Announcements
Security Advisories
CVE-2024-10526
CVE-2023-5950
CVE-2023-2226
CVE-2023-0242
CVE-2023-0290
Documentation
Velociraptor Overview
History
Support Policy
Deployment
Self-Signed SSL
Cloud Deployment
Multi-Frontend
Organizations
Deploying Clients
Security
Performance
Troubleshooting
Config Reference
The Admin GUI
Artifacts
Hunting
Managing Clients
Searching for clients
Client Labels
Client Monitoring
Virtual File System
Shell Commands
Troubleshooting
VQL Fundamentals
Notebooks
Artifacts
JOIN in VQL
Event Queries
Forensic Analysis
Searching Filenames
Velociraptor Paths
Remapping Accessors
Searching Content
NTFS Analysis
Binary parsing
Evidence Of Execution
Event Logs
Volatile State
Triage and acquisition
Remote Uploads
Extending VQL
Server Automation
Server API
Server Monitoring
Downloads
VQL Reference
Frequently Used ✨
Windows-only
Linux-only
Server-only
Parsers
Encode/Decode
Event Plugins
Experimental
Developer
Other
Accessors
Training
Playbooks
Blog
Presentations
Linux Conf Au 2022
Auscert 2022
SANS Summit 2022
Velocon 2022
DFRWS APAC 2022
EverythingOpen 2023
VeloCON 2023
Auscert 2024
Auscert 2024 Talk
Artifact Exchange
Artifact Reference
Knowledge Base
Search
Github
Discord
YouTube
Mailing List
RSS
Rapid7 Docs
watch_journald
watch_journald
Description
watch_journald
Plugin
Arg
Description
Type
filename
A list of journal log files to parse.
list of OSPath (required)
accessor
The accessor to use.
string
raw
Emit raw events (not parsed).
bool
Required permissions:
FILESYSTEM_READ
Description
Watch a journald file and stream events from it.