Journal streams (systemd / journald)

On an SSH source, a stream can follow the host's systemd journal instead of tailing a file. The journal is stored in a binary format, so there is no file to point at - LogRaker runs journalctl on the host and streams its output back over the same SSH connection.

Journal streams are an SSH-only option. Local (this Mac) sources don't offer it - macOS has no journald - and GCP / Firebase sources have their own filter editor.

Creating a journal stream

+ ▸ New Stream… under an SSH source, then set Source to Journal. The File row is replaced by the journal controls:

Units - the systemd units to follow. Each pill is one unit (for example nginx.service, sshd, or my-app); LogRaker passes each one to journalctl with -u. Leave the field empty to follow the entire journal.
Priority - the lowest severity to include. Choosing a level shows that level and everything more severe - for example Error shows Error, Critical, Alert, and Emergency. All priorities (the default) applies no severity filter.
Current boot only - restrict output to the current boot (-b). Off by default, so all retained boots are searched.
Preview - the exact journalctl command the stream will run, updated as you change the controls.

The Filter pills, Strip matched text, and Auto-stream at startup options work exactly as they do for file streams - the Filter is applied on screen, on top of whatever the journal returns.

Permissions

What a journal stream can see depends on the SSH user's own journal access:

A user in the systemd-journal group (or root) sees the full system journal.
A user not in that group sees only their own user journal.

LogRaker runs journalctl directly as the SSH user - it does not prompt for a password or use sudo. To widen access, add the login user to the systemd-journal group on the host (usermod -aG systemd-journal <user>), or connect as a user that already has it.

Requirements & errors

The host must be running systemd and have journalctl on the login shell's PATH. If it isn't found, the stream stops with “journalctl not found … - is this a systemd host?” rather than retrying. A permissions problem instead shows journalctl's own message in the tail (for example a "No journal files were found" or "Permission denied" line).

Timestamps & history

Journal lines arrive with ISO 8601 timestamps at the journal's full microsecond precision (including the host's time-zone offset), so they line up with your other streams and honor the options in Settings ▸ Timestamps - sub-seconds show when your format includes a fractional field. On hosts too old to support microsecond output (systemd before v234, 2017), LogRaker automatically falls back to whole-second timestamps. On connect, LogRaker shows the number of history lines set in Settings ▸ General; reconnects show only new lines.

Services that write their own timestamp into each message would show the time twice - once from journald, once inside the message. The Hide duplicate timestamps option in Settings ▸ Timestamps hides the embedded one and keeps journald's.

Use in Monitors and Layouts

A journal stream is an ordinary Stream - it can be added to a Layout pane and watched by a Monitor just like a file stream.