man/systemd-journald.service.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2010 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="systemd-journald.service">
  25
  26         <refentryinfo>
  27                 <title>systemd-journald.service</title>
  28                 <productname>systemd</productname>
  29
  30                 <authorgroup>
  31                         <author>
  32                                 <contrib>Developer</contrib>
  33                                 <firstname>Lennart</firstname>
  34                                 <surname>Poettering</surname>
  35                                 <email>lennart@poettering.net</email>
  36                         </author>
  37                 </authorgroup>
  38         </refentryinfo>
  39
  40         <refmeta>
  41                 <refentrytitle>systemd-journald.service</refentrytitle>
  42                 <manvolnum>8</manvolnum>
  43         </refmeta>
  44
  45         <refnamediv>
  46                 <refname>systemd-journald.service</refname>
  47                 <refname>systemd-journald.socket</refname>
  48                 <refname>systemd-journald-dev-log.socket</refname>
  49                 <refname>systemd-journald</refname>
  50                 <refpurpose>Journal service</refpurpose>
  51         </refnamediv>
  52
  53         <refsynopsisdiv>
  54                 <para><filename>systemd-journald.service</filename></para>
  55                 <para><filename>systemd-journald.socket</filename></para>
  56                 <para><filename>systemd-journald-dev-log.socket</filename></para>
  57                 <para><filename>/usr/lib/systemd/systemd-journald</filename></para>
  58         </refsynopsisdiv>
  59
  60         <refsect1>
  61                 <title>Description</title>
  62
  63                 <para><filename>systemd-journald</filename> is a
  64                 system service that collects and stores logging data.
  65                 It creates and maintains structured, indexed journals
  66                 based on logging information that is received from the
  67                 kernel, from user processes via the libc
  68                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
  69                 call, from standard input and standard error of system
  70                 services or via its native API. It will implicitly
  71                 collect numerous metadata fields for each log
  72                 messages in a secure and unfakeable way. See
  73                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  74                 for more information about the collected metadata.
  75                 </para>
  76
  77                 <para>Log data collected by the journal is primarily
  78                 text-based but can also include binary data where
  79                 necessary. All objects stored in the journal can be up
  80                 to 2^64-1 bytes in size.</para>
  81
  82                 <para>By default, the journal stores log data in
  83                 <filename>/run/log/journal/</filename>. Since
  84                 <filename>/run/</filename> is volatile, log data is
  85                 lost at reboot. To make the data persistent, it
  86                 is sufficient to create
  87                 <filename>/var/log/journal/</filename> where
  88                 <filename>systemd-journald</filename> will then store
  89                 the data.</para>
  90
  91                 <para><filename>systemd-journald</filename> will
  92                 forward all received log messages to the <constant>AF_UNIX</constant>
  93                 <constant>SOCK_DGRAM</constant> socket
  94                 <filename>/run/systemd/journal/syslog</filename>, if it exists, which
  95                 may be used by Unix syslog daemons to process the data
  96                 further.</para>
  97
  98                 <para>See
  99                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 100                 for information about the configuration of this
 101                 service.</para>
 102         </refsect1>
 103
 104         <refsect1>
 105                 <title>Signals</title>
 106
 107                 <variablelist>
 108                         <varlistentry>
 109                                 <term>SIGUSR1</term>
 110
 111                                 <listitem><para>Request that journal
 112                                 data from <filename>/run/</filename>
 113                                 is flushed to
 114                                 <filename>/var/</filename> in order to
 115                                 make it persistent (if this is
 116                                 enabled). This must be used after
 117                                 <filename>/var/</filename> is mounted,
 118                                 as otherwise log data from
 119                                 <filename>/run</filename> is never
 120                                 flushed to <filename>/var</filename>
 121                                 regardless of the
 122                                 configuration.</para></listitem>
 123                         </varlistentry>
 124
 125                         <varlistentry>
 126                                 <term>SIGUSR2</term>
 127
 128                                 <listitem><para>Request immediate
 129                                 rotation of the journal
 130                                 files.</para></listitem>
 131                         </varlistentry>
 132                 </variablelist>
 133         </refsect1>
 134
 135         <refsect1>
 136                 <title>Kernel Command Line</title>
 137
 138                 <para>A few configuration parameters from
 139                 <filename>journald.conf</filename> may be overridden on
 140                 the kernel command line:</para>
 141
 142                 <variablelist class='kernel-commandline-options'>
 143                         <varlistentry>
 144                                 <term><varname>systemd.journald.forward_to_syslog=</varname></term>
 145                                 <term><varname>systemd.journald.forward_to_kmsg=</varname></term>
 146                                 <term><varname>systemd.journald.forward_to_console=</varname></term>
 147                                 <term><varname>systemd.journald.forward_to_wall=</varname></term>
 148
 149                                 <listitem><para>Enables/disables
 150                                 forwarding of collected log messages
 151                                 to syslog, the kernel log buffer, the
 152                                 system console or wall.
 153                                 </para>
 154
 155                                 <para>See
 156                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 157                                 for information about these settings.</para>
 158                                 </listitem>
 159
 160                         </varlistentry>
 161                 </variablelist>
 162         </refsect1>
 163
 164         <refsect1>
 165                 <title>Access Control</title>
 166
 167                 <para>Journal files are, by default, owned and readable
 168                 by the <literal>systemd-journal</literal> system group
 169                 but are not writable. Adding a user to this group thus
 170                 enables her/him to read the journal files.</para>
 171
 172                 <para>By default, each logged in user will get her/his
 173                 own set of journal files in
 174                 <filename>/var/log/journal/</filename>. These files
 175                 will not be owned by the user, however, in order to
 176                 avoid that the user can write to them
 177                 directly. Instead, file system ACLs are used to ensure
 178                 the user gets read access only.</para>
 179
 180                 <para>Additional users and groups may be granted
 181                 access to journal files via file system access control
 182                 lists (ACL). Distributions and administrators may
 183                 choose to grant read access to all members of the
 184                 <literal>wheel</literal> and <literal>adm</literal>
 185                 system groups with a command such as the
 186                 following:</para>
 187
 188                 <programlisting># setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/</programlisting>
 189
 190                 <para>Note that this command will update the ACLs both
 191                 for existing journal files and for future journal
 192                 files created in the
 193                 <filename>/var/log/journal/</filename>
 194                 directory.</para>
 195         </refsect1>
 196
 197         <refsect1>
 198                 <title>Files</title>
 199
 200                 <variablelist>
 201                         <varlistentry>
 202                                 <term><filename>/etc/systemd/journald.conf</filename></term>
 203
 204                                 <listitem><para>Configure
 205                                 <command>systemd-journald</command>
 206                                 behaviour. See
 207                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 208                                 </para></listitem>
 209                         </varlistentry>
 210
 211                         <varlistentry>
 212                                 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
 213                                 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
 214                                 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
 215                                 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
 216
 217                                 <listitem><para><command>systemd-journald</command>
 218                                 writes entries to files in
 219                                 <filename>/run/log/journal/<replaceable>machine-id</replaceable>/</filename>
 220                                 or
 221                                 <filename>/var/log/journal/<replaceable>machine-id</replaceable>/</filename>
 222                                 with the <literal>.journal</literal>
 223                                 suffix. If the daemon is stopped
 224                                 uncleanly, or if the files are found
 225                                 to be corrupted, they are renamed
 226                                 using the <literal>.journal~</literal>
 227                                 suffix, and
 228                                 <command>systemd-journald</command>
 229                                 starts writing to a new
 230                                 file. <filename>/run</filename> is
 231                                 used when
 232                                 <filename>/var/log/journal</filename>
 233                                 is not available, or when
 234                                 <option>Storage=volatile</option> is
 235                                 set in the
 236                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 237                                 configuration file.
 238                                 </para></listitem>
 239                         </varlistentry>
 240                 </variablelist>
 241         </refsect1>
 242
 243         <refsect1>
 244                 <title>See Also</title>
 245                 <para>
 246                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 247                         <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 248                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 249                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 250                         <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 251                         <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 252                         <citerefentry><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 253                         <command>pydoc systemd.journal</command>.
 254                 </para>
 255         </refsect1>
 256
 257 </refentry>