Add journalctl for ssh by default

Origin: https://github.com/crowdsecurity/crowdsec/pull/2316/

Gbp-Pq: Name 0017-fix-default-acquisition.patch

diff --git a/config/acquis.yaml b/config/acquis.yaml
index cc3631f3ee2fb53bc6e591c5f8b2ccfc68008ae7..f0f9995b394b86bb2a79b16a5ce31d3f5e95afe2 100644 (file)
--- a/config/acquis.yaml
+++ b/config/acquis.yaml
@@ -11,6 +11,12 @@ filenames:
 labels:
   type: syslog
 ---
+source: journalctl
+journalctl_filter:
+ - "_SYSTEMD_UNIT=ssh.service"
+labels:
+  type: syslog
+---
 filename: /var/log/apache2/*.log
 labels:
   type: apache2