[systemd.git] / man / journald.conf.d.html

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>journald.conf</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><style>
    a.headerlink {
      color: #c60f0f;
      font-size: 0.8em;
      padding: 0 4px 0 4px;
      text-decoration: none;
      visibility: hidden;
    }

    a.headerlink:hover {
      background-color: #c60f0f;
      color: white;
    }

    h1:hover > a.headerlink, h2:hover > a.headerlink, h3:hover > a.headerlink, dt:hover > a.headerlink {
      visibility: visible;
    }
  </style><a href="index.html">Index </a>·
  <a href="systemd.directives.html">Directives </a>·
  <a href="../python-systemd/index.html">Python </a>·
  <a href="../libudev/index.html">libudev </a>·
  <a href="../libudev/index.html">gudev </a><span style="float:right">systemd 220</span><hr><div class="refentry"><a name="journald.conf"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>journald.conf, journald.conf.d — Journal service configuration files</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><p><code class="filename">/etc/systemd/journald.conf</code></p><p><code class="filename">/etc/systemd/journald.conf.d/*.conf</code></p><p><code class="filename">/run/systemd/journald.conf.d/*.conf</code></p><p><code class="filename">/usr/lib/systemd/journald.conf.d/*.conf</code></p></div><div class="refsect1"><a name="idm139651278486960"></a><h2 id="Description">Description<a class="headerlink" title="Permalink to this headline" href="#Description">¶</a></h2><p>These files configure various parameters of the systemd
    journal service,
    <a href="systemd-journald.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-journald.service</span>(8)</span></a>.</p></div><div class="refsection"><a name="main-conf"></a><h2>Configuration Directories and Precedence</h2><p>Default configuration is defined during compilation, so a
    configuration file is only needed when it is necessary to deviate
    from those defaults. By default the configuration file in
    <code class="filename">/etc/systemd/</code> contains commented out entries
    showing the defaults as a guide to the administrator. This file
    can be edited to create local overrides.
    </p><p>When packages need to customize the configuration, they can
    install configuration snippets in
    <code class="filename">/usr/lib/systemd/*.conf.d/</code>. Files in
    <code class="filename">/etc/</code> are reserved for the local
    administrator, who may use this logic to override the
    configuration files installed by vendor packages. The main
    configuration file is read before any of the configuration
    directories, and has the lowest precedence; entries in a file in
    any configuration directory override entries in the single
    configuration file. Files in the
    <code class="filename">*.conf.d/</code> configuration subdirectories
    are sorted by their filename in lexicographic order, regardless of
    which of the subdirectories they reside in. If multiple files
    specify the same option, the entry in the file with the
    lexicographically latest name takes precedence.  It is recommended
    to prefix all filenames in those subdirectories with a two-digit
    number and a dash, to simplify the ordering of the files.</p><p>To disable a configuration file supplied by the vendor, the
    recommended way is to place a symlink to
    <code class="filename">/dev/null</code> in the configuration directory in
    <code class="filename">/etc/</code>, with the same filename as the vendor
    configuration file.</p></div><div class="refsect1"><a name="idm139651273530096"></a><h2 id="Options">Options<a class="headerlink" title="Permalink to this headline" href="#Options">¶</a></h2><p>All options are configured in the
    "<code class="literal">[Journal]</code>" section:</p><div class="variablelist"><dl class="variablelist"><dt id="Storage="><span class="term"><code class="varname">Storage=</code></span><a class="headerlink" title="Permalink to this term" href="#Storage=">¶</a></dt><dd><p>Controls where to store journal data. One of
        "<code class="literal">volatile</code>",
        "<code class="literal">persistent</code>",
        "<code class="literal">auto</code>" and
        "<code class="literal">none</code>". If
        "<code class="literal">volatile</code>", journal
        log data will be stored only in memory, i.e. below the
        <code class="filename">/run/log/journal</code> hierarchy (which is
        created if needed). If "<code class="literal">persistent</code>", data
        will be stored preferably on disk, i.e. below the
        <code class="filename">/var/log/journal</code> hierarchy (which is
        created if needed), with a fallback to
        <code class="filename">/run/log/journal</code> (which is created if
        needed), during early boot and if the disk is not writable.
        "<code class="literal">auto</code>" is similar to
        "<code class="literal">persistent</code>" but the directory
        <code class="filename">/var/log/journal</code> is not created if
        needed, so that its existence controls where log data goes.
        "<code class="literal">none</code>" turns off all storage, all log data
        received will be dropped. Forwarding to other targets, such as
        the console, the kernel log buffer, or a syslog socket will
        still work however. Defaults to
        "<code class="literal">auto</code>".</p></dd><dt id="Compress="><span class="term"><code class="varname">Compress=</code></span><a class="headerlink" title="Permalink to this term" href="#Compress=">¶</a></dt><dd><p>Takes a boolean value. If enabled (the
        default), data objects that shall be stored in the journal and
        are larger than a certain threshold are compressed before they
        are written to the file system.</p></dd><dt id="Seal="><span class="term"><code class="varname">Seal=</code></span><a class="headerlink" title="Permalink to this term" href="#Seal=">¶</a></dt><dd><p>Takes a boolean value. If enabled (the
        default), and a sealing key is available (as created by
        <a href="journalctl.html"><span class="citerefentry"><span class="refentrytitle">journalctl</span>(1)</span></a>'s
        <code class="option">--setup-keys</code> command), Forward Secure Sealing
        (FSS) for all persistent journal files is enabled. FSS is
        based on <a class="ulink" href="https://eprint.iacr.org/2013/397" target="_top">Seekable Sequential Key
        Generators</a> by G. A. Marson and B. Poettering
        (doi:10.1007/978-3-642-40203-6_7) and may be used to protect
        journal files from unnoticed alteration.</p></dd><dt id="SplitMode="><span class="term"><code class="varname">SplitMode=</code></span><a class="headerlink" title="Permalink to this term" href="#SplitMode=">¶</a></dt><dd><p>Controls whether to split up journal files per
        user. One of "<code class="literal">uid</code>", "<code class="literal">login</code>"
        and "<code class="literal">none</code>". If "<code class="literal">uid</code>", all
        users will get each their own journal files regardless of
        whether they possess a login session or not, however system
        users will log into the system journal. If
        "<code class="literal">login</code>", actually logged-in users will get
        each their own journal files, but users without login session
        and system users will log into the system journal. If
        "<code class="literal">none</code>", journal files are not split up by
        user and all messages are instead stored in the single system
        journal. Note that splitting up journal files by user is only
        available for journals stored persistently. If journals are
        stored on volatile storage (see above), only a single journal
        file for all user IDs is kept. Defaults to
        "<code class="literal">uid</code>".</p></dd><dt id="RateLimitInterval="><span class="term"><code class="varname">RateLimitInterval=</code>, </span><span class="term"><code class="varname">RateLimitBurst=</code></span><a class="headerlink" title="Permalink to this term" href="#RateLimitInterval=">¶</a></dt><dd><p>Configures the rate limiting that is applied
        to all messages generated on the system. If, in the time
        interval defined by <code class="varname">RateLimitInterval=</code>,
        more messages than specified in
        <code class="varname">RateLimitBurst=</code> are logged by a service,
        all further messages within the interval are dropped until the
        interval is over. A message about the number of dropped
        messages is generated. This rate limiting is applied
        per-service, so that two services which log do not interfere
        with each other's limits. Defaults to 1000 messages in 30s.
        The time specification for
        <code class="varname">RateLimitInterval=</code> may be specified in the
        following units: "<code class="literal">s</code>", "<code class="literal">min</code>",
        "<code class="literal">h</code>", "<code class="literal">ms</code>",
        "<code class="literal">us</code>". To turn off any kind of rate limiting,
        set either value to 0.</p></dd><dt id="SystemMaxUse="><span class="term"><code class="varname">SystemMaxUse=</code>, </span><span class="term"><code class="varname">SystemKeepFree=</code>, </span><span class="term"><code class="varname">SystemMaxFileSize=</code>, </span><span class="term"><code class="varname">RuntimeMaxUse=</code>, </span><span class="term"><code class="varname">RuntimeKeepFree=</code>, </span><span class="term"><code class="varname">RuntimeMaxFileSize=</code></span><a class="headerlink" title="Permalink to this term" href="#SystemMaxUse=">¶</a></dt><dd><p>Enforce size limits on the journal files
        stored. The options prefixed with "<code class="literal">System</code>"
        apply to the journal files when stored on a persistent file
        system, more specifically
        <code class="filename">/var/log/journal</code>. The options prefixed
        with "<code class="literal">Runtime</code>" apply to the journal files
        when stored on a volatile in-memory file system, more
        specifically <code class="filename">/run/log/journal</code>. The former
        is used only when <code class="filename">/var</code> is mounted,
        writable, and the directory
        <code class="filename">/var/log/journal</code> exists. Otherwise, only
        the latter applies. Note that this means that during early
        boot and if the administrator disabled persistent logging,
        only the latter options apply, while the former apply if
        persistent logging is enabled and the system is fully booted
        up. <span class="command"><strong>journalctl</strong></span> and
        <span class="command"><strong>systemd-journald</strong></span> ignore all files with
        names not ending with "<code class="literal">.journal</code>" or
        "<code class="literal">.journal~</code>", so only such files, located in
        the appropriate directories, are taken into account when
        calculating current disk usage.
        </p><p><code class="varname">SystemMaxUse=</code> and
        <code class="varname">RuntimeMaxUse=</code> control how much disk space
        the journal may use up at maximum.
        <code class="varname">SystemKeepFree=</code> and
        <code class="varname">RuntimeKeepFree=</code> control how much disk
        space systemd-journald shall leave free for other uses.
        <span class="command"><strong>systemd-journald</strong></span> will respect both limits
        and use the smaller of the two values.</p><p>The first pair defaults to 10% and the second to 15% of
        the size of the respective file system. If the file system is
        nearly full and either <code class="varname">SystemKeepFree=</code> or
        <code class="varname">RuntimeKeepFree=</code> is violated when
        systemd-journald is started, the value will be raised to
        percentage that is actually free. This means that if there was
        enough free space before and journal files were created, and
        subsequently something else causes the file system to fill up,
        journald will stop using more space, but it will not be
        removing existing files to go reduce footprint either.</p><p><code class="varname">SystemMaxFileSize=</code> and
        <code class="varname">RuntimeMaxFileSize=</code> control how large
        individual journal files may grow at maximum. This influences
        the granularity in which disk space is made available through
        rotation, i.e. deletion of historic data. Defaults to one
        eighth of the values configured with
        <code class="varname">SystemMaxUse=</code> and
        <code class="varname">RuntimeMaxUse=</code>, so that usually seven
        rotated journal files are kept as history. Specify values in
        bytes or use K, M, G, T, P, E as units for the specified sizes
        (equal to 1024, 1024²,... bytes).  Note that size limits are
        enforced synchronously when journal files are extended, and no
        explicit rotation step triggered by time is
        needed.</p></dd><dt id="MaxFileSec="><span class="term"><code class="varname">MaxFileSec=</code></span><a class="headerlink" title="Permalink to this term" href="#MaxFileSec=">¶</a></dt><dd><p>The maximum time to store entries in a single
        journal file before rotating to the next one. Normally,
        time-based rotation should not be required as size-based
        rotation with options such as
        <code class="varname">SystemMaxFileSize=</code> should be sufficient to
        ensure that journal files do not grow without bounds. However,
        to ensure that not too much data is lost at once when old
        journal files are deleted, it might make sense to change this
        value from the default of one month. Set to 0 to turn off this
        feature. This setting takes time values which may be suffixed
        with the units "<code class="literal">year</code>",
        "<code class="literal">month</code>", "<code class="literal">week</code>",
        "<code class="literal">day</code>", "<code class="literal">h</code>" or
        "<code class="literal">m</code>" to override the default time unit of
        seconds.</p></dd><dt id="MaxRetentionSec="><span class="term"><code class="varname">MaxRetentionSec=</code></span><a class="headerlink" title="Permalink to this term" href="#MaxRetentionSec=">¶</a></dt><dd><p>The maximum time to store journal entries.
        This controls whether journal files containing entries older
        then the specified time span are deleted. Normally, time-based
        deletion of old journal files should not be required as
        size-based deletion with options such as
        <code class="varname">SystemMaxUse=</code> should be sufficient to
        ensure that journal files do not grow without bounds. However,
        to enforce data retention policies, it might make sense to
        change this value from the default of 0 (which turns off this
        feature). This setting also takes time values which may be
        suffixed with the units "<code class="literal">year</code>",
        "<code class="literal">month</code>", "<code class="literal">week</code>",
        "<code class="literal">day</code>", "<code class="literal">h</code>" or "<code class="literal">
        m</code>" to override the default time unit of
        seconds.</p></dd><dt id="SyncIntervalSec="><span class="term"><code class="varname">SyncIntervalSec=</code></span><a class="headerlink" title="Permalink to this term" href="#SyncIntervalSec=">¶</a></dt><dd><p>The timeout before synchronizing journal files
        to disk. After syncing, journal files are placed in the
        OFFLINE state. Note that syncing is unconditionally done
        immediately after a log message of priority CRIT, ALERT or
        EMERG has been logged. This setting hence applies only to
        messages of the levels ERR, WARNING, NOTICE, INFO, DEBUG. The
        default timeout is 5 minutes. </p></dd><dt id="ForwardToSyslog="><span class="term"><code class="varname">ForwardToSyslog=</code>, </span><span class="term"><code class="varname">ForwardToKMsg=</code>, </span><span class="term"><code class="varname">ForwardToConsole=</code>, </span><span class="term"><code class="varname">ForwardToWall=</code></span><a class="headerlink" title="Permalink to this term" href="#ForwardToSyslog=">¶</a></dt><dd><p>Control whether log messages received by the
        journal daemon shall be forwarded to a traditional syslog
        daemon, to the kernel log buffer (kmsg), to the system
        console, or sent as wall messages to all logged-in users.
        These options take boolean arguments. If forwarding to syslog
        is enabled but nothing reads messages from the socket,
        forwarding to syslog has no effect. By default, only
        forwarding to wall is enabled. These settings may be
        overridden at boot time with the kernel command line options
        "<code class="literal">systemd.journald.forward_to_syslog=</code>",
        "<code class="literal">systemd.journald.forward_to_kmsg=</code>",
        "<code class="literal">systemd.journald.forward_to_console=</code>", and
        "<code class="literal">systemd.journald.forward_to_wall=</code>". When
        forwarding to the console, the TTY to log to can be changed
        with <code class="varname">TTYPath=</code>, described
        below.</p></dd><dt id="MaxLevelStore="><span class="term"><code class="varname">MaxLevelStore=</code>, </span><span class="term"><code class="varname">MaxLevelSyslog=</code>, </span><span class="term"><code class="varname">MaxLevelKMsg=</code>, </span><span class="term"><code class="varname">MaxLevelConsole=</code>, </span><span class="term"><code class="varname">MaxLevelWall=</code></span><a class="headerlink" title="Permalink to this term" href="#MaxLevelStore=">¶</a></dt><dd><p>Controls the maximum log level of messages
        that are stored on disk, forwarded to syslog, kmsg, the
        console or wall (if that is enabled, see above). As argument,
        takes one of
        "<code class="literal">emerg</code>",
        "<code class="literal">alert</code>",
        "<code class="literal">crit</code>",
        "<code class="literal">err</code>",
        "<code class="literal">warning</code>",
        "<code class="literal">notice</code>",
        "<code class="literal">info</code>",
        "<code class="literal">debug</code>",
        or integer values in the range of 0..7 (corresponding to the
        same levels). Messages equal or below the log level specified
        are stored/forwarded, messages above are dropped. Defaults to
        "<code class="literal">debug</code>" for <code class="varname">MaxLevelStore=</code>
        and <code class="varname">MaxLevelSyslog=</code>, to ensure that the all
        messages are written to disk and forwarded to syslog. Defaults
        to
        "<code class="literal">notice</code>" for <code class="varname">MaxLevelKMsg=</code>,
        "<code class="literal">info</code>" for <code class="varname">MaxLevelConsole=</code>,
        and "<code class="literal">emerg</code>" for
        <code class="varname">MaxLevelWall=</code>.</p></dd><dt id="TTYPath="><span class="term"><code class="varname">TTYPath=</code></span><a class="headerlink" title="Permalink to this term" href="#TTYPath=">¶</a></dt><dd><p>Change the console TTY to use if
        <code class="varname">ForwardToConsole=yes</code> is used. Defaults to
        <code class="filename">/dev/console</code>.</p></dd></dl></div></div><div class="refsect1"><a name="idm139651273443536"></a><h2 id="Forwarding to traditional syslog daemons">Forwarding to traditional syslog daemons<a class="headerlink" title="Permalink to this headline" href="#Forwarding%20to%20traditional%20syslog%20daemons">¶</a></h2><p>
      Journal events can be transferred to a different logging daemon
      in two different ways. In the first method, messages are
      immediately forwarded to a socket
      (<code class="filename">/run/systemd/journal/syslog</code>), where the
      traditional syslog daemon can read them. This method is
      controlled by <code class="varname">ForwardToSyslog=</code> option.  In a
      second method, a syslog daemon behaves like a normal journal
      client, and reads messages from the journal files, similarly to
      <a href="journalctl.html"><span class="citerefentry"><span class="refentrytitle">journalctl</span>(1)</span></a>.
      In this method, messages do not have to be read immediately,
      which allows a logging daemon which is only started late in boot
      to access all messages since the start of the system. In
      addition, full structured meta-data is available to it. This
      method of course is available only if the messages are stored in
      a journal file at all. So it will not work if
      <code class="varname">Storage=none</code> is set. It should be noted that
      usually the <span class="emphasis"><em>second</em></span> method is used by syslog
      daemons, so the <code class="varname">Storage=</code> option, and not the
      <code class="varname">ForwardToSyslog=</code> option, is relevant for them.
    </p></div><div class="refsect1"><a name="idm139651273438176"></a><h2 id="See Also">See Also<a class="headerlink" title="Permalink to this headline" href="#See%20Also">¶</a></h2><p>
        <a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>,
        <a href="systemd-journald.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-journald.service</span>(8)</span></a>,
        <a href="journalctl.html"><span class="citerefentry"><span class="refentrytitle">journalctl</span>(1)</span></a>,
        <a href="systemd.journal-fields.html"><span class="citerefentry"><span class="refentrytitle">systemd.journal-fields</span>(7)</span></a>,
        <a href="systemd-system.conf.html"><span class="citerefentry"><span class="refentrytitle">systemd-system.conf</span>(5)</span></a>
      </p></div></div></body></html>