JOURNAL-BRIEF(1)

📦 version 1.1.8, in ubuntu resolute, ubuntu stonking

💖 JOURNAL-BRIEF 💖

okay bestie, gather round, because journal-brief (that's the manual page name, we're keeping it, it's iconic) is about to become your new fave. it's a journal-brief manual page situation, version 1.0, and it's giving "your journal, but only the tea" 🫖✨

✨ SYNOPSIS ✨

journal-brief [OPTIONS] [COMMAND] ...

that's it. that's the whole vibe. 💅

🌸 DESCRIPTION 🌸

so journal-brief is a command-line tool that reads the systemd journal and prints out the journal entries that match your configured inclusion/exclusion rules. that's the whole job. it's a filter, and it's a slay filter. 🎀

here's the magic part, and no cap, this is the whole reason it exists: it keeps an internal bookmark of the last entry it processed. so every single time you run it, it only spits out entries that are new since the previous run. literally only the fresh stuff. the way that works is so satisfying. 😭

which means it's built for automated usage — like generating periodic briefings of the journal events you actually care about, or feeding automatic processing tools such as fail2ban or logcheck. it's the behind-the-scenes bestie making everyone else's job easier. 👑

by default, journal-brief sends matching journal entries to standard output. and if you wanna get fancy, a YAML configuration file can customize exactly which fields and values get included or excluded. main character customization energy fr fr. 🦋

💅 OPTIONS 💅

  • -h, --help — shows you the usage info and then dips out. exit stage left. 🙈
  • -V, --version — prints the version information and exits. identity check, periodt.
  • -b, --bookmark — sets the current position in the journal as the bookmark without emitting any entries at all. so useful for establishing a baseline — like, "okay, everything up to here is old news, start fresh from this point." 📌
  • --dry-run — processes entries without updating the stored bookmark. it still outputs the matching entries, it just leaves the bookmark exactly where it was. a little peek, no commitment. we love a low-stakes trial run. 💖
  • debrief — generates default inclusion/exclusion rules by scanning recent journal entries. basically it reads the room and writes the rules for you. iconic behavior honestly. ✨

🎀 CONFIGURATION 🎀

journal-brief reads a YAML configuration file, and that file is what controls your inclusion and exclusion criteria. let's go through it, bestie.

priority: VALUE

limits matching entries to those at or above the given syslog priority. the values you can use are:

  • err
  • warning
  • info

so like, err is the loudest drama, info is the quietest gossip. 🌈

inclusions:

a list of maps that specify journal fields and values. an entry gets included if it matches all key/value conditions in one of the maps. so within a single map, everything has to line up; across maps, it's an "or". got it? got it. 💜

exclusions:

a list of maps specifying fields and values whose combination should be excluded. and important detail: this gets applied after the inclusion logic. so inclusion gets first pick, then exclusion comes through and vetoes. 💀

EMAIL configuration (optional)

an optional section to send output via an external mailer or SMTP. yes, it can email you. yes, that's a lot of power. 🫶

🌟 EXAMPLES 🌟

Minimal configuration: only errors

~/.config/journal-brief/journal-brief.conf priority: err
inclusions:   - _SYSTEMD_UNIT: "*"

just the errors. minimal. clean. no clutter. we stan. ✨

Include multiple units, exclude routine noise

~/.config/journal-brief/journal-brief.conf priority: warning inclusions:   - _SYSTEMD_UNIT: sshd.service   - _SYSTEMD_UNIT: docker.service   - _SYSTEMD_UNIT: nginx.service exclusions:   - MESSAGE: "Accepted publickey*"   - MESSAGE: "Starting container*"

three units in, two noisy message patterns out. the vibes are curated. 🎀

~/.config/journal-brief/journal-brief.conf priority: info inclusions:   - _COMM: cron     MESSAGE: "*backup*" exclusions:   - MESSAGE: "*successfully completed*"

you want the backup chatter, but not the "everything went fine" spam. correct take, honestly. 😌

Automatically generate a starting configuration

shell journal-brief --dry-run debrief > ~/.config/journal-brief/journal-brief.conf

let the tool write its own config. delegating. queen behavior. 👑

🦋 FILES 🦋

  • ~/.config/journal-brief/journal-brief.conf — your user configuration file, holding the inclusions, exclusions, and other preferences. this is home base. 🏠💖

🌈 ENVIRONMENT 🌈

no specific environment variables are required. nope, none. but the typical systemd/journalctl environment applies — so, like, permissions and journal access. basically if journalctl can see it, you're good. 🔑

👑 AUTHORS 👑

maintained by twaugh on GitHub; releases are also published on PyPI. thank you for your service, we appreciate you. 🫶

⭐ SEE ALSO ⭐

go read those too, bestie, they're the supporting cast and they carry. 💜

ngl, that internal bookmark thing is the entire plot and it ate. run it, bookmark it, let it brief you. periodt. 💅

and that's the whole page, bestie — version 1.0, dated January 2026, straight from the journal-brief manual. mwah. 💖🎀✨

📦 where this page comes from