1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id="systemd-journald.service">
27 <title>systemd-journald.service</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd-journald.service</refentrytitle>
42 <manvolnum>8</manvolnum>
46 <refname>systemd-journald.service</refname>
47 <refname>systemd-journald.socket</refname>
48 <refname>systemd-journald-dev-log.socket</refname>
49 <refname>systemd-journald</refname>
50 <refpurpose>Journal service</refpurpose>
54 <para><filename>systemd-journald.service</filename></para>
55 <para><filename>systemd-journald.socket</filename></para>
56 <para><filename>systemd-journald-dev-log.socket</filename></para>
57 <para><filename>/usr/lib/systemd/systemd-journald</filename></para>
61 <title>Description</title>
63 <para><filename>systemd-journald</filename> is a
64 system service that collects and stores logging data.
65 It creates and maintains structured, indexed journals
66 based on logging information that is received from the
67 kernel, from user processes via the libc
68 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
69 call, from standard input and standard error of system
70 services or via its native API. It will implicitly
71 collect numerous metadata fields for each log
72 messages in a secure and unfakeable way. See
73 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
74 for more information about the collected metadata.
77 <para>Log data collected by the journal is primarily
78 text-based but can also include binary data where
79 necessary. All objects stored in the journal can be up
80 to 2^64-1 bytes in size.</para>
82 <para>By default, the journal stores log data in
83 <filename>/run/log/journal/</filename>. Since
84 <filename>/run/</filename> is volatile, log data is
85 lost at reboot. To make the data persistent, it
86 is sufficient to create
87 <filename>/var/log/journal/</filename> where
88 <filename>systemd-journald</filename> will then store
91 <para><filename>systemd-journald</filename> will
92 forward all received log messages to the <constant>AF_UNIX</constant>
93 <constant>SOCK_DGRAM</constant> socket
94 <filename>/run/systemd/journal/syslog</filename>, if it exists, which
95 may be used by Unix syslog daemons to process the data
99 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
100 for information about the configuration of this
105 <title>Signals</title>
111 <listitem><para>Request that journal
112 data from <filename>/run/</filename>
114 <filename>/var/</filename> in order to
115 make it persistent (if this is
116 enabled). This must be used after
117 <filename>/var/</filename> is mounted,
118 as otherwise log data from
119 <filename>/run</filename> is never
120 flushed to <filename>/var</filename>
122 configuration.</para></listitem>
128 <listitem><para>Request immediate
129 rotation of the journal
130 files.</para></listitem>
136 <title>Kernel Command Line</title>
138 <para>A few configuration parameters from
139 <filename>journald.conf</filename> may be overridden on
140 the kernel command line:</para>
142 <variablelist class='kernel-commandline-options'>
144 <term><varname>systemd.journald.forward_to_syslog=</varname></term>
145 <term><varname>systemd.journald.forward_to_kmsg=</varname></term>
146 <term><varname>systemd.journald.forward_to_console=</varname></term>
147 <term><varname>systemd.journald.forward_to_wall=</varname></term>
149 <listitem><para>Enables/disables
150 forwarding of collected log messages
151 to syslog, the kernel log buffer, the
152 system console or wall.
156 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
157 for information about these settings.</para>
165 <title>Access Control</title>
167 <para>Journal files are, by default, owned and readable
168 by the <literal>systemd-journal</literal> system group
169 but are not writable. Adding a user to this group thus
170 enables her/him to read the journal files.</para>
172 <para>By default, each logged in user will get her/his
173 own set of journal files in
174 <filename>/var/log/journal/</filename>. These files
175 will not be owned by the user, however, in order to
176 avoid that the user can write to them
177 directly. Instead, file system ACLs are used to ensure
178 the user gets read access only.</para>
180 <para>Additional users and groups may be granted
181 access to journal files via file system access control
182 lists (ACL). Distributions and administrators may
183 choose to grant read access to all members of the
184 <literal>wheel</literal> and <literal>adm</literal>
185 system groups with a command such as the
188 <programlisting># setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/</programlisting>
190 <para>Note that this command will update the ACLs both
191 for existing journal files and for future journal
193 <filename>/var/log/journal/</filename>
202 <term><filename>/etc/systemd/journald.conf</filename></term>
204 <listitem><para>Configure
205 <command>systemd-journald</command>
207 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
212 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
213 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
214 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
215 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
217 <listitem><para><command>systemd-journald</command>
218 writes entries to files in
219 <filename>/run/log/journal/<replaceable>machine-id</replaceable>/</filename>
221 <filename>/var/log/journal/<replaceable>machine-id</replaceable>/</filename>
222 with the <literal>.journal</literal>
223 suffix. If the daemon is stopped
224 uncleanly, or if the files are found
225 to be corrupted, they are renamed
226 using the <literal>.journal~</literal>
228 <command>systemd-journald</command>
229 starts writing to a new
230 file. <filename>/run</filename> is
232 <filename>/var/log/journal</filename>
233 is not available, or when
234 <option>Storage=volatile</option> is
236 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
244 <title>See Also</title>
246 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
247 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
248 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
249 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
250 <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
251 <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
252 <citerefentry><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
253 <command>pydoc systemd.journal</command>.