Path: ...!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!eternal-september.org!.POSTED!not-for-mail
From: Lawrence D'Oliveiro <ldo@nz.invalid>
Newsgroups: comp.os.linux.misc
Subject: Re: More systemdCrap
Date: Tue, 11 Mar 2025 21:05:45 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 30
Message-ID: <vqq8j8$25gtn$7@dont-email.me>
References: <vqn41l$1efis$1@dont-email.me> <vqna2v$1fks2$1@dont-email.me>
	<vqnbm7$1g56j$1@dont-email.me> <vqnihm$1hiap$2@dont-email.me>
	<vqnjfk$1hrbi$2@dont-email.me> <4154alxv4u.ln2@Telcontar.valinor>
	<vqnssj$1jibk$8@dont-email.me> <bjm5alx305.ln2@Telcontar.valinor>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 11 Mar 2025 22:05:45 +0100 (CET)
Injection-Info: dont-email.me; posting-host="fb3f8814a23c1b5929be502852c6d2d1";
	logging-data="2278327"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1/283vRjTDqm66TFNq4q+H0"
User-Agent: Pan/0.162 (Pokrosvk)
Cancel-Lock: sha1:O/RRebfMMq1nEkiYpQJ10fPg5a8=
Bytes: 2375

On Tue, 11 Mar 2025 13:23:39 +0100, Carlos E.R. wrote:

> What you can not do is remove content from the middle of the files.
> Specifically remove some content and leave intact other content.
> This is forbidden in the design of the systemd journal, the developers
> refuse to do it.

When all else fails, read the documentation!

From the journald.conf man page
<https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html>,
note the options for forwarding journal entries to alternative
destinations:

    ForwardToSyslog=, ForwardToKMsg=, ForwardToConsole=, ForwardToWall=, ForwardToSocket=

    ...

    When forwarding over a socket the Journal Export Format is used
    when sending over the wire. Notably this includes the metadata
    field __REALTIME_TIMESTAMP so that systemd-journal-remote (see
    systemd-journal-remote.service(8)) can be used to receive the
    forwarded journal entries.

The Journal Export Format is documented here:
<https://systemd.io/JOURNAL_EXPORT_FORMATS/>.

So the solution is simple: write your own socket listener which saves
journal records to your own rewritable format, e.g. an SQLite
database. You can then edit this to your heart’s content.