see https://www.freedesktop.org/wiki/Software/systemd/journal-files/ which I reached via the links above. – foo May 25 '22 at 22:33
  • `I don't think is correct` What is not correct in it? `is discouraged` that does not mean it is false. – KamilCuk May 25 '22 at 22:36
  • One *can* implement access code on top of direct file-I/O. But the strong recommendation not to do so is from the same (authoritative?) source you linked to. The API access you explained first should be safe, the file access not. – foo May 25 '22 at 22:44
0

Update: https://github.com/meta-bit/jjournal does the job for me, Java API for the purpose.

HTH

foo
  • 1,968
  • 1
  • 23
  • 35