man/systemd-journald.service.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>systemd-journald.service</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><style>
   2     a.headerlink {
   3       color: #c60f0f;
   4       font-size: 0.8em;
   5       padding: 0 4px 0 4px;
   6       text-decoration: none;
   7       visibility: hidden;
   8     }
   9
  10     a.headerlink:hover {
  11       background-color: #c60f0f;
  12       color: white;
  13     }
  14
  15     h1:hover > a.headerlink, h2:hover > a.headerlink, h3:hover > a.headerlink, dt:hover > a.headerlink {
  16       visibility: visible;
  17     }
  18   </style><a href="index.html">Index </a>·
  19   <a href="systemd.directives.html">Directives </a>·
  20   <a href="../python-systemd/index.html">Python </a>·
  21   <a href="../libudev/index.html">libudev </a>·
  22   <a href="../libudev/index.html">gudev </a><span style="float:right">systemd 215</span><hr><div class="refentry"><a name="systemd-journald.service"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>systemd-journald.service, systemd-journald.socket, systemd-journald-dev-log.socket, systemd-journald — Journal service</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><p><code class="filename">systemd-journald.service</code></p><p><code class="filename">systemd-journald.socket</code></p><p><code class="filename">systemd-journald-dev-log.socket</code></p><p><code class="filename">/usr/lib/systemd/systemd-journald</code></p></div><div class="refsect1"><a name="idm214181031376"></a><h2 id="Description">Description<a class="headerlink" title="Permalink to this headline" href="#Description">¶</a></h2><p><code class="filename">systemd-journald</code> is a
  23                 system service that collects and stores logging data.
  24                 It creates and maintains structured, indexed journals
  25                 based on logging information that is received from the
  26                 kernel, from user processes via the libc
  27                 <a href="syslog.html"><span class="citerefentry"><span class="refentrytitle">syslog</span>(3)</span></a>
  28                 call, from standard input and standard error of system
  29                 services or via its native API. It will implicitly
  30                 collect numerous metadata fields for each log
  31                 messages in a secure and unfakeable way. See
  32                 <a href="systemd.journal-fields.html"><span class="citerefentry"><span class="refentrytitle">systemd.journal-fields</span>(7)</span></a>
  33                 for more information about the collected metadata.
  34                 </p><p>Log data collected by the journal is primarily
  35                 text-based but can also include binary data where
  36                 necessary. All objects stored in the journal can be up
  37                 to 2^64-1 bytes in size.</p><p>By default, the journal stores log data in
  38                 <code class="filename">/run/log/journal/</code>. Since
  39                 <code class="filename">/run/</code> is volatile, log data is
  40                 lost at reboot. To make the data persistent, it
  41                 is sufficient to create
  42                 <code class="filename">/var/log/journal/</code> where
  43                 <code class="filename">systemd-journald</code> will then store
  44                 the data.</p><p><code class="filename">systemd-journald</code> will
  45                 forward all received log messages to the <code class="constant">AF_UNIX</code>
  46                 <code class="constant">SOCK_DGRAM</code> socket
  47                 <code class="filename">/run/systemd/journal/syslog</code>, if it exists, which
  48                 may be used by Unix syslog daemons to process the data
  49                 further.</p><p>See
  50                 <a href="journald.conf.html"><span class="citerefentry"><span class="refentrytitle">journald.conf</span>(5)</span></a>
  51                 for information about the configuration of this
  52                 service.</p></div><div class="refsect1"><a name="idm214181154000"></a><h2 id="Signals">Signals<a class="headerlink" title="Permalink to this headline" href="#Signals">¶</a></h2><div class="variablelist"><dl class="variablelist"><dt id="SIGUSR1"><span class="term">SIGUSR1</span><a class="headerlink" title="Permalink to this term" href="#SIGUSR1">¶</a></dt><dd><p>Request that journal
  53                                 data from <code class="filename">/run/</code>
  54                                 is flushed to
  55                                 <code class="filename">/var/</code> in order to
  56                                 make it persistent (if this is
  57                                 enabled). This must be used after
  58                                 <code class="filename">/var/</code> is mounted,
  59                                 as otherwise log data from
  60                                 <code class="filename">/run</code> is never
  61                                 flushed to <code class="filename">/var</code>
  62                                 regardless of the
  63                                 configuration.</p></dd><dt id="SIGUSR2"><span class="term">SIGUSR2</span><a class="headerlink" title="Permalink to this term" href="#SIGUSR2">¶</a></dt><dd><p>Request immediate
  64                                 rotation of the journal
  65                                 files.</p></dd></dl></div></div><div class="refsect1"><a name="idm214181146192"></a><h2 id="Kernel Command Line">Kernel Command Line<a class="headerlink" title="Permalink to this headline" href="#Kernel%20Command%20Line">¶</a></h2><p>A few configuration parameters from
  66                 <code class="filename">journald.conf</code> may be overridden on
  67                 the kernel command line:</p><div class="variablelist"><dl class="variablelist"><dt id="systemd.journald.forward_to_syslog="><span class="term"><code class="varname">systemd.journald.forward_to_syslog=</code>, </span><span class="term"><code class="varname">systemd.journald.forward_to_kmsg=</code>, </span><span class="term"><code class="varname">systemd.journald.forward_to_console=</code>, </span><span class="term"><code class="varname">systemd.journald.forward_to_wall=</code></span><a class="headerlink" title="Permalink to this term" href="#systemd.journald.forward_to_syslog=">¶</a></dt><dd><p>Enables/disables
  68                                 forwarding of collected log messages
  69                                 to syslog, the kernel log buffer, the
  70                                 system console or wall.
  71                                 </p><p>See
  72                                 <a href="journald.conf.html"><span class="citerefentry"><span class="refentrytitle">journald.conf</span>(5)</span></a>
  73                                 for information about these settings.</p></dd></dl></div></div><div class="refsect1"><a name="idm214181138896"></a><h2 id="Access Control">Access Control<a class="headerlink" title="Permalink to this headline" href="#Access%20Control">¶</a></h2><p>Journal files are, by default, owned and readable
  74                 by the "<code class="literal">systemd-journal</code>" system group
  75                 but are not writable. Adding a user to this group thus
  76                 enables her/him to read the journal files.</p><p>By default, each logged in user will get her/his
  77                 own set of journal files in
  78                 <code class="filename">/var/log/journal/</code>. These files
  79                 will not be owned by the user, however, in order to
  80                 avoid that the user can write to them
  81                 directly. Instead, file system ACLs are used to ensure
  82                 the user gets read access only.</p><p>Additional users and groups may be granted
  83                 access to journal files via file system access control
  84                 lists (ACL). Distributions and administrators may
  85                 choose to grant read access to all members of the
  86                 "<code class="literal">wheel</code>" and "<code class="literal">adm</code>"
  87                 system groups with a command such as the
  88                 following:</p><pre class="programlisting"># setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/</pre><p>Note that this command will update the ACLs both
  89                 for existing journal files and for future journal
  90                 files created in the
  91                 <code class="filename">/var/log/journal/</code>
  92                 directory.</p></div><div class="refsect1"><a name="idm214181124160"></a><h2 id="Files">Files<a class="headerlink" title="Permalink to this headline" href="#Files">¶</a></h2><div class="variablelist"><dl class="variablelist"><dt id="/etc/systemd/journald.conf"><span class="term"><code class="filename">/etc/systemd/journald.conf</code></span><a class="headerlink" title="Permalink to this term" href="#/etc/systemd/journald.conf">¶</a></dt><dd><p>Configure
  93                                 <span class="command"><strong>systemd-journald</strong></span>
  94                                 behaviour. See
  95                                 <a href="journald.conf.html"><span class="citerefentry"><span class="refentrytitle">journald.conf</span>(5)</span></a>.
  96                                 </p></dd><dt id="/run/log/journal/machine-id/*.journal"><span class="term"><code class="filename">/run/log/journal/<em class="replaceable"><code>machine-id</code></em>/*.journal</code>, </span><span class="term"><code class="filename">/run/log/journal/<em class="replaceable"><code>machine-id</code></em>/*.journal~</code>, </span><span class="term"><code class="filename">/var/log/journal/<em class="replaceable"><code>machine-id</code></em>/*.journal</code>, </span><span class="term"><code class="filename">/var/log/journal/<em class="replaceable"><code>machine-id</code></em>/*.journal~</code></span><a class="headerlink" title="Permalink to this term" href="#/run/log/journal/machine-id/*.journal">¶</a></dt><dd><p><span class="command"><strong>systemd-journald</strong></span>
  97                                 writes entries to files in
  98                                 <code class="filename">/run/log/journal/<em class="replaceable"><code>machine-id</code></em>/</code>
  99                                 or
 100                                 <code class="filename">/var/log/journal/<em class="replaceable"><code>machine-id</code></em>/</code>
 101                                 with the "<code class="literal">.journal</code>"
 102                                 suffix. If the daemon is stopped
 103                                 uncleanly, or if the files are found
 104                                 to be corrupted, they are renamed
 105                                 using the "<code class="literal">.journal~</code>"
 106                                 suffix, and
 107                                 <span class="command"><strong>systemd-journald</strong></span>
 108                                 starts writing to a new
 109                                 file. <code class="filename">/run</code> is
 110                                 used when
 111                                 <code class="filename">/var/log/journal</code>
 112                                 is not available, or when
 113                                 <code class="option">Storage=volatile</code> is
 114                                 set in the
 115                                 <a href="journald.conf.html"><span class="citerefentry"><span class="refentrytitle">journald.conf</span>(5)</span></a>
 116                                 configuration file.
 117                                 </p></dd></dl></div></div><div class="refsect1"><a name="idm214176140576"></a><h2 id="See Also">See Also<a class="headerlink" title="Permalink to this headline" href="#See%20Also">¶</a></h2><p>
 118                         <a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>,
 119                         <a href="journalctl.html"><span class="citerefentry"><span class="refentrytitle">journalctl</span>(1)</span></a>,
 120                         <a href="journald.conf.html"><span class="citerefentry"><span class="refentrytitle">journald.conf</span>(5)</span></a>,
 121                         <a href="systemd.journal-fields.html"><span class="citerefentry"><span class="refentrytitle">systemd.journal-fields</span>(7)</span></a>,
 122                         <a href="sd-journal.html"><span class="citerefentry"><span class="refentrytitle">sd-journal</span>(3)</span></a>,
 123                         <a href="setfacl.html"><span class="citerefentry"><span class="refentrytitle">setfacl</span>(1)</span></a>,
 124                         <span class="command"><strong>pydoc systemd.journal</strong></span>.
 125                 </p></div></div></body></html>