add journalctl launcher logs to flare (#1592)

kolide · Feb 9, 2024 · 0915b7d · 0915b7d
1 parent d67f7c1
commit 0915b7d
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 3 deletions.
diff --git a/ee/allowedcmd/cmd_linux.go b/ee/allowedcmd/cmd_linux.go
@@ -62,6 +62,10 @@ func Ip(ctx context.Context, arg ...string) (*exec.Cmd, error) {
 	return validatedCommand(ctx, "/usr/sbin/ip", arg...)
 }
 
+func Journalctl(ctx context.Context, arg ...string) (*exec.Cmd, error) {
+	return validatedCommand(ctx, "/usr/bin/journalctl", arg...)
+}
+
 func Loginctl(ctx context.Context, arg ...string) (*exec.Cmd, error) {
 	return validatedCommand(ctx, "/usr/bin/loginctl", arg...)
 }

diff --git a/ee/debug/checkups/init_logs_linux.go b/ee/debug/checkups/init_logs_linux.go
@@ -3,8 +3,24 @@ package checkups
 import (
 	"archive/zip"
 	"context"
+	"fmt"
+
+	"github.com/kolide/launcher/ee/allowedcmd"
 )
 
-func writeInitLogs(_ context.Context, _ *zip.Writer) error {
-	return nil
+func writeInitLogs(ctx context.Context, logZip *zip.Writer) error {
+	cmd, err := allowedcmd.Journalctl(ctx, "-u", "launcher.kolide-k2.service")
+	if err != nil {
+		return fmt.Errorf("creating journalctl command: %w", err)
+	}
+
+	outFile, err := logZip.Create("linux_journalctl_launcher_logs.json")
+	if err != nil {
+		return fmt.Errorf("creating linux_journalctl_launcher_logs.json: %w", err)
+	}
+
+	cmd.Stderr = outFile
+	cmd.Stdout = outFile
+
+	return cmd.Run()
 }
diff --git a/ee/debug/checkups/init_logs_windows.go b/ee/debug/checkups/init_logs_windows.go
@@ -9,7 +9,7 @@ import (
 )
 
 func writeInitLogs(ctx context.Context, logZip *zip.Writer) error {
-	cmdStr := `Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='launcher'} | ConvertTo-Json`
+	cmdStr := `Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='launcher'} | ForEach-Object { $_.Message }`
 	cmd, err := allowedcmd.Powershell(ctx, cmdStr)
 	if err != nil {
 		return fmt.Errorf("creating powershell command: %w", err)