JA EN
shiichan

journald support, of all things! The CloudWatch agent can now read systemd logs directly!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#devops

Hey, it's Shii! Today I found an announcement that's a bit understated, but the kind where you go "oh, that was actually annoying!" So let me tell you about it.

AWS What's New aws.amazon.com

What was announced?

AWS's What's New page announced that the Amazon CloudWatch agent now supports collecting systemd journal (journald) logs. It can now read log entries directly from the systemd journal on Linux instances and send them to Amazon CloudWatch Logs. The key part: it no longer needs to write those logs to a file on disk first.

The story so far

Many modern Linux distributions, including Amazon Linux 2023, use the systemd journal as their primary logging system, and they no longer write traditional text log files like /var/log/messages by default.

Until now, though, collecting journald logs with the CloudWatch agent required extra configuration to export the journal contents to files first. Even though journald holds nicely structured information, that value was hard to take advantage of once everything got flattened into files, which was a bit of a frustrating gap.

What changes

With this update, the CloudWatch agent can read journald entries natively, so that detour through disk files is no longer necessary. On top of that, it preserves the structured metadata that journald captures, such as the systemd unit, priority, and process information, all the way through to CloudWatch Logs.

For anyone monitoring journald-based environments like Amazon Linux 2023 with CloudWatch, the nice part is that you can retire the whole export-logs-to-files workflow. Since it's clearer where each log came from (which systemd unit), investigations and building monitoring rules should get easier too.

Dive Deep

The filtering options are solid too. Before logs get published to CloudWatch Logs, you can narrow them down using:

  • Filtering by systemd unit
  • Filtering by journal priority level
  • Matching on journal fields
  • Regular expression filters

With these, you can cut down the noise from the flood of journald logs and keep a handle on log volume and cost.

This is available in all AWS Commercial Regions and GovCloud (US) regions. There's no new pricing tier for this either; standard Amazon CloudWatch Logs pricing applies to the ingested logs.

Wrap-up

Here's a recap of today's points.

  • The CloudWatch agent can now natively read journald logs
  • No more need to export to files, and structured metadata like the systemd unit, priority, and process info is preserved
  • You can filter by systemd unit, priority level, journal field, and regular expressions
  • Available in all AWS Commercial Regions and GovCloud (US), with standard CloudWatch Logs pricing

If you're running journald-based Linux instances like Amazon Linux 2023 and monitoring them with CloudWatch, this is a great chance to simplify your log collection setup!

Related posts