Journalctl query - how to store an offset file like logtail -o?

Support
1

Is there any chance to store an offsetfile with a journalctl query?
f.ex. via logtail

logtail -f /var/log/mail.log -o /path/to/statsfile.dat

how can I ceate a similar offsetfile (latest run) via journalctl query?
output should look like a logtail query
5629
15142003

2

Why so complicated, just use dates and times. The options -S and -U can be relativ.

But if you want an offset file that is more similar to logtail use --cursor-file=

See
https://www.freedesktop.org/software/systemd/man/latest/journalctl.html#--cursor-file=FILE

1 Like
3

it is a little complicated :slightly_smiling_face:
It’s a zabbix-agent script, the jouranl query for the stats works but the offset part doesn’t work well …
at the moment it works somewhat this way (added the logtail part under jounalctl part)

   journalctl --no-pager --since '5 min ago' -u postfix@-.service | "${PFLOGSUMM}" -h 0 -u 0 --bounce_detail=0 --deferral_detail=0 --reject_detail=0 --no_no_msg_size --smtpd_warning_detail=0 > "${TEMPFILE}"
   "${LOGTAIL}" -f"${TEMPFILE}" -o"${PFOFFSETFILE}"
   for i in "${PFVALS[@]}"; do
      printvalues "$i"
   done

the original script via /var/log/mail.log

#!/usr/bin/env bash

MAILLOG=/var/log/mail.log
PFOFFSETFILE=/etc/zabbix/scripts/zabbix-postfix-offset.dat
PFSTATSFILE=/etc/zabbix/scripts/postfix_statsfile.dat
TEMPFILE=$(mktemp)
PFLOGSUMM=/usr/sbin/pflogsumm
LOGTAIL=/usr/sbin/logtail

PFVALS=( 'received' 'delivered' 'forwarded' 'deferred' 'bounced' 'rejected' 'discarded' 'reject_warnings' 'bytes_received' 'bytes_delivered' )

[ ! -e "${PFSTATSFILE}" ] && touch "${PFSTATSFILE}" && chown zabbix:zabbix "${PFSTATSFILE}"

printvalues() {
  key=$1
  pfkey=$(echo "$1" | tr '_' ' ')
  value=$(grep -m 1 "${pfkey}" $TEMPFILE | awk '{print $1}' | awk '/k|m/{p = /k/?1:2}{printf "%d\n", int($1) * 1024 ^ p}')
  old_value=$(grep -e "^${key};" "${PFSTATSFILE}" | cut -d ";" -f2)
  if [ -n "${old_value}" ]; then
    sed -i -e "s/^${key};${old_value}/${key};$((${old_value}+${value}))/" "${PFSTATSFILE}"
  else
    echo "${key};${value}" >> "${PFSTATSFILE}"
  fi
}

if [ -n "$1" ]; then 
  key=$(echo ${PFVALS[@]} | grep -wo $1)
  if [ -n "${key}" ]; then
    value=$(grep -e "^${key};" "${PFSTATSFILE}" | cut -d ";" -f2)
    echo "${value}"
  else
    rm "${TEMPFILE}"
    exit 2
  fi
else
   "${LOGTAIL}" -f"${MAILLOG}" -o"${PFOFFSETFILE}" | "${PFLOGSUMM}" -h 0 -u 0 --bounce_detail=0 --deferral_detail=0 --reject_detail=0 --no_no_msg_size --smtpd_warning_detail=0 > "${TEMPFILE}"
   for i in "${PFVALS[@]}"; do
      printvalues "$i"
   done
fi

rm "${TEMPFILE}"

so this part “PFOFFSETFILE=/etc/zabbix/scripts/zabbix-postfix-offset.dat” stores the offset data which is normaly taken from mail.log, but in that case I need to use journalctl …
Above I have used the TEMPFILE for the logtail query so it is not accurate right now …