man/systemd-journald.service.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2010 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="systemd-journald.service">
  25
  26         <refentryinfo>
  27                 <title>systemd-journald.service</title>
  28                 <productname>systemd</productname>
  29
  30                 <authorgroup>
  31                         <author>
  32                                 <contrib>Developer</contrib>
  33                                 <firstname>Lennart</firstname>
  34                                 <surname>Poettering</surname>
  35                                 <email>lennart@poettering.net</email>
  36                         </author>
  37                 </authorgroup>
  38         </refentryinfo>
  39
  40         <refmeta>
  41                 <refentrytitle>systemd-journald.service</refentrytitle>
  42                 <manvolnum>8</manvolnum>
  43         </refmeta>
  44
  45         <refnamediv>
  46                 <refname>systemd-journald.service</refname>
  47                 <refname>systemd-journald.socket</refname>
  48                 <refname>systemd-journald</refname>
  49                 <refpurpose>Journal service</refpurpose>
  50         </refnamediv>
  51
  52         <refsynopsisdiv>
  53                 <para><filename>systemd-journald.service</filename></para>
  54                 <para><filename>systemd-journald.socket</filename></para>
  55                 <para><filename>/usr/lib/systemd/systemd-journald</filename></para>
  56         </refsynopsisdiv>
  57
  58         <refsect1>
  59                 <title>Description</title>
  60
  61                 <para><filename>systemd-journald</filename> is a
  62                 system service that collects and stores logging data.
  63                 It creates and maintains structured, indexed journals
  64                 based on logging information that is received from the
  65                 kernel, from user processes via the libc
  66                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
  67                 call, from standard input and standard error of system
  68                 services or via its native API. It will implicitly
  69                 collect numerous metadata fields for each log
  70                 messages in a secure and unfakeable way. See
  71                 <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  72                 for more information about the collected metadata.
  73                 </para>
  74
  75                 <para>Log data collected by the journal is primarily
  76                 text-based but can also include binary data where
  77                 necessary. All objects stored in the journal can be up
  78                 to 2^64-1 bytes in size.</para>
  79
  80                 <para>By default, the journal stores log data in
  81                 <filename>/run/log/journal/</filename>. Since
  82                 <filename>/run/</filename> is volatile, log data is
  83                 lost at reboot. To make the data persistent, it
  84                 is sufficient to create
  85                 <filename>/var/log/journal/</filename> where
  86                 <filename>systemd-journald</filename> will then store
  87                 the data.</para>
  88
  89                 <para><filename>systemd-journald</filename> will
  90                 forward all received log messages to the <constant>AF_UNIX</constant>
  91                 <constant>SOCK_DGRAM</constant> socket
  92                 <filename>/run/systemd/journal/syslog</filename>, if it exists, which
  93                 may be used by Unix syslog daemons to process the data
  94                 further.</para>
  95
  96                 <para>See
  97                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  98                 for information about the configuration of this
  99                 service.</para>
 100         </refsect1>
 101
 102         <refsect1>
 103                 <title>Signals</title>
 104
 105                 <variablelist>
 106                         <varlistentry>
 107                                 <term>SIGUSR1</term>
 108
 109                                 <listitem><para>Request that journal
 110                                 data from <filename>/run/</filename>
 111                                 is flushed to
 112                                 <filename>/var/</filename> in order to
 113                                 make it persistent (if this is
 114                                 enabled). This must be used after
 115                                 <filename>/var/</filename> is mounted,
 116                                 as otherwise log data from
 117                                 <filename>/run</filename> is never
 118                                 flushed to <filename>/var</filename>
 119                                 regardless of the
 120                                 configuration.</para></listitem>
 121                         </varlistentry>
 122
 123                         <varlistentry>
 124                                 <term>SIGUSR2</term>
 125
 126                                 <listitem><para>Request immediate
 127                                 rotation of the journal
 128                                 files.</para></listitem>
 129                         </varlistentry>
 130                 </variablelist>
 131         </refsect1>
 132
 133         <refsect1>
 134                 <title>Kernel Command Line</title>
 135
 136                 <para>A few configuration parameters from
 137                 <filename>journald.conf</filename> may be overridden on
 138                 the kernel command line:</para>
 139
 140                 <variablelist class='kernel-commandline-options'>
 141                         <varlistentry>
 142                                 <term><varname>systemd.journald.forward_to_syslog=</varname></term>
 143                                 <term><varname>systemd.journald.forward_to_kmsg=</varname></term>
 144                                 <term><varname>systemd.journald.forward_to_console=</varname></term>
 145                                 <term><varname>systemd.journald.forward_to_wall=</varname></term>
 146
 147                                 <listitem><para>Enables/disables
 148                                 forwarding of collected log messages
 149                                 to syslog, the kernel log buffer, the
 150                                 system console or wall.
 151                                 </para>
 152
 153                                 <para>See
 154                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 155                                 for information about these settings.</para>
 156                                 </listitem>
 157
 158                         </varlistentry>
 159                 </variablelist>
 160         </refsect1>
 161
 162         <refsect1>
 163                 <title>Access Control</title>
 164
 165                 <para>Journal files are, by default, owned and readable
 166                 by the <literal>systemd-journal</literal> system group
 167                 but are not writable. Adding a user to this group thus
 168                 enables her/him to read the journal files.</para>
 169
 170                 <para>By default, each logged in user will get her/his
 171                 own set of journal files in
 172                 <filename>/var/log/journal/</filename>. These files
 173                 will not be owned by the user, however, in order to
 174                 avoid that the user can write to them
 175                 directly. Instead, file system ACLs are used to ensure
 176                 the user gets read access only.</para>
 177
 178                 <para>Additional users and groups may be granted
 179                 access to journal files via file system access control
 180                 lists (ACL). Distributions and administrators may
 181                 choose to grant read access to all members of the
 182                 <literal>wheel</literal> and <literal>adm</literal>
 183                 system groups with a command such as the
 184                 following:</para>
 185
 186                 <programlisting># setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/</programlisting>
 187
 188                 <para>Note that this command will update the ACLs both
 189                 for existing journal files and for future journal
 190                 files created in the
 191                 <filename>/var/log/journal/</filename>
 192                 directory.</para>
 193         </refsect1>
 194
 195         <refsect1>
 196                 <title>Files</title>
 197
 198                 <variablelist>
 199                         <varlistentry>
 200                                 <term><filename>/etc/systemd/journald.conf</filename></term>
 201
 202                                 <listitem><para>Configure
 203                                 <command>systemd-journald</command>
 204                                 behaviour. See
 205                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 206                                 </para></listitem>
 207                         </varlistentry>
 208
 209                         <varlistentry>
 210                                 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
 211                                 <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
 212                                 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term>
 213                                 <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term>
 214
 215                                 <listitem><para><command>systemd-journald</command>
 216                                 writes entries to files in
 217                                 <filename>/run/log/journal/<replaceable>machine-id</replaceable>/</filename>
 218                                 or
 219                                 <filename>/var/log/journal/<replaceable>machine-id</replaceable>/</filename>
 220                                 with the <literal>.journal</literal>
 221                                 suffix. If the daemon is stopped
 222                                 uncleanly, or if the files are found
 223                                 to be corrupted, they are renamed
 224                                 using the <literal>.journal~</literal>
 225                                 suffix, and
 226                                 <command>systemd-journald</command>
 227                                 starts writing to a new
 228                                 file. <filename>/run</filename> is
 229                                 used when
 230                                 <filename>/var/log/journal</filename>
 231                                 is not available, or when
 232                                 <option>Storage=volatile</option> is
 233                                 set in the
 234                                 <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 235                                 configuration file.
 236                                 </para></listitem>
 237                         </varlistentry>
 238                 </variablelist>
 239         </refsect1>
 240
 241         <refsect1>
 242                 <title>See Also</title>
 243                 <para>
 244                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 245                         <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 246                         <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 247                         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 248                         <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 249                         <citerefentry><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 250                         <command>pydoc systemd.journal</command>.
 251                 </para>
 252         </refsect1>
 253
 254 </refentry>