Continuously monitor Systemd Journals
<p>I am working with systemd journals to create a custom log processing program. I am trying to work with sd_journal APIs but I have a couple of questions:</p>

<ol>
<li><strong>Is it possible to listen the runtime journals</strong> (SD_JOURNAL_RUNTIME_ONLY) without polling? SD_JOURNAL_FOREACH_DATA and sd_journal_get_data doesn't <a href="http://www.dsm.fordham.edu/cgi-bin/man-cgi.pl?topic=sd_journal_next&amp;ampsect=3" rel="noreferrer">say much</a> about this.</li>
<li>In your opinion, <strong>is this a good design</strong>?</li>
<li>Is there a way to understand <strong>where are the runtime logs getting forwarded</strong>? I did "systemctl status systemd-journald.service" and the service status is running. However, when I am trying to read journals using sd_journal_open, it doesn't show any entry. I can see the entries through journalctl. I want to do this without reading journal files (by sniffing /run/log/journal which is a unix domain socket) to avoid disk io.</li>
</ol>

<p>Here is the sample code I am using:</p>

<pre><code>#include &lt;stdio.h&gt;                                                                                         
#include &lt;unistd.h&gt;                                                                                        
#include &lt;stdlib.h&gt;                                                                                        

#include &lt;systemd/sd-journal.h&gt;                                                                          
#include &lt;systemd/sd-daemon.h&gt;                                                                           

int main(int argc, char *argv[]) {                                                                       

  int ret_val = 0;                                                                                       
  int count = 0;                                                                                         
  sd_journal *jd;                                                                                        

  sd_journal_print(LOG_INFO, "Hello World, this is PID %lu!", (unsigned long) getpid());                 

  do {                                                                                                   
    ret_val = sd_journal_open (&amp;jd, SD_JOURNAL_SYSTEM | SD_JOURNAL_RUNTIME_ONLY | SD_JOURNAL_LOCAL_ONLY);
    if (ret_val != 0) {                                                                                  
      fprintf(stderr, "Failed to open journal: %s\n", strerror(-ret_val));                               
      break;                                                                                             
    }                                                                                                    

    printf ("Current Journal was loaded successfully!\n");                                               

    const void *d;                                                                                       
    size_t l;                                                                                            

    SD_JOURNAL_FOREACH_DATA (jd, d, l) {                                                                 
      printf("%.*s\n", (int)l, (const char*) d);                                                                                                                                                              
      count++;                                                                                           
    }                                                                                                    

    sd_journal_close(jd);                                                                                
    printf ("# of Journal entries read: %d\n", count);                                                          
  } while (0);                                                                                           
  return 0;                                                                                                  
}        
</code></pre>