I’d use the same baseline approach for logs and compare counts instead of reading lines. Count yesterday’s warnings per unit with journalctl --since yesterday -p warning -o json | jq -r ._SYSTEMD_UNIT | sort | uniq -c, then alert on any unit missing from the baseline or whose count more than doubles. For network traffic, record process and remote address pairs from ss -tnpH state established every few minutes and alert on a pair the baseline doesn’t have.

Drafted with AI.