I'm trying to forward systemd logs to the remote host and can't get systemd-journal-gateway
working. I can connect to http://localhost:19531/entries?follow
but there aren't any entries. In the same time journalctl -f
shows new journal entries.
I have read docs for systemd-journal-gatewayd.service, but there are no glue about this case.
EDIT:
$ systemctl status systemd-journal-gatewayd
systemd-journal-gatewayd.service - Journal Gateway Service
Loaded: loaded (/usr/lib64/systemd/system/systemd-journal-gatewayd.service; indirect; vendor preset: disabled)
Active: active (running) since Tue 2015-07-07 07:35:48 UTC; 2h 23min ago
Main PID: 5183 (systemd-journal)
Memory: 1.0M
CPU: 236ms
CGroup: /system.slice/systemd-journal-gatewayd.service
└─5183 /usr/lib/systemd/systemd-journal-gatewayd
Jul 07 07:35:48 ip-10-4-1-91.ec2.internal systemd[1]: Started Journal Gateway Service.
Jul 07 07:35:48 ip-10-4-1-91.ec2.internal systemd[1]: Starting Journal Gateway Service...
EDIT 2:
lsof
shows that system log accessed and open:
$ lsof -p 805
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
...
systemd-j 805 systemd-journal-gateway 11u IPv6 17965 0t0 TCP localhost:http-alt->localhost:55344 (ESTABLISHED)
systemd-j 805 systemd-journal-gateway 12u REG 0,32 0 18492 /tmp/#18492 (deleted)
systemd-j 805 systemd-journal-gateway 13r 0000 0,10 0 6679 anon_inode
systemd-j 805 systemd-journal-gateway 14r REG 202,9 8388608 30 /var/log/journal/fdb957828b9941b29ef97394f06a0cdc/system.journal
But for some reason it don't shows them neither in web UI nor in direct http request.
Also, sometime in the web console for http://x.x.x.x:19531/entries
I see 400 Bad request
Failed to seek in journal
. But can't reproduce it with curl.