JOURNAL-BRIEF(1)

NAME
journal-brief - show interesting new systemd journal entries since last run

SYNOPSIS
journal-brief [OPTIONS] [COMMAND] ...

DESCRIPTION

journal-brief is a command-line tool that reads the systemd journal and prints journal entries that match configured inclusion/exclusion rules. It maintains an internal bookmark of the last processed entry so that each invocation only outputs entries that are new since the previous run. This makes it suitable for automated usage to generate periodic briefings of relevant journal events or to feed automatic processing tools such as fail2ban or logcheck.

By default, journal-brief sends matching journal entries to standard output. A YAML configuration file can be used to customize which fields and values to include or exclude.

OPTIONS

-h, --help
    Show usage information and exit.

-V, --version
    Print version information and exit.

-b, --bookmark
    Set the current position in the journal as the bookmark without emitting any entries. Useful for establishing a baseline.

--dry-run
    Process entries without updating the stored bookmark. Outputs matching entries and leaves the bookmark unchanged.

debrief
    Generate default inclusion/exclusion rules by scanning recent journal entries.

CONFIGURATION
journal-brief reads a YAML configuration file that controls inclusion and exclusion criteria.

priority: VALUE
    Limits matching entries to those at or above the given syslog priority (err, warning, info).

inclusions:
    List of maps specifying journal fields and values. An entry is included if it matches all key/value conditions in one of the maps.

exclusions:
    List of maps specifying fields and values whose combination should be excluded. Applied after inclusion logic.

EMAIL configuration (optional)
    Optional section to send output via external mailer or SMTP.

EXAMPLES

Minimal configuration: only errors
    ~/.config/journal-brief/journal-brief.conf priority: err inclusions: - _SYSTEMD_UNIT: "*"

Include multiple units, exclude routine noise
    ~/.config/journal-brief/journal-brief.conf priority: warning inclusions: - _SYSTEMD_UNIT: sshd.service - _SYSTEMD_UNIT: docker.service - _SYSTEMD_UNIT: nginx.service exclusions: - MESSAGE: "Accepted publickey*" - MESSAGE: "Starting container*"

Include entries from cron process related to backups
    ~/.config/journal-brief/journal-brief.conf priority: info inclusions: - _COMM: cron MESSAGE: "*backup*" exclusions: - MESSAGE: "*successfully completed*"

Automatically generate a starting configuration
    shell journal-brief --dry-run debrief > ~/.config/journal-brief/journal-brief.conf

FILES

~/.config/journal-brief/journal-brief.conf
    User configuration file containing inclusions, exclusions, and other preferences.

ENVIRONMENT
No specific environment variables are required, but the typical systemd/journalctl environment applies (permissions, journal access).

AUTHORS
Maintained by twaugh on GitHub; releases also published on PyPI.

SEE ALSO
journalctl(1), systemd-journal-fields(7)