monitor.sh

#!/bin/sh
( tail -n 0 -f --follow=name --retry $* \
    /var/lib/containers/storage/overlay-containers/68dd6c9415c7988fff9eee72253caa8a0165b7d06e1854e81a3366db6daee271/userdata/ctr.log & \
  journalctl --no-pager --follow --full & ) \
    2>&1  \
| grep -v -i "audit.*res=success"
| grep -v -i "\(Completed 200 OK in\|Processing by Gitlab\)"

  
#
        # /var/lib/containers/storage/overlay-containers/68dd6c9415c7988fff9eee72253caa8a0165b7d06e1854e81a3366db6daee271/userdata/ctr.log \

monitor_client.sh

socat tcp-connect:localhost:23455 - \
  | perl -p -e '$| = 1; s/\%([A-Fa-f0-9]{2})/pack('C', hex($1))/seg' \
  | perl -p -e '$| = 1; s/\\x([A-Fa-f0-9]{2})/pack('C', hex($1))/seg' \
  | perl -p -e '$| = 1; s/\\([0-9]{3})/pack('C', oct("$1"))/seg' \
  | ack --ignore-case --flush --passthru --color --color-match=red    "denied" \
  | ack --ignore-case --flush --passthru --color --color-match=red    "error[a-z]*" \
  | ack --ignore-case --flush --passthru --color --color-match=red    "critical[a-z]*" \
  | ack --ignore-case --flush --passthru --color --color-match=yellow "exception" \
  | ack --ignore-case --flush --passthru --color --color-match=yellow "warn[a-z]*" \
  | ack --ignore-case --flush --passthru --color --color-match=green  "info" \
  | ack --ignore-case --flush --passthru --color --color-match=green  "success" \
  | ack --ignore-case --flush --passthru --color --color-match=green  "complete" \
  | ack --ignore-case --flush --passthru --color --color-match=white  "debug" \
  | ack --ignore-case --flush --passthru --color --color-match=white  "trace" \
  | ack --ignore-case --flush --passthru --color --color-match=on_bright_green  "==>[^<]*<==" \
  | ack --ignore-case --flush --passthru --color --color-match=black            "==>[^<]*<=="

monitor_server.service

[Unit]
Description=Monitor server
After=network.target

[Service]
Type=simple
ExecStart=/root/monitor_server.sh
PIDFile=/var/run/monitor_server.pid
WorkingDirectory=/root/

[Install]
WantedBy=basic.target

monitor_server.sh

#!/bin/bash
/bin/socat TCP-LISTEN:23455,fork SYSTEM:"/root/monitor.sh"