shukueki (宿駅 — the relay post stations that couriers and post-horses used to hand off mail across long distances) is a background agent that tails a set of log files and ships their records to Azure Monitor's Logs Ingestion API. It is built to be deployed at scale by an MDM (Jamf Pro or Intune) and released as open source.
Status: early development. This repository currently contains the project skeleton; functionality is being implemented incrementally. See TODO.md for what is not implemented yet.
- Ships arbitrary log files named in the configuration profile — there is no
fixed set of paths. System logs under
/var/logand per-user logs under~/Library/Logsare only examples of what an operator might configure. - Runs as a single root LaunchDaemon so it can read whatever paths the configuration names — including files owned by any user — and keep running across logout.
- App-only authentication to Entra ID. The default credential is a certificate client assertion (PS256) signed by a non-extractable private key in the system keychain — the key never leaves the OS security daemon. Configuration profiles never contain secrets.
- Configuration via MDM as a configuration profile (managed preferences). The agent is MDM-agnostic and reloads configuration without a restart.
- At-least-once delivery with per-file checkpoints (inode + fingerprint +
offset) persisted in SQLite, plus a bounded on-disk buffer and a dead-letter
store. A stable
_recordIdlets you de-duplicate downstream in KQL. - Built-in, configuration-driven formatters (regex / json / syslog / raw) with multiline support, so ingested data is structured rather than raw text.
- Portable Go core: the bulk of the agent is pure Go (cross-compilable and unit-tested on Linux). Only the keychain signing bridge is macOS-specific cgo, isolated behind a build tag — which keeps the door open to a future Windows build that shares the core.
| Binary | Role |
|---|---|
shukueki |
The daemon: tails logs, formats, batches, and ships records. |
shukuekictl |
Operator CLI: prints the daemon's health from its status file. |
Requires Go (see go.mod). On macOS the keychain signing path uses cgo, so the
Command Line Tools (a C compiler + Security framework headers) are required to
build the daemon for macOS; the pure-Go core builds anywhere.
make build # build all packages
make test # unit tests (-race -shuffle=on)
make lint # golangci-lintSee CONTRIBUTING.md. Commits must be signed off under the
Developer Certificate of Origin (git commit -s).