in_systemd: fix no journal data when reading from tail

[n-hass]

Adds a journal cursor step-back after seeking to journal tail. This is necessary in order for subsequent journal reads to return data. Fixes issue #8394.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [N/A] Run local packaging test showing all targets (including any new ones) build.
• [N/A] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [N/A] Documentation required for this feature

Backporting

• [N/A] Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

[n-hass]

Config tested:

[SERVICE]
  Log_Level   debug

[INPUT]
  Name            systemd
  Path /var/log/journal
  Read_From_Tail  On

[OUTPUT]
  Name  stdout
  Match *

Debug logs:

Fluent Bit v3.0.0
* Copyright (C) 2015-2024 The Fluent Bit Authors
* Fluent Bit is a CNCF sub-project under the umbrella of Fluentd
* https://fluentbit.io
...
____________________
< Fluent Bit v2.2.2 >
------------------- 
[2024/01/20 13:12:17] [ info] Configuration:
[2024/01/20 13:12:17] [ info]  flush time     | 1.000000 seconds
[2024/01/20 13:12:17] [ info]  grace          | 5 seconds
[2024/01/20 13:12:17] [ info]  daemon         | 0
[2024/01/20 13:12:17] [ info] ___________
[2024/01/20 13:12:17] [ info]  inputs:
[2024/01/20 13:12:17] [ info]      systemd
[2024/01/20 13:12:17] [ info] ___________
[2024/01/20 13:12:17] [ info]  filters:
[2024/01/20 13:12:17] [ info] ___________
[2024/01/20 13:12:17] [ info]  outputs:
[2024/01/20 13:12:17] [ info]      stdout.0
[2024/01/20 13:12:17] [ info] ___________
[2024/01/20 13:12:17] [ info]  collectors:
[2024/01/20 13:12:17] [ info] [fluent bit] version=3.0.0, commit=, pid=151411
[2024/01/20 13:12:17] [debug] [engine] coroutine stack size: 24576 bytes (24.0K)
[2024/01/20 13:12:17] [ info] [storage] ver=1.5.1, type=memory, sync=normal, checksum=off, max_chunks_up=128
[2024/01/20 13:12:17] [ info] [cmetrics] version=0.6.6
[2024/01/20 13:12:17] [ info] [ctraces ] version=0.4.0
[2024/01/20 13:12:17] [ info] [input:systemd:systemd.0] initializing
[2024/01/20 13:12:17] [ info] [input:systemd:systemd.0] storage_strategy='memory' (memory only)
[2024/01/20 13:12:17] [debug] [systemd:systemd.0] created event channels: read=27 write=28
[2024/01/20 13:12:17] [debug] [input:systemd:systemd.0] jump to the end of journal and skip 0 last entries
[2024/01/20 13:12:17] [debug] [input:systemd:systemd.0] sd_journal library may truncate values to sd_journal_get_data_threshold() bytes: 65536
[2024/01/20 13:12:17] [debug] [stdout:stdout.0] created event channels: read=32 write=138
[2024/01/20 13:12:17] [ info] [sp] stream processor started
[2024/01/20 13:12:17] [ info] [output:stdout:stdout.0] worker #0 started
[2024/01/20 13:12:19] [debug] [input chunk] update output instances with new chunk size diff=348, records=1, input=systemd.0
[2024/01/20 13:12:19] [debug] [task] created task=0x7fea3001ea70 id=0 OK
[2024/01/20 13:12:19] [debug] [output:stdout:stdout.0] task_id=0 assigned to thread #0
[0] systemd.0: [[1705718538.959576000, {}], {"_UID"=>"0", "_GID"=>"0", "_BOOT_ID"=>"2cf3461cc773488b9273c2d35fe746eb", "_MACHINE_ID"=>"8c313b0330e149afa8b4de9251886561", "_HOSTNAME"=>"praetor", "_RUNTIME_SCOPE"=>"system", "_TRANSPORT"=>"stdout", "_CAP_EFFECTIVE"=>"1ffffffffff", "PRIORITY"=>"7", "SYSLOG_IDENTIFIER"=>"testme", "_COMM"=>"/nix/store/khnd", "MESSAGE"=>"hello4", "_STREAM_ID"=>"380f50c296aa453daef3e00f3e159b92", "_PID"=>"151419"}]
[2024/01/20 13:12:19] [debug] [out flush] cb_destroy coro_id=0
[2024/01/20 13:12:19] [debug] [task] destroy task=0x7fea3001ea70 (task_id=0)
^C[2024/01/20 13:12:22] [engine] caught signal (SIGINT)
[2024/01/20 13:12:22] [ warn] [engine] service will shutdown in max 5 seconds
[2024/01/20 13:12:22] [ info] [input] pausing systemd.0
[2024/01/20 13:12:22] [ info] [engine] service has stopped (0 pending tasks)
[2024/01/20 13:12:22] [ info] [input] pausing systemd.0
[2024/01/20 13:12:22] [ info] [output:stdout:stdout.0] thread worker #0 stopping...
[2024/01/20 13:12:22] [ info] [output:stdout:stdout.0] thread worker #0 stopped

Valgrind summary:

==169809== Memcheck, a memory error detector
==169809== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==169809== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==169809== Command: ./bin/fluent-bit -c /root/fb.conf
==169809== 
... (see logs above)
==169809== 
==169809== HEAP SUMMARY:
==169809==     in use at exit: 0 bytes in 0 blocks
==169809==   total heap usage: 2,551 allocs, 2,551 frees, 1,178,625 bytes allocated
==169809== 
==169809== All heap blocks were freed -- no leaks are possible
==169809== 
==169809== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

[agup006]

Maybe @cosmo0920 could take a look?

[cosmo0920]

Thank you for your work. I confirmed that the previous behavior that returns two journal entries is restored with this patch.

[pwhelan]

LGTM. No idea why I was flagged as CODEOWRNERS though.

[n-hass]

Is there anything holding this up besides CODEOWNER approval? Sorry for the ping @edsiper @leonardo-albertovich @fujimotos @koleini

[jfroche]

This fix works for us as well. Thank you !
Hopefully it get merged soon.

[n-hass]

hey @edsiper ... can we please get some movement on this? Or another code-owner who can review this one-line fix and merge?

[n-hass]

Fixed by #8917