systemd adds Varlink traffic monitoring with varlinkctl monitor

systemd has gained new observability tools for Varlink, the protocol increasingly used alongside D-Bus in modern Linux systems. A new io.systemd.VarlinkMonitor service provides a ring buffer for filtered traffic capture, while the varlinkctl monitor command exposes this functionality for terminal and script use. Output can be formatted as JSON-seq for processing with jq. The tooling was presented at All Systems Go; the author suggests future integration with Bustle for unified D-Bus and Varlink system-wide visibility.

What the new Varlink monitoring tools provide

• io.systemd.VarlinkMonitor: new Varlink service that maintains a ring buffer of captured packets matching user-supplied filters
• varlinkctl monitor: new CLI verb exposing the service for interactive and scripted use; equivalent to dbus-monitor for the Varlink protocol
• --json short flag: emits JSON-seq output, compatible with jq --seq for structured processing
• Current gap: no equivalent to Bustle's graphical D-Bus capture; unified D-Bus/Varlink visualization not yet available

Why it matters

As systemd components and other system services migrate from D-Bus to Varlink, administrators and developers lose the mature observability tooling built around D-Bus. These tools begin to close that gap, though unified visibility across both protocols remains a future goal.