How can you capture Linux systemd logs using the CloudWatch Agent?

Question

I want to use the CloudWatch agent to capture events in systemd's Journal. I checked the CloudWatch agent docs but couldn't find anything relevant. I did find some old 3rd party projects on Github (journald-cloudwatch-logs, systemd-cloud-watch) that looked like they might work but I wanted to see if there was something native before I started down the path of "unknown" code.

A possible workaround might be to have journalcrl save service.unit to a log file and then ingest that with a normal "logs" CloudWatch agent config. But that seems pretty messy and would require some maintenance (rotate log files, etc.)

A possible workaround might be to have `journalcrl` save service.unit to a log file and then ingest that with a normal "logs" CloudWatch agent config.  But that seems pretty messy and would require some maintenance (rotate log files, etc.)

Answer

One solution might be to use Datadog's Vector product to facilitate logging.  Vector can use [journald as a "source"](https://vector.dev/docs/reference/configuration/sources/journald/) and [CloudWatch Logs and a "sink"](https://vector.dev/docs/reference/configuration/sinks/aws_cloudwatch_logs/).

Another thought is to modify the systemd service file to save logging events to a physical file and then configure the CloudWatch agent to process that file.  However, this requires us to manage a log file, and on a long running system that is tedious.  I don't really want to worry about filling up the disk with old log information.  And it seems much more efficient to just process journald directly.

However, I've never used Vector and can't be sure how it will work in practice.  It may be that using a physical log file is easier and more reliable.

Wouldn't it be great if CloudWatch logs could talk to journald directly?  Or even process a STDOUT stream?  That way we could pipe information directly into CW without having to go through all this trouble.

How can you capture Linux systemd logs using the CloudWatch Agent?

Relevant content