1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id="systemd-journald.service">
27 <title>systemd-journald.service</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd-journald.service</refentrytitle>
42 <manvolnum>8</manvolnum>
46 <refname>systemd-journald.service</refname>
47 <refname>systemd-journald.socket</refname>
48 <refname>systemd-journald-dev-log.socket</refname>
49 <refname>systemd-journald</refname>
50 <refpurpose>Journal service</refpurpose>
54 <para><filename>systemd-journald.service</filename></para>
55 <para><filename>systemd-journald.socket</filename></para>
56 <para><filename>systemd-journald-dev-log.socket</filename></para>
57 <para><filename>/usr/lib/systemd/systemd-journald</filename></para>
61 <title>Description</title>
63 <para><filename>systemd-journald</filename> is a
64 system service that collects and stores logging data.
65 It creates and maintains structured, indexed journals
66 based on logging information that is received from a
67 variety of sources:</para>
70 <listitem><para>Kernel log messages, via kmsg</para></listitem>
72 <listitem><para>Simple system log messages, via the
74 project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
75 call</para></listitem>
77 <listitem><para>Structured system log messages via the
78 native Journal API, see
79 <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>4</manvolnum></citerefentry></para></listitem>
81 <listitem><para>Standard output and
82 standard error of system
83 services</para></listitem>
85 <listitem><para>Audit records, via the audit subsystem</para></listitem>
88 <para>The daemon will implicitly collect numerous
89 metadata fields for each log messages in a secure and
91 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
92 for more information about the collected metadata.
95 <para>Log data collected by the journal is primarily
96 text-based but can also include binary data where
97 necessary. All objects stored in the journal can be up
98 to 2^64-1 bytes in size.</para>
100 <para>By default, the journal stores log data in
101 <filename>/run/log/journal/</filename>. Since
102 <filename>/run/</filename> is volatile, log data is
103 lost at reboot. To make the data persistent, it
104 is sufficient to create
105 <filename>/var/log/journal/</filename> where
106 <filename>systemd-journald</filename> will then store
109 <para><filename>systemd-journald</filename> will
110 forward all received log messages to the <constant>AF_UNIX</constant>/<constant>SOCK_DGRAM</constant> socket
111 <filename>/run/systemd/journal/syslog</filename>, if it exists, which
112 may be used by Unix syslog daemons to process the data
116 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
117 for information about the configuration of this
122 <title>Signals</title>
128 <listitem><para>Request that journal
129 data from <filename>/run/</filename>
131 <filename>/var/</filename> in order to
132 make it persistent (if this is
133 enabled). This must be used after
134 <filename>/var/</filename> is mounted,
135 as otherwise log data from
136 <filename>/run</filename> is never
137 flushed to <filename>/var</filename>
139 configuration.</para></listitem>
145 <listitem><para>Request immediate
146 rotation of the journal
147 files.</para></listitem>
153 <title>Kernel Command Line</title>
155 <para>A few configuration parameters from
156 <filename>journald.conf</filename> may be overridden on
157 the kernel command line:</para>
159 <variablelist class='kernel-commandline-options'>
161 <term><varname>systemd.journald.forward_to_syslog=</varname></term>
162 <term><varname>systemd.journald.forward_to_kmsg=</varname></term>
163 <term><varname>systemd.journald.forward_to_console=</varname></term>
164 <term><varname>systemd.journald.forward_to_wall=</varname></term>
166 <listitem><para>Enables/disables
167 forwarding of collected log messages
168 to syslog, the kernel log buffer, the
169 system console or wall.
173 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
174 for information about these settings.</para>
182 <title>Access Control</title>
184 <para>Journal files are, by default, owned and readable
185 by the <literal>systemd-journal</literal> system group
186 but are not writable. Adding a user to this group thus
187 enables her/him to read the journal files.</para>
189 <para>By default, each logged in user will get her/his
190 own set of journal files in
191 <filename>/var/log/journal/</filename>. These files
192 will not be owned by the user, however, in order to
193 avoid that the user can write to them
194 directly. Instead, file system ACLs are used to ensure
195 the user gets read access only.</para>
197 <para>Additional users and groups may be granted
198 access to journal files via file system access control
199 lists (ACL). Distributions and administrators may
200 choose to grant read access to all members of the
201 <literal>wheel</literal> and <literal>adm</literal>
202 system groups with a command such as the
205 <programlisting># setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/</programlisting>
207 <para>Note that this command will update the ACLs both
208 for existing journal files and for future journal
210 <filename>/var/log/journal/</filename>
219 <term><filename>/etc/systemd/journald.conf</filename></term>
221 <listitem><para>Configure
222 <command>systemd-journald</command>
224 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
229 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
230 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
231 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
232 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
234 <listitem><para><command>systemd-journald</command>
235 writes entries to files in
236 <filename>/run/log/journal/<replaceable>machine-id</replaceable>/</filename>
238 <filename>/var/log/journal/<replaceable>machine-id</replaceable>/</filename>
239 with the <literal>.journal</literal>
240 suffix. If the daemon is stopped
241 uncleanly, or if the files are found
242 to be corrupted, they are renamed
243 using the <literal>.journal~</literal>
245 <command>systemd-journald</command>
246 starts writing to a new
247 file. <filename>/run</filename> is
249 <filename>/var/log/journal</filename>
250 is not available, or when
251 <option>Storage=volatile</option> is
253 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
261 <title>See Also</title>
263 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
264 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
265 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
266 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
267 <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
268 <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
269 <citerefentry><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
270 <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>4</manvolnum></citerefentry>,
271 <command>pydoc systemd.journal</command>.