journald.go RawHistoryFolder

1package accesslog
2
3import (
4	"fmt"
5	"strings"
6
7	"github.com/coreos/go-systemd/v22/journal"
8)
9
10// journalEnabledFunc and journalSendFunc are package-level variables so that
11// tests can replace them with stubs without requiring a live systemd journal.
12var (
13	journalEnabledFunc = journal.Enabled
14	journalSendFunc    = func(msg string, priority journal.Priority, vars map[string]string) error {
15		return journal.Send(msg, priority, vars)
16	}
17)
18
19// journaldSink writes access log lines directly to the systemd journal with a
20// distinct SYSLOG_IDENTIFIER so security tools (CrowdSec, fail2ban) can filter
21// on the identity without catching application logs.
22type journaldSink struct {
23	// vars is built once at construction and reused on every write to avoid a
24	// per-request map allocation.
25	vars map[string]string
26}
27
28func newJournaldSink(cfg Config) (*journaldSink, error) {
29	id := strings.TrimSpace(cfg.SyslogIdentifier)
30	if id == "" {
31		return nil, fmt.Errorf("accesslog: journald output requires a non-empty syslog_identifier")
32	}
33	if !journalEnabledFunc() {
34		return nil, fmt.Errorf("accesslog: journald output requested but journald is not available on this system")
35	}
36	return &journaldSink{
37		vars: map[string]string{"SYSLOG_IDENTIFIER": id},
38	}, nil
39}
40
41func (s *journaldSink) WriteLine(line string) error {
42	if err := journalSendFunc(line, journal.PriInfo, s.vars); err != nil {
43		return fmt.Errorf("accesslog: journald write: %w", err)
44	}
45	return nil
46}
47
48func (s *journaldSink) Close() error { return nil }