Continuously monitor Systemd Journals

Question

I am working with systemd journals to create a custom log processing program. I am trying to work with sd_journal APIs but I have a couple of questions:

1. Is it possible to listen the runtime journals (SD_JOURNAL_RUNTIME_ONLY) without polling? SD_JOURNAL_FOREACH_DATA and sd_journal_get_data doesn't say much about this.
2. In your opinion, is this a good design?
3. Is there a way to understand where are the runtime logs getting forwarded? I did "systemctl status systemd-journald.service" and the service status is running. However, when I am trying to read journals using sd_journal_open, it doesn't show any entry. I can see the entries through journalctl. I want to do this without reading journal files (by sniffing /run/log/journal which is a unix domain socket) to avoid disk io.

Here is the sample code I am using:

#include <stdio.h>                                                                                         
#include <unistd.h>                                                                                        
#include <stdlib.h>                                                                                        

#include <systemd/sd-journal.h>                                                                          
#include <systemd/sd-daemon.h>                                                                           

int main(int argc, char *argv[]) {                                                                       

  int ret_val = 0;                                                                                       
  int count = 0;                                                                                         
  sd_journal *jd;                                                                                        

  sd_journal_print(LOG_INFO, "Hello World, this is PID %lu!", (unsigned long) getpid());                 

  do {                                                                                                   
    ret_val = sd_journal_open (&jd, SD_JOURNAL_SYSTEM | SD_JOURNAL_RUNTIME_ONLY | SD_JOURNAL_LOCAL_ONLY);
    if (ret_val != 0) {                                                                                  
      fprintf(stderr, "Failed to open journal: %s\n", strerror(-ret_val));                               
      break;                                                                                             
    }                                                                                                    

    printf ("Current Journal was loaded successfully!\n");                                               

    const void *d;                                                                                       
    size_t l;                                                                                            

    SD_JOURNAL_FOREACH_DATA (jd, d, l) {                                                                 
      printf("%.*s\n", (int)l, (const char*) d);                                                                                                                                                              
      count++;                                                                                           
    }                                                                                                    

    sd_journal_close(jd);                                                                                
    printf ("# of Journal entries read: %d\n", count);                                                          
  } while (0);                                                                                           
  return 0;                                                                                                  
}        

Answer 1

It took me a while to figure out but the problem was fairly simple. The problem was in the use of

SD_JOURNAL_RUNTIME_ONLY

while the journald storage was specified as persistent.

To me, it was non-intuitive that persistent journals doesn't go to runtime journal buffer. So the only way to simulate the functionality of journalctl -f was by opening the local journals and seek the tail.