Merge pull request #277 from mnrkbys/journalctl

artif: new systemd journal artifacts

CHANGELOG.md

@@ -25,6 +25,7 @@
 - live_response/storage/lsblk.yaml: Added JSON output format for listing block devices [linux] ([mnrkbys](https://github.com/mnrkbys)).
 - live_response/system/coredump.yaml: Added collection of core dump files information [linux] ([mnrkbys](https://github.com/mnrkbys)).
 - live_response/system/getcap.yaml: Added functionality to collect the list of files with associated process capabilities [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/system/journalctl.yaml: Added collection of listing of time periods between boots [linux] ([mnrkbys](https://github.com/mnrkbys)).
 - live_response/system/ulimit.yaml: Added collection of all resource limits information [all] ([mnrkbys](https://github.com/mnrkbys)).
 - memory_dump/coredump.yaml: Added collection of core dump, ABRT, Apport, and kdump files [esxi, linux, netbsd] ([mnrkbys](https://github.com/mnrkbys)).
 

artifacts/files/logs/journal.yaml

@@ -1,8 +1,8 @@
-version: 1.0
+version: 1.1
 artifacts:
   -
     description: Collect journal log files.
     supported_os: [linux]
     collector: file
     path: /
-    name_pattern: ["*.journal"]
+    name_pattern: ["*.journal", "*.journal~"]

artifacts/live_response/system/journalctl.yaml

@@ -0,0 +1,10 @@
+version: 1.0
+condition: command_exists "journalctl"
+output_directory: /live_response/system
+artifacts:
+  -
+    description: Show a listing of time periods between boots.
+    supported_os: [linux]
+    collector: command
+    command: journalctl --list-boots
+    output_file: journalctl_--list-boots.txt