systemd-Journal by file

[ktsaou]

Operating systemd-journal file-by-file is about 2x faster compared to the default.

On my tests, the current master version of systemd-journal needs 29.2 seconds, while the new one needs 13.5 seconds, for a given time-frame query.

The changes on this PR:

• maintain a registry of journal files
• add support for volatile journal files, even when netdata runs in a container (/run/log/journal)
• display the actual realtime timestamp associated with a log entry. The current master presents the timestamp the log was received by journald, while this PR extracts the actual timestamp the log was generated.
• overloads fstat64() libc system call, to speed up libsystemd (Journalctl: 13x faster by caching fstat() and optimizing timestamps retrieval systemd/systemd#29261)
• support for multiple log sources (including system and user logs, journald namespaces, logs from remote hosts), allowing the user to select the sources of interest.
• fixed several issues related to forward/backward data-only queries
• support for slicing the logs using journal matches

[Ancairon]

Morning! Just a note, I see a README file in the additions, (I see you used the old way of adding metadata to it, doesn't work anymore, no worries) I can add it to Learn, under Data Collection as its own entry (outside of integrations folders, on the same level as System metrics and the likes. For it to appear as an integration we would need to have it inside integrations.js (I feel this is not the goal here, so when this is merged I will add it to the spot I mentioned). Just FYI