mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
3855b75c5f
Without `--all`, `journalctl --output=json` encodes a field over 4096 bytes as `null`, so a long host error matched nothing and the check passed. A repeated `MESSAGE` field arrives as a JSON array of its values, and `bytes()` on that array raised `TypeError`, which aborted the whole check. Pass `--all`, and tell a byte array (all integers) from an array of field values, decoding each value on its own. Reproduced against the host journal: a 5000-byte error line read back as `"MESSAGE":null` and produced no match; an entry with two `MESSAGE` fields, sent over the native journal socket, read back as `["error first","error second"]` and crashed `host_errors` with `TypeError`. With the fix both are reported. Also clear the two test-lint findings of this PR: `test_comments_valid` rejects the narrative comment above the `journalctl` Popen, so it goes; the stderr-to-file choice stays, because an unread stderr pipe that fills up would block `journalctl` while stdout is still being read. `test_no_uncached_file_reads` flags the read of the stub's argument file, which lives in the test's tempdir and is written per run, so the path-keyed `utils.cache.files.read_text` could serve a stale body; the read opts out with `# nocheck: cache-read tempdir fixture`, as the other stub-driven script tests do. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
45 lines
2.2 KiB
Markdown
45 lines
2.2 KiB
Markdown
# sys-ctl-hlth-journalctl
|
|
|
|
## Description
|
|
|
|
Scans `journalctl` over the last day for “error” entries outside container logs and alerts if any are found.
|
|
|
|
## Overview
|
|
|
|
This role searches the systemd journal for errors over the past day and alerts if any are found.
|
|
Container output is skipped, because every compose service logs to journald and application errors would otherwise trigger the host check.
|
|
Docker daemon and system errors are still reported.
|
|
|
|
## Cosmos
|
|
|
|
The diagram places sys-ctl-hlth-journalctl in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
subgraph role [sys-ctl-hlth-journalctl 💻]
|
|
svc_journalctl["journalctl"]
|
|
end
|
|
```
|
|
|
|
Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments); red `0..0` edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in `meta/main.yml`.
|
|
|
|
## Features
|
|
|
|
- Reads the last day of the journal as JSON with every field in full (`--all`) and drops every entry that carries a `CONTAINER_ID` field.
|
|
- Joins a repeated `MESSAGE` field into one line before matching.
|
|
- Matches the remaining messages case-insensitively against `error`.
|
|
- Prints one `source: message` line per match, naming the systemd unit or, without one, the syslog identifier, so alerts show who logged the error.
|
|
- Exits non-zero on matches, and also when `journalctl` itself fails, so a broken check never passes silently.
|
|
- Scheduled via systemd timer.
|
|
- Alerts via `sys-ctl-alm-compose` on detection.
|
|
|
|
## Usage
|
|
|
|
Include the role; set `on_calendar_health_journalctl` for your preferred schedule.
|
|
|
|
## Credits
|
|
|
|
Implemented by **[Kevin Veen-Birkenbach](https://www.veen.world)**.
|
|
Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code) and maintained by [Kevin Veen-Birkenbach](https://www.veen.world).
|
|
Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
|