- Add scripts/export_journal.sh — dumps recent journal (priority 0-5, 20min window) to /opt/turnstone/data/journal-export.jsonl; idempotent via entry_id deduplication so overlap is safe - Add system-journal source to sources.yaml pointing at the export file - Add 9 system-level patterns to default.yaml: systemd_fail, oom_kill, disk_hw_error, fs_error, kernel_error, ssh_brute, container_crash, smart_error, nfs_error |
||
|---|---|---|
| .. | ||
| default.yaml | ||
| sources.yaml | ||