Mantas Mikulėnas schrieb am Mo 03. Aug, 10:24 (+0300): > Set up a hourly cron job that does > journalctl -q -p err --cursor-file=/var/log/journal/cron.hourly > and crond (or a custom timer if you want) will mail you a report of all > error+ level log messages.
I use the same idea: ``` # /etc/systemd/system/journal-report.timer [Unit] Description=Trigger report about errors/warnings in journal [Timer] OnCalendar=*:10/10 [Install] WantedBy=timers.target ``` ``` # /etc/systemd/system/journal-report.service [Unit] Description=Report about error/warning messages in journal to root [Service] Type=oneshot SyslogIdentifier=err-report ExecStart=/bin/sh StandardInput=data StandardInputText=\ out=$(journalctl --cursor-file /var/local/error.cur --no-hostname --no-tail -p warning) \n\ echo "$out" | grep -q -e '-- No entries --' && exit \n\ echo "$out" |mail -s "[`hostname`] error log" root || exit \n\ echo "Found $(echo "$out" | wc -l) error messages. Sent e-mail." # Common security settings https://jo-so.de/2021-05/H%C3%A4rtung-Systemd.html CapabilityBoundingSet= KeyringMode=private LockPersonality=true MemoryDenyWriteExecute=true NoNewPrivileges=true UMask=077 DevicePolicy=closed PrivateDevices=true PrivateTmp=true PrivateUsers=true ProtectClock=true ProtectControlGroups=true ProtectHostname=true ProtectKernelLogs=true ProtectKernelModules=true ProtectKernelTunables=true # strict: mounts the whole system read-only # full: mount only /var as read-write # true: mount /var and /etc as read-write ProtectSystem=strict ProtectHome=true # Make sure that the process can only see PIDs and process details of itself, # and the second option disables seeing details of things like system load and # I/O etc ProtectProc=invisible ProcSubset=pid RemoveIPC=true RestrictNamespaces=true RestrictRealtime=true RestrictSUIDSGID=true SystemCallArchitectures=native SystemCallFilter=@system-service SystemCallFilter=~@aio @clock @module @mount @obsolete @privileged @reboot @resources @setuid @swap RestrictAddressFamilies=AF_UNIX # end of common security settings # required for Exim's mail delivery CapabilityBoundingSet=CAP_CHOWN CAP_SETGID CAP_SETUID PrivateUsers=false SystemCallFilter=@privileged @chown # write access to /var required by Exim ProtectSystem=full # even unix sockets aren't neccessary RestrictAddressFamilies=~AF_UNIX # required for bsd-mailx SystemCallFilter=setgid ``` > On Sat, 1 Aug 2026, 20:45 Felix E. Klee <[email protected]> wrote: > > > Using a toplevel override, I set up email notification on service fail: > > > > # /etc/systemd/system/service.d/toplevel-override.conf > > [Unit] > > OnFailure=failure-notification@%n > > > > Now, every time a service fails to start, I get an email, on every > > single restart attempt. This can result in many emails. In fact, if > > `StartLimitBurst` is not set, I would get mailbombed by my server. > > > > Therefore, I am thinking about a different solution that does not have > > the mailbomb risk: A timer that sends an email if there is a failed > > service. Having the timer trigger every hour would be sufficient. It > > certainly would be better than getting no notification at all. > > > > *Am I reinventing the wheel? Isn’t there already something that solves > > the problem?* > > -- Navimatix GmbH T: 03641 - 327 99 0 Tatzendpromenade 2 F: 03641 - 526 306 07745 Jena www.navimatix.de Geschäftsführer: Steffen Späthe, Jan Rommeley Registergericht: Amtsgericht Jena, HRB 501480
smime.p7s
Description: S/MIME cryptographic signature
