man/systemd-journald.service.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2010 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="systemd-journald.service">
  25
  26         <refentryinfo>
  27                 <title>systemd-journald.service</title>
  28                 <productname>systemd</productname>
  29
  30                 <authorgroup>
  31                         <author>
  32                                 <contrib>Developer</contrib>
  33                                 <firstname>Lennart</firstname>
  34                                 <surname>Poettering</surname>
  35                                 <email>lennart@poettering.net</email>
  36                         </author>
  37                 </authorgroup>
  38         </refentryinfo>
  39
  40         <refmeta>
  41                 <refentrytitle>systemd-journald.service</refentrytitle>
  42                 <manvolnum>8</manvolnum>
  43         </refmeta>
  44
  45         <refnamediv>
  46                 <refname>systemd-journald.service</refname>
  47                 <refname>systemd-journald.socket</refname>
  48                 <refname>systemd-journald-dev-log.socket</refname>
  49                 <refname>systemd-journald</refname>
  50                 <refpurpose>Journal service</refpurpose>
  51         </refnamediv>
  52
  53         <refsynopsisdiv>
  54                 <para><filename>systemd-journald.service</filename></para>
  55                 <para><filename>systemd-journald.socket</filename></para>
  56                 <para><filename>systemd-journald-dev-log.socket</filename></para>
  57                 <para><filename>/usr/lib/systemd/systemd-journald</filename></para>
  58         </refsynopsisdiv>
  59
  60         <refsect1>
  61                 <title>Description</title>
  62
  63                 <para><filename>systemd-journald</filename> is a
  64                 system service that collects and stores logging data.
  65                 It creates and maintains structured, indexed journals
  66                 based on logging information that is received from a
  67                 variety of sources:</para>
  68
  69                 <itemizedlist>
  70                         <listitem><para>Kernel log messages, via kmsg</para></listitem>
  71
  72                         <listitem><para>Simple system log messages, via the
  73                         libc <citerefentry
  74                         project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
  75                         call</para></listitem>
  76
  77                         <listitem><para>Structured system log messages via the
  78                         native Journal API, see
  79                         <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>4</manvolnum></citerefentry></para></listitem>
  80
  81                         <listitem><para>Standard output and
  82                         standard error of system
  83                         services</para></listitem>
  84
  85                         <listitem><para>Audit records, via the audit subsystem</para></listitem>
  86                 </itemizedlist>
  87
  88                 <para>The daemon will implicitly collect numerous
  89                 metadata fields for each log messages in a secure and
  90                 unfakeable way. See
  91                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  92                 for more information about the collected metadata.
  93                 </para>
  94
  95                 <para>Log data collected by the journal is primarily
  96                 text-based but can also include binary data where
  97                 necessary. All objects stored in the journal can be up
  98                 to 2^64-1 bytes in size.</para>
  99
 100                 <para>By default, the journal stores log data in
 101                 <filename>/run/log/journal/</filename>. Since
 102                 <filename>/run/</filename> is volatile, log data is
 103                 lost at reboot. To make the data persistent, it
 104                 is sufficient to create
 105                 <filename>/var/log/journal/</filename> where
 106                 <filename>systemd-journald</filename> will then store
 107                 the data.</para>
 108
 109                 <para><filename>systemd-journald</filename> will
 110                 forward all received log messages to the <constant>AF_UNIX</constant>/<constant>SOCK_DGRAM</constant> socket
 111                 <filename>/run/systemd/journal/syslog</filename>, if it exists, which
 112                 may be used by Unix syslog daemons to process the data
 113                 further.</para>
 114
 115                 <para>See
 116                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 117                 for information about the configuration of this
 118                 service.</para>
 119         </refsect1>
 120
 121         <refsect1>
 122                 <title>Signals</title>
 123
 124                 <variablelist>
 125                         <varlistentry>
 126                                 <term>SIGUSR1</term>
 127
 128                                 <listitem><para>Request that journal
 129                                 data from <filename>/run/</filename>
 130                                 is flushed to
 131                                 <filename>/var/</filename> in order to
 132                                 make it persistent (if this is
 133                                 enabled). This must be used after
 134                                 <filename>/var/</filename> is mounted,
 135                                 as otherwise log data from
 136                                 <filename>/run</filename> is never
 137                                 flushed to <filename>/var</filename>
 138                                 regardless of the
 139                                 configuration.</para></listitem>
 140                         </varlistentry>
 141
 142                         <varlistentry>
 143                                 <term>SIGUSR2</term>
 144
 145                                 <listitem><para>Request immediate
 146                                 rotation of the journal
 147                                 files.</para></listitem>
 148                         </varlistentry>
 149                 </variablelist>
 150         </refsect1>
 151
 152         <refsect1>
 153                 <title>Kernel Command Line</title>
 154
 155                 <para>A few configuration parameters from
 156                 <filename>journald.conf</filename> may be overridden on
 157                 the kernel command line:</para>
 158
 159                 <variablelist class='kernel-commandline-options'>
 160                         <varlistentry>
 161                                 <term><varname>systemd.journald.forward_to_syslog=</varname></term>
 162                                 <term><varname>systemd.journald.forward_to_kmsg=</varname></term>
 163                                 <term><varname>systemd.journald.forward_to_console=</varname></term>
 164                                 <term><varname>systemd.journald.forward_to_wall=</varname></term>
 165
 166                                 <listitem><para>Enables/disables
 167                                 forwarding of collected log messages
 168                                 to syslog, the kernel log buffer, the
 169                                 system console or wall.
 170                                 </para>
 171
 172                                 <para>See
 173                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 174                                 for information about these settings.</para>
 175                                 </listitem>
 176
 177                         </varlistentry>
 178                 </variablelist>
 179         </refsect1>
 180
 181         <refsect1>
 182                 <title>Access Control</title>
 183
 184                 <para>Journal files are, by default, owned and readable
 185                 by the <literal>systemd-journal</literal> system group
 186                 but are not writable. Adding a user to this group thus
 187                 enables her/him to read the journal files.</para>
 188
 189                 <para>By default, each logged in user will get her/his
 190                 own set of journal files in
 191                 <filename>/var/log/journal/</filename>. These files
 192                 will not be owned by the user, however, in order to
 193                 avoid that the user can write to them
 194                 directly. Instead, file system ACLs are used to ensure
 195                 the user gets read access only.</para>
 196
 197                 <para>Additional users and groups may be granted
 198                 access to journal files via file system access control
 199                 lists (ACL). Distributions and administrators may
 200                 choose to grant read access to all members of the
 201                 <literal>wheel</literal> and <literal>adm</literal>
 202                 system groups with a command such as the
 203                 following:</para>
 204
 205                 <programlisting># setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/</programlisting>
 206
 207                 <para>Note that this command will update the ACLs both
 208                 for existing journal files and for future journal
 209                 files created in the
 210                 <filename>/var/log/journal/</filename>
 211                 directory.</para>
 212         </refsect1>
 213
 214         <refsect1>
 215                 <title>Files</title>
 216
 217                 <variablelist>
 218                         <varlistentry>
 219                                 <term><filename>/etc/systemd/journald.conf</filename></term>
 220
 221                                 <listitem><para>Configure
 222                                 <command>systemd-journald</command>
 223                                 behaviour. See
 224                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 225                                 </para></listitem>
 226                         </varlistentry>
 227
 228                         <varlistentry>
 229                                 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
 230                                 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
 231                                 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
 232                                 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
 233
 234                                 <listitem><para><command>systemd-journald</command>
 235                                 writes entries to files in
 236                                 <filename>/run/log/journal/<replaceable>machine-id</replaceable>/</filename>
 237                                 or
 238                                 <filename>/var/log/journal/<replaceable>machine-id</replaceable>/</filename>
 239                                 with the <literal>.journal</literal>
 240                                 suffix. If the daemon is stopped
 241                                 uncleanly, or if the files are found
 242                                 to be corrupted, they are renamed
 243                                 using the <literal>.journal~</literal>
 244                                 suffix, and
 245                                 <command>systemd-journald</command>
 246                                 starts writing to a new
 247                                 file. <filename>/run</filename> is
 248                                 used when
 249                                 <filename>/var/log/journal</filename>
 250                                 is not available, or when
 251                                 <option>Storage=volatile</option> is
 252                                 set in the
 253                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 254                                 configuration file.
 255                                 </para></listitem>
 256                         </varlistentry>
 257                 </variablelist>
 258         </refsect1>
 259
 260         <refsect1>
 261                 <title>See Also</title>
 262                 <para>
 263                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 264                         <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 265                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 266                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 267                         <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 268                         <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 269                         <citerefentry><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 270                         <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>4</manvolnum></citerefentry>,
 271                         <command>pydoc systemd.journal</command>.
 272                 </para>
 273         </refsect1>
 274
 275 </refentry>