Journald watcher for instant pages or a periodic digest for runtime service failures on openSUSE?
0 reputation · 19 Oct 2020, 19:18 UTC
I run a small openSUSE Leap server and want to be notified only about actionable failures, not routine log traffic. Boot-time health is already covered by health-checker with snapper rollback on my btrfs root, which gives me a single meaningful signal when a boot goes bad. The gap is runtime failures, such as a systemd unit failing mid-day while the system keeps running.
Two documented approaches seem possible. One is a journald-based watcher (a systemd timer or persistent unit running journalctl with priority and unit filters like -p err and -u) that notifies as soon as a matching error appears. The other is batching the same filtered journal output into a periodic digest, so failures surface on a schedule instead of immediately.
My constraints: I am the only admin, so alert fatigue matters, but some services are customer-facing and a multi-hour digest delay could hurt. I also know journald rate limiting can drop bursts, which might affect either approach.
Which approach fits a single-admin setup where only a few units are truly urgent? Is there a documented way to page immediately for specific units while digesting everything else, without running two separate alerting pipelines?