pyr0ball
d769be04d4
Local Heimdall sources (journal, Docker containers, network syslog) are now tailed continuously by the built-in watcher via watch.yaml — no periodic collection needed for those. SSH collection of remote node journals is now handled by a systemd timer (turnstone-cluster-collect.service/.timer) instead of cron. collect_cluster_logs.sh simplified to only SSH-collect remote nodes and trigger ingest directly. docker-cluster.sh updated to mount: - /var/run/docker.sock (so watcher can run docker logs -f) - /run/systemd/journal (so watcher can run journalctl -f) - /devl/turnstone-cluster/patterns/ (cluster-specific watch.yaml)
12 lines
237 B
SYSTEMD
12 lines
237 B
SYSTEMD
[Unit]
|
|
Description=Turnstone — remote cluster journal collection (every 15 min)
|
|
Requires=turnstone-cluster-collect.service
|
|
|
|
[Timer]
|
|
OnBootSec=2min
|
|
OnUnitActiveSec=15min
|
|
AccuracySec=30s
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|