journal-triggerd

Latest version: 0.2.1

The latest version of journal-triggerd can be downloaded here. For Arch Linux users, the AUR has a PKGBUILD.

You can find the source code on this GitHub, where you can also report bugs, send suggestions or other (constructive) feedback.

What is journal-triggerd ?

journal-triggerd is a small daemon that runs in the background, listening to systemd's journal, and will run "triggers" (i.e. exec a given command line) when certain messages are added.

Which messages to listen for, and what action to run when such messages are added, is simply define via rules.

Rules

Rules are defined in (UTF8 encoded) text files, whose names must end with .rule and placed in /etc/journal-triggerd.rules

Any file whose name not end in .rule will be ignored. Files are not processed in any defined order, neither will rules be processed in any given order; Not that it should matter, since all rules are always processed against every new message added to the journal.

A rule is composed of two things : a filter, used to match messages added to the journal, and a trigger, to be run when match occurs.

Rule File Format

Rule files have a syntax similar to that of conf/INI files, or systemd's unit files. A section [Rule] must exist, where filter/trigger be defined.

The trigger is simply a command line, define under option trigger

A filter can be either a list of conditions to match, or use boolean logic to create more complex filtering. For the former, no option under [Rule] is needed, simply create a section [Filter] and define the conditions there.

To create more complex filters, an option filer can be set under [Rule] and must be an expression that can make use of parenthesis, AND, OR and NOT as well as named filters/groups.

Those names are case-sensitive names of sections that must exist in the file, where a list of conditions will be defined.

For example, one could use:

filter=foobar AND (foo OR bar) AND NOT barfoo

And there must be sections [foobar], [foo], [bar], and [barfoo] defined in the rule file, all of which defining one or more conditions to be matched.

It is of course possible to only use one group name, i.e. when no option filter is set, it defaults to filter=Filter

Define multiple rules in one file

As a facility it is possible to define multiple rules from a single file, thus allowing to use the same groups in different filters. To do so, simply create an option filterXXX with a matching triggerXXX

For example:

[Rule]
filter_foo=foo AND NOT foobar
trigger_foo=foobar --foo
filter_bar=bar AND NOT foobar
trigger_bar=foobar --bar
filter=foobar AND (foo OR bar)
trigger=foobar --foobar

Conditions

The heart of a filter is a group of conditions, defined simply as a section in the rule file. All conditions are simply the name of a field from the journal, an optional comparison operator before the required equal sign (=), and the value to compare with.

The supported operators are :

  • Exact match: = The field must be of the specified value.

  • Pattern match: ? You can use * and ? wildcards with similar semantics as the standard glob functions: * matches an arbitrary, possibly empty, string, ? matches an arbitrary character.

  • Lesser match: < The value must be an integer, the value of the field will also be parsed as an integer value, and must be less than or equal to the specified value to match.

  • Greater match: > The value must be an integer, the value of the field will also be parsed as an integer value, and must be greater than or equal to the specified value to match.

You can specify as many conditions as you want in each group; All will need to be a match for the entire group to be a match. You can specify conditions on the same field multiple times.

It is also possible to prefix the comparison operator with a ! in order to inverse the match, i.e. the field shall not match the condition for it to be a match.

Example:

[Filter]
PRIORITYE<=3
MESSAGE!=Some message to ignore
MESSAGE!=Another message to ignore

Read more about journal-triggerd

You can check out the following blog posts, or head over this topic on Arch Forums.

Top of Page