0

Using a general journalctl command, the log line of interest appears:

[root@bee server]# journalctl -n
-- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 21:41:12 EEST. --
...
Jun 10 21:41:12 bee ownCloud[25476]: {core} Login failed: 'ewrf' (Remote IP: '172.16.0.2', X-Forwarded-For: '')

How could I reach this ownCloud line with the -u option, aka _SYSTEMD_UNIT?

[root@bee server]# journalctl -u ownCloud
-- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 22:01:02 EEST. --

I need to specify the journalmatch variable in the relevant owncloud filter file for fail2ban.

[root@bee server]# cat /etc/fail2ban/filter.d/owncloud-login.conf
[Definition]
failregex = {"app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>', X-Forwarded-For: '.*'\)","level":2,"time":".*"}

Ignoreregex =
[Init]

# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 10

journalmatch = _SYSTEMD_UNIT=ownCloud

Could I possibly use a regex pattern? How?

$man journalctl
...
-u, --unit=UNIT|PATTERN
           Show messages for the specified systemd unit UNIT (such as a service unit), or for any of the units matched by PATTERN. If a pattern is specified, a list of
           unit names found in the journal is compared with the specified pattern and all that match are used. For each unit name, a match is added for messages from
           the unit ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages from systemd and messages about coredumps for the specified unit.
...
raratiru
  • 111
  • 5

1 Answers1

1

I have own cloud running under uWSGI/Nginx on ArchLinux and while my journalctl entries show uwsgi the actual system unit name is uwsgi@owncloud.service. You should be able to use the command below to find out the correct _SYSTEMD_UNIT name. The command will find a single entry that matches the wildcard unit name and then output it in JSON format.

journalctl -u *ownCloud* -n 1 --output json --no-pager
  • Thank you for the answer. Using the solution above, I get the following error in Fedora: ```Failed to add filter for units: No data available```. However I have implimented the following solution: ```journalmatch = SYSLOG_IDENTIFIER=ownCloud``` – raratiru Jun 10 '15 at 21:40