systemd journal remote

Overview

This module installs, configures and manages the following remote journald services:

• systemd-journal-remote
• systemd-journal-upload
• systemd-journal-gatewayd

Package Management

By default, depending on the distribution, the systemd-journal-remote package is managed. The ::systemd_journal_remote class is required by all other services managed by this module.

# Default package management
class { '::systemd_journal_remote':
  manage_package => true,
  package_name   => 'systemd-journal-remote',
  package_ensure => present,
}

Example Usage

Remote Service

The systemd-journal-remote service can be used to receive journal messages over the network with the ::systemd_journal_remote::remote class.

include ::systemd_journal_remote::remote

By default, to ensure the service runs without configuration, journal-remote listens over HTTP and outputs to /var/log/journal/remote/.

To receive over HTTPS (recommended) and use trusted connections with Puppet certificates:

# Passive configuration example
class { '::systemd_journal_remote::remote':
  command_flags => {
    'listen-https' => '0.0.0.0:19532',
    'compress'     => 'yes',
    'output'       => '/var/log/journal/remote/',
  },
  options       => {
    'SplitMode'              => 'host',
    'ServerKeyFile'          => "/etc/puppetlabs/puppet/ssl/private_keys/${trusted['certname']}.pem",
    'ServerCertificateFile'  => "/etc/puppetlabs/puppet/ssl/certs/${trusted['certname']}.pem",
    'TrustedCertificateFile' => '/etc/puppetlabs/puppet/ssl/certs/ca.pem',
  }
}

To pull data from another source in:

# Active configuration example
class { '::systemd_journal_remote::remote':
  command_flags => {
    'url'    => 'https://some.host:19531/',
    'getter' => "'curl \"-HAccept: application/vnd.fdo.journal\" https://some.host:19531/'",
    'output' => '/var/log/journal/remote/',
  },
  options       => {
    'SplitMode' => 'host',
  }
}

The command_flags and options parameters available mirror those documented in man systemd-journal-remote and man journal-remote.conf.

Upload Service

The systemd-journal-upload service can be used to upload (send) journal messages over the network with the ::systemd_journal_remote::upload class.

By default this class is configured to upload over HTTP to http://0.0.0.0:19532 and save its current state to /var/lib/systemd/journal-upload/state.

To send journal events over HTTPS using Puppet certificates:

# Upload over HTTPS with Puppet certificates
class { '::systemd_journal_remote::upload':
  command_flags => {
    'save-state' => '/var/lib/systemd/journal-upload/state',
  },
  options       => {
    'URL'                    => 'https://0.0.0.0:19532',
    'ServerKeyFile'          => "/etc/puppetlabs/puppet/ssl/private_keys/${trusted['certname']}.pem",
    'ServerCertificateFile'  => "/etc/puppetlabs/puppet/ssl/certs/${trusted['certname']}.pem",
    'TrustedCertificateFile' => '/etc/puppetlabs/puppet/ssl/certs/ca.pem',
    'NetworkTimeoutSec'      => '30',
  }
}

Gateway Daemon Service

The systemd-journal-gatewayd service can be used as a HTTP server to request journal logs as server-sent events, binary or in text/JSON using the ::systemd_journal_remote::gatewayd class.

By default the server listens on all interfaces over HTTP on port 19531. To use HTTPS add the cert option.

# Expect HTTPS connection using Puppet certificates
class { '::systemd_journal_remote::gatewayd':
  command_flags => {
    'key'   => "/etc/puppetlabs/puppet/ssl/private_keys/${trusted['certname']}.pem",
    'cert'  => "/etc/puppetlabs/puppet/ssl/certs/${trusted['certname']}.pem",
    'trust' => '/etc/puppetlabs/puppet/ssl/certs/ca.pem',
  }
}

Limitations

SSL certificates are not managed by this module. You will need to ensure the systemd-journal-(remote|upload|gateway) users have the correct access to the necessary files.

This module only manages the systemd-journal-(remote|upload|gatewayd) systemd service ExecStart, journal-remote.conf and journal-upload.conf configuration files and the initial package installation.

Reference

Table of Contents

Classes

Public Classes

• systemd_journal_remote: This module manages and configures the systemd journal remote package
• systemd_journal_remote::gatewayd: This class manages and configures the systemd-journal-gatewayd service
• systemd_journal_remote::remote: This module manages and configures the systemd journal remote package
• systemd_journal_remote::upload: This class manages and configures the systemd journal upload service

Private Classes

• systemd_journal_remote::gatewayd::config: This class configures the systemd-journal-gatewayd unit override
• systemd_journal_remote::gatewayd::service: This class manages the systemd-journal-gatewayd service
• systemd_journal_remote::remote::config: This class configures the [Remote] section of journal-remote.conf
• systemd_journal_remote::remote::service: This class manages the systemd-journal-remote service
• systemd_journal_remote::upload::config: This class configures the [Upload] section of journal-upload.conf
• systemd_journal_remote::upload::service: This class manages the systemd-journal-upload service

Data types

• Systemd_Journal_Remote::Gatewayd_Flags: Matches systemd gatewayd options in man systemd-journal-gatewayd
• Systemd_Journal_Remote::Remote_Flags: Matches systemd remote options in man systemd-journal-remote
• Systemd_Journal_Remote::Remote_Options: Matches systemd remote options in man journal-remote.conf
• Systemd_Journal_Remote::Upload_Flags: Matches systemd upload options in man systemd-journal-upload
• Systemd_Journal_Remote::Upload_Options: Matches systemd upload options in man journal-upload.conf

Classes

systemd_journal_remote

This module manages and configures the systemd journal remote package

Parameters

The following parameters are available in the systemd_journal_remote class:

• manage_package
• package_name
• package_ensure

manage_package

Data type: Boolean

Manage the systemd-journal-remote package installation

Default value: true

package_name

Data type: String

The systemd-journal-remote package name to use

Default value: 'systemd-journal-remote'

package_ensure

Data type: Enum['latest', 'absent', 'present']

The systemd-journal-remote package state

Default value: present

systemd_journal_remote::gatewayd

This class manages and configures the systemd-journal-gatewayd service

Parameters

The following parameters are available in the systemd_journal_remote::gatewayd class:

• command_path
• command_flags
• manage_service
• service_enable
• service_name
• service_ensure

command_path

Data type: Stdlib::Absolutepath

The service ExecStart command path

Default value: '/usr/lib/systemd/systemd-journal-gatewayd'

command_flags

Data type: Systemd_Journal_Remote::Gatewayd_Flags

The service ExecStart command flags to use

Default value: {}

manage_service

Data type: Boolean

Manage the journal-gatewayd service

Default value: true

service_enable

Data type: Boolean

Enable the journal-gatewayd service

Default value: true

service_name

Data type: String

The journal-gatewayd service name

Default value: 'systemd-journal-gatewayd'

service_ensure

Data type: Stdlib::Ensure::Service

Default value: running

systemd_journal_remote::remote

This module manages and configures the systemd journal remote package

Parameters

The following parameters are available in the systemd_journal_remote::remote class:

• command_path
• command_flags
• manage_output
• manage_service
• service_enable
• service_ensure
• service_name
• options

command_path

Data type: Stdlib::Absolutepath

The service ExecStart command path

Default value: '/usr/lib/systemd/systemd-journal-remote'

command_flags

Data type: Systemd_Journal_Remote::Remote_Flags

The service ExecStart command flags to use

Default value: {}

manage_output

Data type: Boolean

Manage the creation of the default output paths (/var/log/journal/remote/)

Default value: false

manage_service

Data type: Boolean

Manage the systemd-journal-remote service

Default value: true

service_enable

Data type: Boolean

Enable the journal-remote service

Default value: true

service_ensure

Data type: Stdlib::Ensure::Service

Ensure the journal-remote service state

Default value: running

service_name

Data type: String

The journal-remote service name

Default value: 'systemd-journal-remote'

options

Data type: Optional[Systemd_Journal_Remote::Remote_Options]

Config hash to configure the [Remote] options in journal-remote.conf

Default value: {}

systemd_journal_remote::upload

This class manages and configures the systemd journal upload service

Parameters

The following parameters are available in the systemd_journal_remote::upload class:

• command_path
• command_flags
• manage_service
• service_enable
• service_ensure
• service_name
• options
• manage_state

command_path

Data type: Stdlib::Absolutepath

The service ExecStart command path

Default value: '/usr/lib/systemd/systemd-journal-upload'

command_flags

Data type: Systemd_Journal_Remote::Upload_Flags

The service ExecStart command flags to use

Default value: {}

manage_service

Data type: Boolean

Manage the journal-upload service

Default value: true

service_enable

Data type: Boolean

Enable the journal-upload service

Default value: true

service_ensure

Data type: Stdlib::Ensure::Service

Ensure the journal-upload state

Default value: running

service_name

Data type: String

The journal-upload service name

Default value: 'systemd-journal-upload'

options

Data type: Optional[Systemd_Journal_Remote::Upload_Options]

Config hash to configure the [Upload] options in journal-upload.conf

Default value: {}

manage_state

Data type: Boolean

Default value: false

Data types

Systemd_Journal_Remote::Gatewayd_Flags

Matches systemd gatewayd options in man systemd-journal-gatewayd

Alias of

Struct[{
    Optional['cert']         => Stdlib::Unixpath,
    Optional['key']          => Stdlib::Unixpath,
    Optional['trust']        => Variant[Stdlib::Unixpath, Enum['all']],
    Optional['system']       => Variant[Boolean, Enum['true', 'false']],
    Optional['user']         => Variant[Boolean, Enum['true', 'false']],
    Optional['merge']        => Variant[Boolean, Enum['true', 'false']],
    Optional['D']            => Stdlib::Unixpath,
    Optional['directory']    => Stdlib::Unixpath,
    Optional['file']         => String,
  }]

Systemd_Journal_Remote::Remote_Flags

Matches systemd remote options in man systemd-journal-remote

Alias of

Struct[{
    Optional['url']          => Variant[Stdlib::HTTPUrl, Stdlib::HTTPSUrl],
    Optional['getter']       => String,
    Optional['listen-raw']   => String,
    Optional['listen-http']  => Variant[String, Integer[-3, -1]],
    Optional['listen-https'] => Variant[String, Integer[-3, -1]],
    Optional['key']          => Stdlib::Unixpath,
    Optional['cert']         => Stdlib::Unixpath,
    Optional['trust']        => Variant[Stdlib::Unixpath, Enum['all']],
    Optional['gnutls-log']   => String,
    Optional['output']       => Stdlib::Unixpath,
    Optional['gnutls-log']   => String,
    Optional['split-mode']   => Enum['none','host'],
    Optional['compress']     => Enum['yes','no'],
    Optional['seal']         => Enum['yes','no'],
  }]

Systemd_Journal_Remote::Remote_Options

Matches systemd remote options in man journal-remote.conf

Alias of

Struct[{
    Optional['Seal']                   => Enum['yes','no'],
    Optional['SplitMode']              => Enum['host','none'],
    Optional['ServerKeyFile']          => Stdlib::Absolutepath,
    Optional['ServerCertificateFile']  => Stdlib::Absolutepath,
    Optional['TrustedCertificateFile'] => Variant[Stdlib::Absolutepath, Enum['all']],
  }]

Systemd_Journal_Remote::Upload_Flags

Matches systemd upload options in man systemd-journal-upload

Alias of

Struct[{
    Optional['u']            => Variant[Stdlib::Host, Stdlib::HTTPUrl, Stdlib::HTTPSUrl],
    Optional['url']          => Variant[Stdlib::Host, Stdlib::HTTPUrl, Stdlib::HTTPSUrl],
    Optional['system']       => Variant[Boolean, Enum['true', 'false']],
    Optional['user']         => Variant[Boolean, Enum['true', 'false']],
    Optional['merge']        => Variant[Boolean, Enum['true', 'false']],
    Optional['D']            => Stdlib::Unixpath,
    Optional['directory']    => Stdlib::Unixpath,
    Optional['file']         => String,
    Optional['cursor']       => String,
    Optional['after-cursor'] => String,
    Optional['save-state']   => Stdlib::Unixpath,
    Optional['follow']       => Boolean,
    Optional['key']          => Variant[Enum['-'], Stdlib::Unixpath],
    Optional['cert']         => Variant[Enum['-'], Stdlib::Unixpath],
    Optional['trust']        => Variant[Enum['-', 'all'], Stdlib::Unixpath],
  }]

Systemd_Journal_Remote::Upload_Options

Matches systemd upload options in man journal-upload.conf

Alias of

Struct[{
    Optional['URL']                    => Variant[Stdlib::HTTPUrl, Stdlib::HTTPSUrl],
    Optional['ServerKeyFile']          => Stdlib::Absolutepath,
    Optional['ServerCertificateFile']  => Stdlib::Absolutepath,
    Optional['TrustedCertificateFile'] => Stdlib::Absolutepath,
    Optional['NetworkTimeoutSec']      => Variant[Integer, String],
  }]

Change log

All notable changes to this project will be documented in this file. The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

v1.1.0 (2022-11-26)

Full Changelog

Added

• Add Ubuntu 22.04 support. Drop CentOS 8 and Debian 9. #5 (gibbs)

v1.0.0 (2022-07-13)

Full Changelog

Fixed

• Explicitly set lint checks #4 (gibbs)

0.2.0 (2022-01-30)

Full Changelog

Added

• Add journal-upload and journal-gatewayd management #3 (gibbs)

0.1.0 (2022-01-25)

Full Changelog

Added

• Add active service example #1 (gibbs)

Fixed

• Fix release user and dependency cycle in metadata. #2 (gibbs)

* This Changelog was automatically generated by github_changelog_generator