Scroll to navigation

JOURNAL-BRIEF(1) journal-brief manual JOURNAL-BRIEF(1)

NAME

journal-brief - show interesting new systemd journal entries since last run

SYNOPSIS

journal-brief [OPTIONS] [COMMAND] ...

DESCRIPTION

journal-brief is a command-line tool that reads the systemd journal and prints journal entries that match configured inclusion/exclusion rules. It maintains an internal bookmark of the last processed entry so that each invocation only outputs entries that are new since the previous run. This makes it suitable for automated usage to generate periodic briefings of relevant journal events or to feed automatic processing tools such as fail2ban or logcheck.

By default, journal-brief sends matching journal entries to standard output. A YAML configuration file can be used to customize which fields and values to include or exclude.

OPTIONS

Show usage information and exit.
Print version information and exit.
Set the current position in the journal as the bookmark without emitting any entries. Useful for establishing a baseline.
Process entries without updating the stored bookmark. Outputs matching entries and leaves the bookmark unchanged.
Generate default inclusion/exclusion rules by scanning recent journal entries.

CONFIGURATION

journal-brief reads a YAML configuration file that controls inclusion and exclusion criteria.

Limits matching entries to those at or above the given syslog priority (err, warning, info).
List of maps specifying journal fields and values. An entry is included if it matches all key/value conditions in one of the maps.
List of maps specifying fields and values whose combination should be excluded. Applied after inclusion logic.
Optional section to send output via external mailer or SMTP.

EXAMPLES

~/.config/journal-brief/journal-brief.conf priority: err inclusions: - _SYSTEMD_UNIT: "*"
~/.config/journal-brief/journal-brief.conf priority: warning inclusions: - _SYSTEMD_UNIT: sshd.service - _SYSTEMD_UNIT: docker.service - _SYSTEMD_UNIT: nginx.service exclusions: - MESSAGE: "Accepted publickey*" - MESSAGE: "Starting container*"
~/.config/journal-brief/journal-brief.conf priority: info inclusions: - _COMM: cron MESSAGE: "*backup*" exclusions: - MESSAGE: "*successfully completed*"
shell journal-brief --dry-run debrief > ~/.config/journal-brief/journal-brief.conf

FILES

~/.config/journal-brief/journal-brief.conf
User configuration file containing inclusions, exclusions, and other preferences.

ENVIRONMENT

No specific environment variables are required, but the typical systemd/journalctl environment applies (permissions, journal access).

AUTHORS

Maintained by twaugh on GitHub; releases also published on PyPI.

SEE ALSO

journalctl(1), systemd-journal-fields(7)

January 2026 1.0