Exit "journalctl --follow" based on `--grep` matches

[jaybeers]

Component

journalctl

Is your feature request related to a problem? Please describe

It would be nice if journalctl --follow could automatically exit based on the presence (or absence) of a regular expression in its output.

Describe the solution you'd like

I'd like the following optional parameters to be added to journalctl:

--grep-count <count>

This is the main one that would immediately improve my life. 🙂 With this parameter, journalctl would exit when <count> matches of the pattern provided with --grep were seen in the output. If this parameter had a default value, it would be 1.

Negative values could be used with the semantic "if you see the pattern this many times, exit with an error status", I suppose.

--grep-timeout <duration>

This one would be nice as well; I thought of it in terms of Konsole's "Monitor for Silence" function. With this parameter, journalctl would exit if <duration> time passes without a match of the pattern provided with --grep in the output. To me, it makes sense for <duration> to be specified in seconds, but whatever makes the most sense.

Using both together

The parameters --grep-count and --grep-timeout could be used independently; if both were provided then either one would trigger an exit. The practical upshot is that, for example, this command:

journalctl --follow --grep "all clear" --grep-count 3 --grep-timeout 300

...would exit when the string all clear had appeared three times, or 300 seconds had passed (whichever occurs first).

Ideally, you'd be able to tell which of these occurred based on the exit status. That way, you could wrap some kind of automation around it when you start a service, that could know whether the service started up properly or not based on the exit status (which tells it whether journalctl saw the all-clear message(s) or timed out).

Describe alternatives you've considered

I've currently cobbled together this jankimplemented this elegant solution¹, which does get (part of) the job done²:

journalctl -f | while read LINE; do
    grep_output=$(echo "${LINE}" | grep --color=always -P -- "all clear")
    if [ -z "${grep_output}" ]; then
        echo "${LINE}"
    else
        echo "${grep_output}"
        break
    fi
done

However, this doesn't provide analogues for:

• ...--grep-count with values other than 1, or
• ...--grep-timeout,

...so having the functionality built in to journalctl would be better.³

---

¹ When I'm using this in the wild, it's a one-liner strung together with semicolons; I've added indentation here so it's friendlier to read.

² Made possible by the work done in #9374 which allows journalctl to exit when its stdout closes...thanks!

³ Having said the above, I'm down for any level of ridiculousness if somebody's got a workaround, as long as it can be a one-liner; I've got tooling to insert arbitrary strings into the terminal when I'm doing this task, so even some absurd 2000-character monstrosity would be fine since I'm not going to be typing it in (or even copy/pasting it).

The systemd version you checked that didn't have the feature you are asking for

249.11