Gabier Docs
Browse the documentation

Reference

CLI

The Gabier subcommands — run, test, check and replay — plus the global --config and --dry-run flags, config lookup order and the logging environment variables.

Four subcommands. run is the default, which is what the systemd unit calls.

CommandWhat it does
gabierWatch the logs. Same as gabier run.
gabier run --quiet-startWatch, without the “surveillance started” notification.
gabier testPost one test message on every configured destination.
gabier checkValidate the config and reach every webhook, without publishing anything.
gabier replay <file>Run a log file through the whole pipeline.

Two flags are global, valid on every subcommand:

FlagEffect
-c, --config <path>Config file. Otherwise ./config.toml, then /etc/gabier/config.toml.
--dry-runPrint notifications instead of sending them.

run

$ sudo -u gabier gabier run --config /etc/gabier/config.toml
gabier démarre host=vps-prod-1 source=journald vers=discord+slack

Runs until SIGTERM or Ctrl-C, flushing any pending burst summary on the way out. On start it announces itself in the channel, which is how you know the service came back after a reboot — pass --quiet-start to suppress that.

test

$ sudo -u gabier gabier test --config /etc/gabier/config.toml
Envoyé. Regarde ton salon Discord.

Posts one real message per destination and exits non-zero if nothing left. Use it right after pasting a webhook: it proves the URL, the network path and the channel permissions in one shot.

check

$ sudo -u gabier gabier check --config /etc/gabier/config.toml
config    /etc/gabier/config.toml
serveur   vps-prod-1
source    journald (ssh, sshd)
évènements accepted=true failed=true invalid_user=true closed=false
anti-spam 1 échec(s) par IP, puis résumé toutes les 300s
geoip     false
discord   https://discord.com/api/webhooks/123/abcd…
          joignable

Tout est prêt.

Parses the config, prints it with the webhook token masked, and probes every destination — without posting anything to the channel. It reports all the broken destinations rather than stopping at the first, and exits non-zero if any failed:

$ sudo -u gabier gabier check && sudo systemctl restart gabier

replay

$ gabier replay tests/fixtures/auth.log --dry-run --config config.example.toml

412 lignes, 180 évènements, 7 notifications, 173 échecs regroupés.

Feeds a log file through the parser, the filters and the throttle. With --dry-run nothing is sent, so it is the safe way to see how a config behaves against real traffic before you commit to it — and the fastest way to check that your distribution’s log format is parsed correctly.

Config lookup

With no --config, in order:

  1. ./config.toml
  2. /etc/gabier/config.toml

The first one that exists wins. If neither does, Gabier exits with pas de config trouvée, passe --config.

Environment

VariableEffect
RUST_LOGLog filter. gabier=debug logs the decisions; the default is info.
GABIER_DISCORD_WEBHOOKSupplies discord.webhook_url.
GABIER_SLACK_WEBHOOKSupplies slack.webhook_url.
JOURNAL_STREAMSet by systemd. Gabier notices and drops its own timestamps and colours, since journald adds them.

Logs go to stderr, so journalctl -u gabier -f is the right way to read them under systemd.