man/journald.conf.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
   5
   6 <refentry id="journald.conf"
   7     xmlns:xi="http://www.w3.org/2001/XInclude">
   8   <refentryinfo>
   9     <title>journald.conf</title>
  10     <productname>systemd</productname>
  11   </refentryinfo>
  12
  13   <refmeta>
  14     <refentrytitle>journald.conf</refentrytitle>
  15     <manvolnum>5</manvolnum>
  16   </refmeta>
  17
  18   <refnamediv>
  19     <refname>journald.conf</refname>
  20     <refname>journald.conf.d</refname>
  21     <refname>journald@.conf</refname>
  22     <refpurpose>Journal service configuration files</refpurpose>
  23   </refnamediv>
  24
  25   <refsynopsisdiv>
  26     <para><simplelist>
  27       <member><filename>/etc/systemd/journald.conf</filename></member>
  28       <member><filename>/etc/systemd/journald.conf.d/*.conf</filename></member>
  29       <member><filename>/run/systemd/journald.conf.d/*.conf</filename></member>
  30       <member><filename>/usr/lib/systemd/journald.conf.d/*.conf</filename></member>
  31       <member><filename>/etc/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf</filename></member>
  32       <member><filename>/etc/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf.d/*.conf</filename></member>
  33       <member><filename>/run/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf.d/*.conf</filename></member>
  34       <member><filename>/usr/lib/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf.d/*.conf</filename></member>
  35     </simplelist></para>
  36   </refsynopsisdiv>
  37
  38   <refsect1>
  39     <title>Description</title>
  40
  41     <para>These files configure various parameters of the systemd journal service,
  42     <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
  43     See
  44     <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  45     for a general description of the syntax.</para>
  46
  47     <para>The <command>systemd-journald</command> instance managing the default namespace is configured by
  48     <filename>/etc/systemd/journald.conf</filename> and associated drop-ins. Instances managing other
  49     namespaces read <filename>/etc/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf</filename>
  50     and associated drop-ins with the namespace identifier filled in. This allows each namespace to carry
  51     a distinct configuration. See
  52     <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  53     for details about journal namespaces.</para>
  54   </refsect1>
  55
  56   <xi:include href="standard-conf.xml" xpointer="main-conf" />
  57
  58   <refsect1>
  59     <title>Options</title>
  60
  61     <para>All options are configured in the
  62     [Journal] section:</para>
  63
  64     <variablelist class='config-directives'>
  65
  66       <varlistentry>
  67         <term><varname>Storage=</varname></term>
  68
  69         <listitem><para>Controls where to store journal data. One of <literal>volatile</literal>,
  70         <literal>persistent</literal>, <literal>auto</literal> and <literal>none</literal>. If
  71         <literal>volatile</literal>, journal log data will be stored only in memory, i.e. below the
  72         <filename>/run/log/journal</filename> hierarchy (which is created if needed). If
  73         <literal>persistent</literal>, data will be stored preferably on disk, i.e. below the
  74         <filename>/var/log/journal</filename> hierarchy (which is created if needed), with a fallback to
  75         <filename>/run/log/journal</filename> (which is created if needed), during early boot and if the disk
  76         is not writable. <literal>auto</literal> behaves like <literal>persistent</literal> if the
  77         <filename>/var/log/journal</filename> directory exists, and <literal>volatile</literal> otherwise
  78         (the existence of the directory controls the storage mode). <literal>none</literal> turns off all
  79         storage, all log data received will be dropped (but forwarding to other targets, such as the console,
  80         the kernel log buffer, or a syslog socket will still work). Defaults to <literal>auto</literal> in
  81         the default journal namespace, and <literal>persistent</literal> in all others.</para>
  82
  83         <para>Note that journald will initially use volatile storage, until a call to
  84         <command>journalctl --flush</command> (or sending <constant>SIGUSR1</constant> to journald) will cause
  85         it to switch to persistent logging (under the conditions mentioned above). This is done automatically
  86         on boot via <literal>systemd-journal-flush.service</literal>.</para>
  87
  88         <para>Note that when this option is changed to <literal>volatile</literal>, existing persistent data
  89         is not removed. In the other direction,
  90         <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> with
  91         the <option>--flush</option> option may be used to move volatile data to persistent storage.</para>
  92
  93         <para>When journal namespacing (see <varname>LogNamespace=</varname> in
  94         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>) is
  95         used, setting <varname>Storage=</varname> to <literal>volatile</literal> or <literal>auto</literal>
  96         will not have an effect on the creation of the per-namespace logs directory in
  97         <filename>/var/log/journal/</filename>, as the <filename>systemd-journald@.service</filename> service
  98         file by default carries <varname>LogsDirectory=</varname>. To turn that off, add a unit file drop-in
  99         file that sets <varname>LogsDirectory=</varname> to an empty string.</para>
 100
 101         <para>Note that per-user journal files are not supported unless persistent storage is enabled, thus
 102         making <command>journalctl --user</command> unavailable.</para>
 103
 104         <xi:include href="version-info.xml" xpointer="v186"/>
 105         </listitem>
 106       </varlistentry>
 107
 108       <varlistentry>
 109         <term><varname>Compress=</varname></term>
 110
 111         <listitem><para>Can take a boolean value. If enabled (the
 112         default), data objects that shall be stored in the journal
 113         and are larger than the default threshold of 512 bytes are
 114         compressed before they are written to the file system. It
 115         can also be set to a number of bytes to specify the
 116         compression threshold directly. Suffixes like K, M, and G
 117         can be used to specify larger units.</para></listitem>
 118       </varlistentry>
 119
 120       <varlistentry>
 121         <term><varname>Seal=</varname></term>
 122
 123         <listitem><para>Takes a boolean value. If enabled (the
 124         default), and a sealing key is available (as created by
 125         <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
 126         <option>--setup-keys</option> command), Forward Secure Sealing
 127         (FSS) for all persistent journal files is enabled. FSS is
 128         based on <ulink
 129         url="https://eprint.iacr.org/2013/397">Seekable Sequential Key
 130         Generators</ulink> by G. A. Marson and B. Poettering
 131         (doi:10.1007/978-3-642-40203-6_7) and may be used to protect
 132         journal files from unnoticed alteration.</para>
 133
 134         <xi:include href="version-info.xml" xpointer="v189"/></listitem>
 135       </varlistentry>
 136
 137       <varlistentry>
 138         <term><varname>SplitMode=</varname></term>
 139
 140         <listitem><para>Controls whether to split up journal files per user, either <literal>uid</literal> or
 141         <literal>none</literal>. Split journal files are primarily useful for access control: on UNIX/Linux access
 142         control is managed per file, and the journal daemon will assign users read access to their journal files. If
 143         <literal>uid</literal>, all regular users (with UID outside the range of system users, dynamic service users,
 144         and the nobody user) will each get their own journal files, and system users will log to the system journal.
 145         See <ulink url="https://systemd.io/UIDS-GIDS">Users, Groups, UIDs and GIDs on systemd systems</ulink>
 146         for more details about UID ranges.
 147         If <literal>none</literal>, journal files are not split up by user and all messages are
 148         instead stored in the single system journal. In this mode unprivileged users generally do not have access to
 149         their own log data. Note that splitting up journal files by user is only available for journals stored
 150         persistently. If journals are stored on volatile storage (see <varname>Storage=</varname> above), only a single
 151         journal file is used. Defaults to <literal>uid</literal>.</para>
 152
 153         <xi:include href="version-info.xml" xpointer="v190"/></listitem>
 154       </varlistentry>
 155
 156       <varlistentry>
 157         <term><varname>RateLimitIntervalSec=</varname></term>
 158         <term><varname>RateLimitBurst=</varname></term>
 159
 160         <listitem><para>Configures the rate limiting that is applied
 161         to all messages generated on the system. If, in the time
 162         interval defined by <varname>RateLimitIntervalSec=</varname>,
 163         more messages than specified in
 164         <varname>RateLimitBurst=</varname> are logged by a service,
 165         all further messages within the interval are dropped until the
 166         interval is over. A message about the number of dropped
 167         messages is generated. This rate limiting is applied
 168         per-service, so that two services which log do not interfere
 169         with each other's limits. Defaults to 10000 messages in 30s.
 170         The time specification for
 171         <varname>RateLimitIntervalSec=</varname> may be specified in the
 172         following units: <literal>s</literal>, <literal>min</literal>,
 173         <literal>h</literal>, <literal>ms</literal>,
 174         <literal>us</literal>. To turn off any kind of rate limiting,
 175         set either value to 0.</para>
 176
 177         <para>Note that the effective rate limit is multiplied by a
 178         factor derived from the available free disk space for the journal.
 179         Currently, this factor is calculated using the base 2 logarithm.</para>
 180
 181         <table>
 182           <title>Example <varname>RateLimitBurst=</varname> rate
 183             modifications by the available disk space</title>
 184           <tgroup cols='2'>
 185             <colspec colname='freespace' />
 186             <colspec colname='multiplier' />
 187             <thead>
 188               <row>
 189                 <entry>Available Disk Space</entry>
 190                 <entry>Burst Multiplier</entry>
 191               </row>
 192             </thead>
 193             <tbody>
 194               <row>
 195                 <entry>&lt;= 1MB</entry>
 196                 <entry>1</entry>
 197               </row>
 198               <row>
 199                 <entry>&lt;= 16MB</entry>
 200                 <entry>2</entry>
 201               </row>
 202               <row>
 203                 <entry>&lt;= 256MB</entry>
 204                 <entry>3</entry>
 205               </row>
 206               <row>
 207                 <entry>&lt;= 4GB</entry>
 208                 <entry>4</entry>
 209               </row>
 210               <row>
 211                 <entry>&lt;= 64GB</entry>
 212                 <entry>5</entry>
 213               </row>
 214               <row>
 215                 <entry>&lt;= 1TB</entry>
 216                 <entry>6</entry>
 217               </row>
 218             </tbody>
 219           </tgroup>
 220         </table>
 221
 222         <para>If a service provides rate limits for itself through
 223         <varname>LogRateLimitIntervalSec=</varname> and/or <varname>LogRateLimitBurst=</varname>
 224         in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 225         those values will override the settings specified here.</para>
 226         </listitem>
 227       </varlistentry>
 228
 229       <varlistentry>
 230         <term><varname>SystemMaxUse=</varname></term>
 231         <term><varname>SystemKeepFree=</varname></term>
 232         <term><varname>SystemMaxFileSize=</varname></term>
 233         <term><varname>SystemMaxFiles=</varname></term>
 234         <term><varname>RuntimeMaxUse=</varname></term>
 235         <term><varname>RuntimeKeepFree=</varname></term>
 236         <term><varname>RuntimeMaxFileSize=</varname></term>
 237         <term><varname>RuntimeMaxFiles=</varname></term>
 238
 239         <listitem><para>Enforce size limits on the journal files
 240         stored. The options prefixed with <literal>System</literal>
 241         apply to the journal files when stored on a persistent file
 242         system, more specifically
 243         <filename>/var/log/journal</filename>. The options prefixed
 244         with <literal>Runtime</literal> apply to the journal files
 245         when stored on a volatile in-memory file system, more
 246         specifically <filename>/run/log/journal</filename>. The former
 247         is used only when <filename>/var/</filename> is mounted,
 248         writable, and the directory
 249         <filename>/var/log/journal</filename> exists. Otherwise, only
 250         the latter applies. Note that this means that during early
 251         boot and if the administrator disabled persistent logging,
 252         only the latter options apply, while the former apply if
 253         persistent logging is enabled and the system is fully booted
 254         up. <command>journalctl</command> and
 255         <command>systemd-journald</command> ignore all files with
 256         names not ending with <literal>.journal</literal> or
 257         <literal>.journal~</literal>, so only such files, located in
 258         the appropriate directories, are taken into account when
 259         calculating current disk usage.</para>
 260
 261         <para><varname>SystemMaxUse=</varname> and
 262         <varname>RuntimeMaxUse=</varname> control how much disk space
 263         the journal may use up at most.
 264         <varname>SystemKeepFree=</varname> and
 265         <varname>RuntimeKeepFree=</varname> control how much disk
 266         space systemd-journald shall leave free for other uses.
 267         <command>systemd-journald</command> will respect both limits
 268         and use the smaller of the two values.</para>
 269
 270         <para>The first pair defaults to 10% and the second to 15% of
 271         the size of the respective file system, but each value is
 272         capped to 4G. If the file system is nearly full and either
 273         <varname>SystemKeepFree=</varname> or
 274         <varname>RuntimeKeepFree=</varname> are violated when
 275         systemd-journald is started, the limit will be raised to the
 276         percentage that is actually free. This means that if there was
 277         enough free space before and journal files were created, and
 278         subsequently something else causes the file system to fill up,
 279         journald will stop using more space, but it will not be
 280         removing existing files to reduce the footprint again,
 281         either. Also note that only archived files are deleted to reduce the
 282         space occupied by journal files. This means that, in effect, there might
 283         still be more space used than <varname>SystemMaxUse=</varname> or
 284         <varname>RuntimeMaxUse=</varname> limit after a vacuuming operation is
 285         complete.</para>
 286
 287         <para><varname>SystemMaxFileSize=</varname> and <varname>RuntimeMaxFileSize=</varname> control how
 288         large individual journal files may grow at most. This influences the granularity in which disk space
 289         is made available through rotation, i.e. deletion of historic data. Defaults to one eighth of the
 290         values configured with <varname>SystemMaxUse=</varname> and <varname>RuntimeMaxUse=</varname> capped
 291         to 128M, so that usually seven rotated journal files are kept as history. If the journal compact
 292         mode is enabled (enabled by default), the maximum file size is capped to 4G.</para>
 293
 294         <para>Specify values in bytes or use K, M, G, T, P, E as units for the specified sizes (equal to
 295         1024, 1024², … bytes). Note that size limits are enforced synchronously when journal files are
 296         extended, and no explicit rotation step triggered by time is needed.</para>
 297
 298         <para><varname>SystemMaxFiles=</varname> and
 299         <varname>RuntimeMaxFiles=</varname> control how many
 300         individual journal files to keep at most. Note that only
 301         archived files are deleted to reduce the number of files until
 302         this limit is reached; active files will stay around. This
 303         means that, in effect, there might still be more journal files
 304         around in total than this limit after a vacuuming operation is
 305         complete. This setting defaults to 100.</para></listitem>
 306       </varlistentry>
 307
 308       <varlistentry>
 309         <term><varname>MaxFileSec=</varname></term>
 310
 311         <listitem><para>The maximum time to store entries in a single
 312         journal file before rotating to the next one. Normally,
 313         time-based rotation should not be required as size-based
 314         rotation with options such as
 315         <varname>SystemMaxFileSize=</varname> should be sufficient to
 316         ensure that journal files do not grow without bounds. However,
 317         to ensure that not too much data is lost at once when old
 318         journal files are deleted, it might make sense to change this
 319         value from the default of one month. Set to 0 to turn off this
 320         feature. This setting takes time values which may be suffixed
 321         with the units <literal>year</literal>,
 322         <literal>month</literal>, <literal>week</literal>,
 323         <literal>day</literal>, <literal>h</literal> or
 324         <literal>m</literal> to override the default time unit of
 325         seconds.</para>
 326
 327         <xi:include href="version-info.xml" xpointer="v195"/></listitem>
 328       </varlistentry>
 329
 330       <varlistentry>
 331         <term><varname>MaxRetentionSec=</varname></term>
 332
 333         <listitem><para>The maximum time to store journal entries.
 334         This controls whether journal files containing entries older
 335         than the specified time span are deleted. Normally, time-based
 336         deletion of old journal files should not be required as
 337         size-based deletion with options such as
 338         <varname>SystemMaxUse=</varname> should be sufficient to
 339         ensure that journal files do not grow without bounds. However,
 340         to enforce data retention policies, it might make sense to
 341         change this value from the default of 0 (which turns off this
 342         feature). This setting also takes time values which may be
 343         suffixed with the units <literal>year</literal>,
 344         <literal>month</literal>, <literal>week</literal>,
 345         <literal>day</literal>, <literal>h</literal> or <literal>
 346         m</literal> to override the default time unit of
 347         seconds.</para>
 348
 349         <xi:include href="version-info.xml" xpointer="v195"/></listitem>
 350       </varlistentry>
 351
 352       <varlistentry>
 353         <term><varname>SyncIntervalSec=</varname></term>
 354
 355         <listitem><para>The timeout before synchronizing journal files
 356         to disk. After syncing, journal files are placed in the
 357         OFFLINE state. Note that syncing is unconditionally done
 358         immediately after a log message of priority CRIT, ALERT or
 359         EMERG has been logged. This setting hence applies only to
 360         messages of the levels ERR, WARNING, NOTICE, INFO, DEBUG. The
 361         default timeout is 5 minutes. </para>
 362
 363         <xi:include href="version-info.xml" xpointer="v199"/></listitem>
 364       </varlistentry>
 365
 366       <varlistentry>
 367         <term><varname>ForwardToSyslog=</varname></term>
 368         <term><varname>ForwardToKMsg=</varname></term>
 369         <term><varname>ForwardToConsole=</varname></term>
 370         <term><varname>ForwardToWall=</varname></term>
 371
 372         <listitem><para>Control whether log messages received by the journal daemon shall be forwarded to a
 373         traditional syslog daemon, to the kernel log buffer (kmsg), to the system console, or sent as wall
 374         messages to all logged-in users.  These options take boolean arguments. If forwarding to syslog is
 375         enabled but nothing reads messages from the socket, forwarding to syslog has no effect. By default,
 376         only forwarding to wall is enabled. These settings may be overridden at boot time with the kernel
 377         command line options <literal>systemd.journald.forward_to_syslog</literal>,
 378         <literal>systemd.journald.forward_to_kmsg</literal>,
 379         <literal>systemd.journald.forward_to_console</literal>, and
 380         <literal>systemd.journald.forward_to_wall</literal>. If the option name is specified without
 381         <literal>=</literal> and the following argument, true is assumed. Otherwise, the argument is parsed
 382         as a boolean.</para>
 383
 384         <para>When forwarding to the console, the TTY to log to can be changed with
 385         <varname>TTYPath=</varname>, described below.</para>
 386
 387         <para>When forwarding to the kernel log buffer (kmsg), make sure to select a suitably large size for
 388         the log buffer, for example by adding <literal>log_buf_len=8M</literal> to the kernel command line.
 389         <command>systemd</command> will automatically disable kernel's rate-limiting applied to userspace
 390         processes (equivalent to setting <literal>printk.devkmsg=on</literal>).</para></listitem>
 391
 392         <para>Note: Forwarding is performed synchronously within journald, and may significantly affect its
 393         performance.  This is particularly relevant when using ForwardToConsole=yes in cloud environments,
 394         where the console is often a slow, virtual serial port.  Since journald is implemented as a
 395         conventional single-process daemon, forwarding to a completely hung console will block journald.
 396         This can have a cascading effect resulting in any services synchronously logging to the blocked
 397         journal also becoming blocked.  Unless actively debugging/developing something, it's generally
 398         preferable to setup a <command>journalctl --follow</command> style service redirected to the
 399         console, instead of ForwardToConsole=yes, for production use.</para>
 400       </varlistentry>
 401
 402       <varlistentry>
 403         <term><varname>MaxLevelStore=</varname></term>
 404         <term><varname>MaxLevelSyslog=</varname></term>
 405         <term><varname>MaxLevelKMsg=</varname></term>
 406         <term><varname>MaxLevelConsole=</varname></term>
 407         <term><varname>MaxLevelWall=</varname></term>
 408
 409         <listitem><para>Controls the maximum log level of messages
 410         that are stored in the journal, forwarded to syslog, kmsg, the
 411         console or wall (if that is enabled, see above). As argument,
 412         takes one of
 413         <literal>emerg</literal>,
 414         <literal>alert</literal>,
 415         <literal>crit</literal>,
 416         <literal>err</literal>,
 417         <literal>warning</literal>,
 418         <literal>notice</literal>,
 419         <literal>info</literal>,
 420         <literal>debug</literal>,
 421         or integer values in the range of 0–7 (corresponding to the
 422         same levels). Messages equal or below the log level specified
 423         are stored/forwarded, messages above are dropped. Defaults to
 424         <literal>debug</literal> for <varname>MaxLevelStore=</varname>
 425         and <varname>MaxLevelSyslog=</varname>, to ensure that the all
 426         messages are stored in the journal and forwarded to syslog.
 427         Defaults to
 428         <literal>notice</literal> for <varname>MaxLevelKMsg=</varname>,
 429         <literal>info</literal> for <varname>MaxLevelConsole=</varname>,
 430         and <literal>emerg</literal> for
 431         <varname>MaxLevelWall=</varname>. These settings may be
 432         overridden at boot time with the kernel command line options
 433         <literal>systemd.journald.max_level_store=</literal>,
 434         <literal>systemd.journald.max_level_syslog=</literal>,
 435         <literal>systemd.journald.max_level_kmsg=</literal>,
 436         <literal>systemd.journald.max_level_console=</literal>,
 437         <literal>systemd.journald.max_level_wall=</literal>.</para>
 438
 439         <xi:include href="version-info.xml" xpointer="v185"/>
 440         </listitem>
 441       </varlistentry>
 442
 443       <varlistentry>
 444         <term><varname>ReadKMsg=</varname></term>
 445
 446         <listitem><para>Takes a boolean value. If enabled <command>systemd-journal</command> processes
 447         <filename>/dev/kmsg</filename> messages generated by the kernel. In the default journal namespace
 448         this option is enabled by default, it is disabled in all others.</para>
 449
 450         <xi:include href="version-info.xml" xpointer="v235"/></listitem>
 451       </varlistentry>
 452
 453       <varlistentry>
 454         <term><varname>Audit=</varname></term>
 455
 456         <listitem><para>Takes a boolean value. If enabled <command>systemd-journald</command> will turn on
 457         kernel auditing on start-up. If disabled it will turn it off. If unset it will neither enable nor
 458         disable it, leaving the previous state unchanged.  This means if another tool turns on auditing even
 459         if <command>systemd-journald</command> left it off, it will still collect the generated
 460         messages. Defaults to on.</para>
 461
 462         <para>Note that this option does not control whether <command>systemd-journald</command> collects
 463         generated audit records, it just controls whether it tells the kernel to generate them. If you need
 464         to prevent <command>systemd-journald</command> from collecting the generated messages, the socket
 465         unit <literal>systemd-journald-audit.socket</literal> can be disabled and in this case this setting
 466         is without effect.</para>
 467
 468         <xi:include href="version-info.xml" xpointer="v246"/>
 469         </listitem>
 470       </varlistentry>
 471
 472       <varlistentry>
 473         <term><varname>TTYPath=</varname></term>
 474
 475         <listitem><para>Change the console TTY to use if
 476         <varname>ForwardToConsole=yes</varname> is used. Defaults to
 477         <filename>/dev/console</filename>.</para>
 478
 479         <xi:include href="version-info.xml" xpointer="v185"/></listitem>
 480       </varlistentry>
 481
 482       <varlistentry>
 483         <term><varname>LineMax=</varname></term>
 484
 485         <listitem><para>The maximum line length to permit when converting stream logs into record logs. When a systemd
 486         unit's standard output/error are connected to the journal via a stream socket, the data read is split into
 487         individual log records at newline (<literal>\n</literal>, ASCII 10) and <constant>NUL</constant> characters. If no such delimiter is
 488         read for the specified number of bytes a hard log record boundary is artificially inserted, breaking up overly
 489         long lines into multiple log records. Selecting overly large values increases the possible memory usage of the
 490         Journal daemon for each stream client, as in the worst case the journal daemon needs to buffer the specified
 491         number of bytes in memory before it can flush a new log record to disk. Also note that permitting overly large
 492         line maximum line lengths affects compatibility with traditional log protocols as log records might not fit
 493         anymore into a single <constant>AF_UNIX</constant> or <constant>AF_INET</constant> datagram. Takes a size in
 494         bytes. If the value is suffixed with K, M, G or T, the specified size is parsed as Kilobytes, Megabytes,
 495         Gigabytes, or Terabytes (with the base 1024), respectively. Defaults to 48K, which is relatively large but
 496         still small enough so that log records likely fit into network datagrams along with extra room for
 497         metadata. Note that values below 79 are not accepted and will be bumped to 79.</para>
 498
 499         <xi:include href="version-info.xml" xpointer="v235"/></listitem>
 500       </varlistentry>
 501
 502     </variablelist>
 503
 504   </refsect1>
 505
 506   <refsect1>
 507     <title>Forwarding to traditional syslog daemons</title>
 508
 509     <para>
 510       Journal events can be transferred to a different logging daemon
 511       in two different ways. With the first method, messages are
 512       immediately forwarded to a socket
 513       (<filename>/run/systemd/journal/syslog</filename>), where the
 514       traditional syslog daemon can read them. This method is
 515       controlled by the <varname>ForwardToSyslog=</varname> option. With a
 516       second method, a syslog daemon behaves like a normal journal
 517       client, and reads messages from the journal files, similarly to
 518       <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
 519       With this, messages do not have to be read immediately,
 520       which allows a logging daemon which is only started late in boot
 521       to access all messages since the start of the system. In
 522       addition, full structured meta-data is available to it. This
 523       method of course is available only if the messages are stored in
 524       a journal file at all. So it will not work if
 525       <varname>Storage=none</varname> is set. It should be noted that
 526       usually the <emphasis>second</emphasis> method is used by syslog
 527       daemons, so the <varname>Storage=</varname> option, and not the
 528       <varname>ForwardToSyslog=</varname> option, is relevant for them.
 529     </para>
 530   </refsect1>
 531
 532   <refsect1>
 533       <title>See Also</title>
 534       <para>
 535         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 536         <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 537         <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 538         <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 539         <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 540       </para>
 541   </refsect1>
 542
 543 </refentry>