From b636b4b3e91ce486d6169395db0b69c67c4c7aab Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 3 May 2024 13:01:10 +0100 Subject: [PATCH] feat(aa-log): improve the journalctl filter. --- pkg/logs/loggers.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkg/logs/loggers.go b/pkg/logs/loggers.go index 517f038a..9eb8a681 100644 --- a/pkg/logs/loggers.go +++ b/pkg/logs/loggers.go @@ -75,8 +75,13 @@ func GetJournalctlLogs(path string, useFile bool) (io.Reader, error) { } scanner = bufio.NewScanner(file) } else { - // journalctl -b -o json --grep=apparmor --output-fields=MESSAGE > systemd.log - cmd := exec.Command("journalctl", "--boot", "--grep=apparmor", "--output=json", "--output-fields=MESSAGE") + // journalctl -b -o json -g apparmor -t kernel -t audit -t dbus-daemon --output-fields=MESSAGE > systemd.log + args := []string{ + "--boot", "--grep=apparmor", + "--identifier=kernel", "--identifier=audit", "--identifier=dbus-daemon", + "--output=json", "--output-fields=MESSAGE", + } + cmd := exec.Command("journalctl", args...) cmd.Stdout = &stdout if err := cmd.Run(); err != nil { return nil, err