
# @@{SYSTEMD_JOURNAL} is set by 20_aide_run_systemd-journald
!/@@{RUN}/systemd/journal$ d
!/@@{RUN}/systemd/journal/(dev-log|socket|stdout|syslog)$ s
!/@@{RUN}/systemd/journal/flushed$ f
/@@{RUN}/systemd/journal/kernel-seqnum$ f VarFile
!/@@{RUN}/systemd/journal/streams$ d
!/@@{RUN}/systemd/journal/io\\.systemd\\.journal$ s
!/@@{RUN}/systemd/journal/streams/[[:digit:]]:[[:digit:]]+$ f
/@@{SYSTEMD_JOURNAL}?$ d RecreatedDir
/@@{SYSTEMD_JOURNAL}/@@{MACHINEID}$ d RecreatedDir
# we cannot monitor gid and acls on journald. This is not going
# to be fixed upstream, see #934284 and
# https://github.com/systemd/systemd/issues/22729
/@@{SYSTEMD_JOURNAL}/@@{MACHINEID}/(system|user-[[:digit:]]+)\\.journal$ f VarFile-g-acl
!/@@{SYSTEMD_JOURNAL}/@@{MACHINEID}/(system|user-[[:digit:]]+)@[[:xdigit:]]{32}-[[:xdigit:]]{16}-[[:xdigit:]]{16}\\.journal$ f

@@if defined SYSTEMD_JOURNAL_EXTRA
/@@{SYSTEMD_JOURNAL}/@@{MACHINEID}/@@{SYSTEMD_JOURNAL_EXTRA}\\.journal$ f VarFile
@@endif

