Hello!
I'm fairly certain this is a bug, but on GitHub I'm told to post here, so here we go:
Since Journal logs are now read via journalctl (PR) the agent container (8.17.0 for example) cannot read journal system logs mounted from the host, since journalctl is not available in the image.
Systemd should be installed in the image. Not pretty, but what can one do. I did a very rudimentary test, and installing systemd increases the current image size from 1.54G to 1.65G. I don't think it's possible to install journald/journalctl separately.
Also note that I did NOT check if installing Systemd in itself is sufficient to correctly handle host journal logs.
The most basic system integration now also supports journal as a source (which is a good thing), so I believe this should work out of the box without using a custom image.
(Btw I think reading the host journal from a container probably also breaks the current default conditions that decides which input to use [syslog or journal], but those are waaay too conservative anyway, so I have them overridden.)