1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 2.1 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 Lesser General Public License for more details.
21 You should have received a copy of the GNU Lesser General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="journald.conf"
26 xmlns:xi="http://www.w3.org/2001/XInclude">
28 <title>journald.conf</title>
29 <productname>systemd</productname>
33 <contrib>Developer</contrib>
34 <firstname>Lennart</firstname>
35 <surname>Poettering</surname>
36 <email>lennart@poettering.net</email>
42 <refentrytitle>journald.conf</refentrytitle>
43 <manvolnum>5</manvolnum>
47 <refname>journald.conf</refname>
48 <refname>journald.conf.d</refname>
49 <refpurpose>Journal service configuration files</refpurpose>
53 <para><filename>/etc/systemd/journald.conf</filename></para>
54 <para><filename>/etc/systemd/journald.conf.d/*.conf</filename></para>
55 <para><filename>/run/systemd/journald.conf.d/*.conf</filename></para>
56 <para><filename>/usr/lib/systemd/journald.conf.d/*.conf</filename></para>
60 <title>Description</title>
62 <para>These files configure various parameters of the
63 systemd journal service,
64 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
68 <xi:include href="standard-conf.xml" xpointer="confd" />
69 <xi:include href="standard-conf.xml" xpointer="conf" />
72 <title>Options</title>
74 <para>All options are configured in the
75 <literal>[Journal]</literal> section:</para>
80 <term><varname>Storage=</varname></term>
82 <listitem><para>Controls where to
83 store journal data. One of
84 <literal>volatile</literal>,
85 <literal>persistent</literal>,
86 <literal>auto</literal> and
87 <literal>none</literal>. If
88 <literal>volatile</literal>, journal
89 log data will be stored only in
90 memory, i.e. below the
91 <filename>/run/log/journal</filename>
92 hierarchy (which is created if
94 <literal>persistent</literal>, data will
95 be stored preferably on disk,
97 <filename>/var/log/journal</filename>
98 hierarchy (which is created if
99 needed), with a fallback to
100 <filename>/run/log/journal</filename>
101 (which is created if needed), during
102 early boot and if the disk is not
103 writable. <literal>auto</literal> is
105 <literal>persistent</literal> but the
107 <filename>/var/log/journal</filename>
108 is not created if needed, so that its
109 existence controls where log data
110 goes. <literal>none</literal> turns
111 off all storage, all log data received
112 will be dropped. Forwarding to other
113 targets, such as the console, the
114 kernel log buffer or a syslog daemon
115 will still work however. Defaults to
116 <literal>auto</literal>.</para></listitem>
120 <term><varname>Compress=</varname></term>
122 <listitem><para>Takes a boolean
123 value. If enabled (the default), data
124 objects that shall be stored in the
125 journal and are larger than a certain
126 threshold are compressed before they
127 are written to the file
128 system.</para></listitem>
132 <term><varname>Seal=</varname></term>
134 <listitem><para>Takes a boolean
135 value. If enabled (the default), and a
136 sealing key is available (as created
138 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
139 <option>--setup-keys</option>
140 command), Forward Secure Sealing (FSS)
141 for all persistent journal files is
142 enabled. FSS is based on <ulink
143 url="https://eprint.iacr.org/2013/397">Seekable
144 Sequential Key Generators</ulink> by
145 G. A. Marson and B. Poettering
146 (doi:10.1007/978-3-642-40203-6_7)
147 and may be used to protect journal files
148 from unnoticed alteration.</para></listitem>
152 <term><varname>SplitMode=</varname></term>
154 <listitem><para>Controls whether to
155 split up journal files per user. One
156 of <literal>uid</literal>,
157 <literal>login</literal> and
158 <literal>none</literal>. If
159 <literal>uid</literal>, all users will
160 get each their own journal files
161 regardless of whether they possess a
162 login session or not, however system
163 users will log into the system
164 journal. If <literal>login</literal>,
165 actually logged-in users will get each
166 their own journal files, but users
167 without login session and system users
168 will log into the system journal. If
169 <literal>none</literal>, journal files
170 are not split up by user and all
171 messages are instead stored in the
172 single system journal. Note that
173 splitting up journal files by user is
174 only available for journals stored
175 persistently. If journals are stored
176 on volatile storage (see above), only
177 a single journal file for all user IDs
179 <literal>uid</literal>.</para></listitem>
183 <term><varname>RateLimitInterval=</varname></term>
184 <term><varname>RateLimitBurst=</varname></term>
186 <listitem><para>Configures the rate
187 limiting that is applied to all
188 messages generated on the system. If,
189 in the time interval defined by
190 <varname>RateLimitInterval=</varname>,
191 more messages than specified in
192 <varname>RateLimitBurst=</varname> are
193 logged by a service, all further
194 messages within the interval are
195 dropped until the interval is over. A
196 message about the number of dropped
197 messages is generated. This rate
198 limiting is applied per-service, so
199 that two services which log do not
200 interfere with each other's
201 limits. Defaults to 1000 messages in
202 30s. The time specification for
203 <varname>RateLimitInterval=</varname>
204 may be specified in the following
205 units: <literal>s</literal>,
206 <literal>min</literal>,
207 <literal>h</literal>,
208 <literal>ms</literal>,
209 <literal>us</literal>. To turn off any
210 kind of rate limiting, set either
211 value to 0.</para></listitem>
215 <term><varname>SystemMaxUse=</varname></term>
216 <term><varname>SystemKeepFree=</varname></term>
217 <term><varname>SystemMaxFileSize=</varname></term>
218 <term><varname>RuntimeMaxUse=</varname></term>
219 <term><varname>RuntimeKeepFree=</varname></term>
220 <term><varname>RuntimeMaxFileSize=</varname></term>
222 <listitem><para>Enforce size limits on
223 the journal files stored. The options
225 <literal>System</literal> apply to the
226 journal files when stored on a
227 persistent file system, more
229 <filename>/var/log/journal</filename>. The
230 options prefixed with
231 <literal>Runtime</literal> apply to
232 the journal files when stored on a
233 volatile in-memory file system, more
235 <filename>/run/log/journal</filename>. The
236 former is used only when
237 <filename>/var</filename> is mounted,
238 writable, and the directory
239 <filename>/var/log/journal</filename>
240 exists. Otherwise, only the latter
241 applies. Note that this means that
242 during early boot and if the
243 administrator disabled persistent
244 logging, only the latter options apply,
245 while the former apply if persistent
246 logging is enabled and the system is
248 up. <command>journalctl</command> and
249 <command>systemd-journald</command>
250 ignore all files with names not ending
251 with <literal>.journal</literal> or
252 <literal>.journal~</literal>, so only
253 such files, located in the appropriate
254 directories, are taken into account
255 when calculating current disk usage.
258 <para><varname>SystemMaxUse=</varname>
259 and <varname>RuntimeMaxUse=</varname>
260 control how much disk space the
261 journal may use up at maximum.
262 <varname>SystemKeepFree=</varname> and
263 <varname>RuntimeKeepFree=</varname>
264 control how much disk space
265 systemd-journald shall leave free for
267 <command>systemd-journald</command>
268 will respect both limits and use the
269 smaller of the two values.</para>
271 <para>The first pair defaults to 10%
272 and the second to 15% of the size of
273 the respective file system. If the
274 file system is nearly full and either
275 <varname>SystemKeepFree=</varname> or
276 <varname>RuntimeKeepFree=</varname> is
277 violated when systemd-journald is
278 started, the value will be raised to
279 percentage that is actually free. This
280 means that if there was enough
281 free space before and journal files were
282 created, and subsequently something
283 else causes the file system to fill
284 up, journald will stop using more
285 space, but it will not be removing
286 existing files to go reduce footprint
289 <para><varname>SystemMaxFileSize=</varname>
291 <varname>RuntimeMaxFileSize=</varname>
292 control how large individual journal
293 files may grow at maximum. This
294 influences the granularity in which
295 disk space is made available through
296 rotation, i.e. deletion of historic
297 data. Defaults to one eighth of the
298 values configured with
299 <varname>SystemMaxUse=</varname> and
300 <varname>RuntimeMaxUse=</varname>, so
301 that usually seven rotated journal
302 files are kept as history. Specify
303 values in bytes or use K, M, G, T, P,
304 E as units for the specified sizes
305 (equal to 1024, 1024²,... bytes).
306 Note that size limits are enforced
307 synchronously when journal files are
308 extended, and no explicit rotation
309 step triggered by time is
310 needed.</para></listitem>
314 <term><varname>MaxFileSec=</varname></term>
316 <listitem><para>The maximum time to
317 store entries in a single journal
318 file before rotating to the next
319 one. Normally, time-based rotation
320 should not be required as size-based
321 rotation with options such as
322 <varname>SystemMaxFileSize=</varname>
323 should be sufficient to ensure that
324 journal files do not grow without
325 bounds. However, to ensure that not
326 too much data is lost at once when old
327 journal files are deleted, it might
328 make sense to change this value from
329 the default of one month. Set to 0 to
330 turn off this feature. This setting
331 takes time values which may be
332 suffixed with the units
333 <literal>year</literal>,
334 <literal>month</literal>,
335 <literal>week</literal>, <literal>day</literal>,
336 <literal>h</literal> or <literal>m</literal>
337 to override the default time unit of
338 seconds.</para></listitem>
342 <term><varname>MaxRetentionSec=</varname></term>
344 <listitem><para>The maximum time to
345 store journal entries. This
346 controls whether journal files
347 containing entries older then the
348 specified time span are
349 deleted. Normally, time-based deletion
350 of old journal files should not be
351 required as size-based deletion with
353 <varname>SystemMaxUse=</varname>
354 should be sufficient to ensure that
355 journal files do not grow without
356 bounds. However, to enforce data
357 retention policies, it might make sense
358 to change this value from the
359 default of 0 (which turns off this
360 feature). This setting also takes
361 time values which may be suffixed with
362 the units <literal>year</literal>,
363 <literal>month</literal>,
364 <literal>week</literal>, <literal>day</literal>,
365 <literal>h</literal> or <literal> m</literal>
366 to override the default time unit of
367 seconds.</para></listitem>
372 <term><varname>SyncIntervalSec=</varname></term>
374 <listitem><para>The timeout before
375 synchronizing journal files to
376 disk. After syncing, journal files are
377 placed in the OFFLINE state. Note that
378 syncing is unconditionally done
379 immediately after a log message of
380 priority CRIT, ALERT or EMERG has been
381 logged. This setting hence applies
382 only to messages of the levels ERR,
383 WARNING, NOTICE, INFO, DEBUG. The
384 default timeout is 5 minutes.
389 <term><varname>ForwardToSyslog=</varname></term>
390 <term><varname>ForwardToKMsg=</varname></term>
391 <term><varname>ForwardToConsole=</varname></term>
392 <term><varname>ForwardToWall=</varname></term>
394 <listitem><para>Control whether log
395 messages received by the journal
396 daemon shall be forwarded to a
397 traditional syslog daemon, to the
398 kernel log buffer (kmsg), to the
399 system console, or sent as wall
400 messages to all logged-in users. These
401 options take boolean arguments. If
402 forwarding to syslog is enabled but no
403 syslog daemon is running, the
404 respective option has no effect. By
405 default, only forwarding wall is
406 enabled. These settings may be
407 overridden at boot time with the
408 kernel command line options
409 <literal>systemd.journald.forward_to_syslog=</literal>,
410 <literal>systemd.journald.forward_to_kmsg=</literal>,
411 <literal>systemd.journald.forward_to_console=</literal>
413 <literal>systemd.journald.forward_to_wall=</literal>.
414 When forwarding to the console, the
415 TTY to log to can be changed with
416 <varname>TTYPath=</varname>, described
417 below.</para></listitem>
421 <term><varname>MaxLevelStore=</varname></term>
422 <term><varname>MaxLevelSyslog=</varname></term>
423 <term><varname>MaxLevelKMsg=</varname></term>
424 <term><varname>MaxLevelConsole=</varname></term>
425 <term><varname>MaxLevelWall=</varname></term>
427 <listitem><para>Controls the maximum
428 log level of messages that are stored
429 on disk, forwarded to syslog, kmsg,
430 the console or wall (if that is
431 enabled, see above). As argument,
433 <literal>emerg</literal>,
434 <literal>alert</literal>,
435 <literal>crit</literal>,
436 <literal>err</literal>,
437 <literal>warning</literal>,
438 <literal>notice</literal>,
439 <literal>info</literal>,
440 <literal>debug</literal> or integer
441 values in the range of 0..7 (corresponding
442 to the same levels). Messages equal or below
443 the log level specified are
444 stored/forwarded, messages above are
446 <literal>debug</literal> for
447 <varname>MaxLevelStore=</varname> and
448 <varname>MaxLevelSyslog=</varname>, to
449 ensure that the all messages are
450 written to disk and forwarded to
452 <literal>notice</literal> for
453 <varname>MaxLevelKMsg=</varname>,
454 <literal>info</literal> for
455 <varname>MaxLevelConsole=</varname> and
456 <literal>emerg</literal> for
457 <varname>MaxLevelWall=</varname>.</para></listitem>
461 <term><varname>TTYPath=</varname></term>
463 <listitem><para>Change the console TTY
465 <varname>ForwardToConsole=yes</varname>
467 <filename>/dev/console</filename>.</para></listitem>
475 <title>See Also</title>
477 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
478 <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
479 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
480 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
481 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>