Descriptionsystemd-journald is a
- system service that collects and stores logging
- data. It creates and maintains structured, indexed
- journals based on logging information that is received
- from the kernel, from user processes via the libc
- syslog3
- call, from STDOUT/STDERR of system services or via its
- native API. It will implicitly collect numerous meta
- data fields for each log messages in a secure and
- unfakeable way. See
+ system service that collects and stores logging data.
+ It creates and maintains structured, indexed journals
+ based on logging information that is received from the
+ kernel, from user processes via the libc
+ syslog3
+ call, from standard input and standard error of system
+ services or via its native API. It will implicitly
+ collect numerous metadata fields for each log
+ messages in a secure and unfakeable way. See
systemd.journal-fields7
- for more information about the collected meta data.
+ for more information about the collected metadata.
Log data collected by the journal is primarily
@@ -77,7 +79,7 @@
necessary. All objects stored in the journal can be up
to 2^64-1 bytes in size.
- By default the journal stores log data in
+ By default, the journal stores log data in
/run/log/journal/. Since
/run/ is volatile, log data is
lost at reboot. To make the data persistent, it
@@ -142,11 +144,12 @@
systemd.journald.forward_to_syslog=systemd.journald.forward_to_kmsg=systemd.journald.forward_to_console=
+ systemd.journald.forward_to_wall=Enables/disables
forwarding of collected log messages
- to syslog, the kernel log buffer or
- the system console.
+ to syslog, the kernel log buffer, the
+ system console or wall.
See
@@ -206,11 +209,15 @@
+ /run/log/journal/machine-id/*.journal
+ /run/log/journal/machine-id/*.journal~/var/log/journal/machine-id/*.journal/var/log/journal/machine-id/*.journal~systemd-journald
writes entries to files in
+ /run/log/journal/machine-id/
+ or
/var/log/journal/machine-id/
with the .journal
suffix. If the daemon is stopped
@@ -219,7 +226,15 @@
using the .journal~
suffix, and
systemd-journald
- starts writing to a new file.
+ starts writing to a new
+ file. /run is
+ used when
+ /var/log/journal
+ is not available, or when
+ is
+ set in the
+ journald.conf5
+ configuration file.
@@ -233,6 +248,7 @@
journald.conf5,
systemd.journal-fields7,
sd-journal3,
+ systemd-coredump8,
setfacl1,
pydoc systemd.journal.