in_systemd: Move one record back after skipping to the end

[ardavast]

On recent versions of systemd, read_from_tail() doesn't work as expected unless followed with a call to sd_journal_previous().

This can be tested with: fluent-bit -i systemd -p read_from_tail=On -o stdout
The command works on:

• Ubuntu 22.10 with systemd 251 (251.4-1ubuntu7.3)
• Yocto mickledore with systemd 253 (253.1)

But it doesn't work on:

• Ubuntu 24.04 with systemd 255 (255.4-1ubuntu8.1)
• Yocto nanbield with systemd 254 (254.4)

The following short program can also be used to test this (uncomment the line that calls sd_journal_previous() to see the difference):

#include <stdio.h>
#include <stdlib.h>
#include <systemd/sd-journal.h>

int main(void) {
    sd_journal *j;
    int ret;

    sd_journal_open(&j, SD_JOURNAL_LOCAL_ONLY);
    sd_journal_seek_tail(j);
    //sd_journal_previous(j);

    for (;;) {
        sd_journal_wait(j, (uint64_t) -1);
        while (sd_journal_next(j) > 0) {
            const char *d;
            size_t l;

            if (sd_journal_get_data(j, "MESSAGE", (const void **)&d, &l) >= 0) {
                printf("%.*s\n", (int)l, d);
            }
        }
    }

    sd_journal_close(j);

    return 0;
}

[edsiper]

@ardavast thanks for this contribution, would you please sign off the commits ? (DCO error)

[ardavast]

@ardavast thanks for this contribution, would you please sign off the commits ? (DCO error)

Done

[leonardo-albertovich]

According to the manual this seems to be correct :

Note that these calls do not actually make any entry the new current entry, this needs to be done in a separate step with a subsequent [sd_journal_next(3)](https://manpages.debian.org/testing/libsystemd-dev/sd_journal_next.3.en.html) invocation (or a similar call).

[n-hass]

I’m SO glad this got merged finally! This fix has existed since my PR #8396, but I was getting radio silence :( thank you so much for finally getting this merged