Description

Develop a Journald Reader for Logcollector that behaves similarly to the journalctl command. The Reader will filter and forward logs based on configurable parameters, ensuring robust integration with the Journald API.

Requirements

Configuration Options

The Journald Reader will support the following configuration:

• journald: Defines a Journald reader with the following options:

  • field: Selects a field from Journald entries.
  • regex: Regular expression the selected field must match for the log to be transmitted.
  • ignore_if_missing: Boolean; defines whether to ignore the log if the specified field does not exist.

• file_wait: Defines the log polling interval (e.g., 500ms).

• reload_interval: Interval for detecting log rotation (e.g., 1m).

Example Configuration:

logcollector:
    enabled: true
    reload_interval: 1m
    file_wait: 500ms
    
    journald:
    - field: _SYSTEMD_UNIT
      regex: ^cron.service$
    - field: PRIORITY
      regex: [0-3]
      ignore_if_missing: true

Tasks

Spike

1. Review Configuration Options
   • Ensure that all necessary options are defined and consider additional useful features.
   • Confirm compatibility with Logcollector's configuration structure.
2. Integrate Journald API
   • Utilize the client implementation from Wazuh 4.x.
   • Ensure synchronous interaction with the Journald API.
3. Define Runner Behavior
   • Design the Journald runner in compliance with the specification outlined in issue Support Platform-Specific Logging Systems in Logcollector #424.
   • Ensure seamless detection of rotation and log state tracking.

Development

1. Extend Logcollector's Setup Function
   • Parse and validate the Journald configuration options.
2. Integrate Journald API Client
   • Add Journald API as a dependency to facilitate log retrieval and filtering.
3. Implement Journald Reader
   • Develop the Reader to process logs based on configured filters.
   • Detect log rotation and handle state persistence for reliable log processing.
4. Testing
   • Create unit and integration tests to validate the Reader's behavior under various configurations and scenarios.
5. Documentation
   • Provide comprehensive documentation for the Journald Reader, including configuration examples and usage instructions.

Deliverables

• Fully implemented Journald Reader in Logcollector.
• Unit and integration test coverage for all features.
• Documentation for the Journald Reader.