]>
Commit | Line | Data |
---|---|---|
b47ffcfd | 1 | <?xml version='1.0'?> <!--*-nxml-*--> |
3a54a157 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
12b42c76 | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> |
db9ecf05 | 4 | <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
b47ffcfd | 5 | |
a9edaeff | 6 | <refentry id="journald.conf" |
798d3a52 ZJS |
7 | xmlns:xi="http://www.w3.org/2001/XInclude"> |
8 | <refentryinfo> | |
9 | <title>journald.conf</title> | |
10 | <productname>systemd</productname> | |
798d3a52 ZJS |
11 | </refentryinfo> |
12 | ||
13 | <refmeta> | |
14 | <refentrytitle>journald.conf</refentrytitle> | |
15 | <manvolnum>5</manvolnum> | |
16 | </refmeta> | |
17 | ||
18 | <refnamediv> | |
19 | <refname>journald.conf</refname> | |
20 | <refname>journald.conf.d</refname> | |
6bc43619 | 21 | <refname>journald@.conf</refname> |
798d3a52 ZJS |
22 | <refpurpose>Journal service configuration files</refpurpose> |
23 | </refnamediv> | |
24 | ||
25 | <refsynopsisdiv> | |
73e97bb0 ZJS |
26 | <para><simplelist> |
27 | <member><filename>/etc/systemd/journald.conf</filename></member> | |
28 | <member><filename>/etc/systemd/journald.conf.d/*.conf</filename></member> | |
29 | <member><filename>/run/systemd/journald.conf.d/*.conf</filename></member> | |
30 | <member><filename>/usr/lib/systemd/journald.conf.d/*.conf</filename></member> | |
31 | <member><filename>/etc/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf</filename></member> | |
32 | <member><filename>/etc/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf.d/*.conf</filename></member> | |
33 | <member><filename>/run/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf.d/*.conf</filename></member> | |
34 | <member><filename>/usr/lib/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf.d/*.conf</filename></member> | |
35 | </simplelist></para> | |
798d3a52 ZJS |
36 | </refsynopsisdiv> |
37 | ||
38 | <refsect1> | |
39 | <title>Description</title> | |
40 | ||
0f943ae4 ZJS |
41 | <para>These files configure various parameters of the systemd journal service, |
42 | <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. | |
43 | See | |
675fa6ea | 44 | <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry> |
0f943ae4 | 45 | for a general description of the syntax.</para> |
798d3a52 | 46 | |
6bc43619 LP |
47 | <para>The <command>systemd-journald</command> instance managing the default namespace is configured by |
48 | <filename>/etc/systemd/journald.conf</filename> and associated drop-ins. Instances managing other | |
005c7b1d YW |
49 | namespaces read <filename>/etc/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf</filename> |
50 | and associated drop-ins with the namespace identifier filled in. This allows each namespace to carry | |
51 | a distinct configuration. See | |
6bc43619 LP |
52 | <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
53 | for details about journal namespaces.</para> | |
798d3a52 ZJS |
54 | </refsect1> |
55 | ||
e93549ef | 56 | <xi:include href="standard-conf.xml" xpointer="main-conf" /> |
798d3a52 ZJS |
57 | |
58 | <refsect1> | |
59 | <title>Options</title> | |
60 | ||
61 | <para>All options are configured in the | |
bdac5608 | 62 | [Journal] section:</para> |
798d3a52 | 63 | |
d2acdcc6 | 64 | <variablelist class='config-directives'> |
798d3a52 ZJS |
65 | |
66 | <varlistentry> | |
67 | <term><varname>Storage=</varname></term> | |
68 | ||
6bc43619 LP |
69 | <listitem><para>Controls where to store journal data. One of <literal>volatile</literal>, |
70 | <literal>persistent</literal>, <literal>auto</literal> and <literal>none</literal>. If | |
71 | <literal>volatile</literal>, journal log data will be stored only in memory, i.e. below the | |
72 | <filename>/run/log/journal</filename> hierarchy (which is created if needed). If | |
73 | <literal>persistent</literal>, data will be stored preferably on disk, i.e. below the | |
74 | <filename>/var/log/journal</filename> hierarchy (which is created if needed), with a fallback to | |
75 | <filename>/run/log/journal</filename> (which is created if needed), during early boot and if the disk | |
f254abcd ZJS |
76 | is not writable. <literal>auto</literal> behaves like <literal>persistent</literal> if the |
77 | <filename>/var/log/journal</filename> directory exists, and <literal>volatile</literal> otherwise | |
78 | (the existence of the directory controls the storage mode). <literal>none</literal> turns off all | |
79 | storage, all log data received will be dropped (but forwarding to other targets, such as the console, | |
80 | the kernel log buffer, or a syslog socket will still work). Defaults to <literal>auto</literal> in | |
81 | the default journal namespace, and <literal>persistent</literal> in all others.</para> | |
82 | ||
9854ac4a LP |
83 | <para>Note that journald will initially use volatile storage, until a call to |
84 | <command>journalctl --flush</command> (or sending <constant>SIGUSR1</constant> to journald) will cause | |
19d25fde LA |
85 | it to switch to persistent logging (under the conditions mentioned above). This is done automatically |
86 | on boot via <literal>systemd-journal-flush.service</literal>.</para> | |
87 | ||
f254abcd ZJS |
88 | <para>Note that when this option is changed to <literal>volatile</literal>, existing persistent data |
89 | is not removed. In the other direction, | |
90 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> with | |
91 | the <option>--flush</option> option may be used to move volatile data to persistent storage.</para> | |
fc709443 LP |
92 | |
93 | <para>When journal namespacing (see <varname>LogNamespace=</varname> in | |
94 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>) is | |
95 | used, setting <varname>Storage=</varname> to <literal>volatile</literal> or <literal>auto</literal> | |
96 | will not have an effect on the creation of the per-namespace logs directory in | |
97 | <filename>/var/log/journal/</filename>, as the <filename>systemd-journald@.service</filename> service | |
98 | file by default carries <varname>LogsDirectory=</varname>. To turn that off, add a unit file drop-in | |
99 | file that sets <varname>LogsDirectory=</varname> to an empty string.</para> | |
cad8fa47 LP |
100 | |
101 | <para>Note that per-user journal files are not supported unless persistent storage is enabled, thus | |
102 | making <command>journalctl --user</command> unavailable.</para> | |
ec07c3c8 AK |
103 | |
104 | <xi:include href="version-info.xml" xpointer="v186"/> | |
f254abcd | 105 | </listitem> |
798d3a52 ZJS |
106 | </varlistentry> |
107 | ||
108 | <varlistentry> | |
109 | <term><varname>Compress=</varname></term> | |
110 | ||
1b7cf0e5 AG |
111 | <listitem><para>Can take a boolean value. If enabled (the |
112 | default), data objects that shall be stored in the journal | |
113 | and are larger than the default threshold of 512 bytes are | |
114 | compressed before they are written to the file system. It | |
115 | can also be set to a number of bytes to specify the | |
116 | compression threshold directly. Suffixes like K, M, and G | |
117 | can be used to specify larger units.</para></listitem> | |
798d3a52 ZJS |
118 | </varlistentry> |
119 | ||
120 | <varlistentry> | |
121 | <term><varname>Seal=</varname></term> | |
122 | ||
123 | <listitem><para>Takes a boolean value. If enabled (the | |
124 | default), and a sealing key is available (as created by | |
125 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s | |
126 | <option>--setup-keys</option> command), Forward Secure Sealing | |
127 | (FSS) for all persistent journal files is enabled. FSS is | |
128 | based on <ulink | |
129 | url="https://eprint.iacr.org/2013/397">Seekable Sequential Key | |
130 | Generators</ulink> by G. A. Marson and B. Poettering | |
131 | (doi:10.1007/978-3-642-40203-6_7) and may be used to protect | |
ec07c3c8 AK |
132 | journal files from unnoticed alteration.</para> |
133 | ||
134 | <xi:include href="version-info.xml" xpointer="v189"/></listitem> | |
798d3a52 ZJS |
135 | </varlistentry> |
136 | ||
137 | <varlistentry> | |
138 | <term><varname>SplitMode=</varname></term> | |
139 | ||
76153ad4 ZJS |
140 | <listitem><para>Controls whether to split up journal files per user, either <literal>uid</literal> or |
141 | <literal>none</literal>. Split journal files are primarily useful for access control: on UNIX/Linux access | |
142 | control is managed per file, and the journal daemon will assign users read access to their journal files. If | |
a1533ad7 AZ |
143 | <literal>uid</literal>, all regular users (with UID outside the range of system users, dynamic service users, |
144 | and the nobody user) will each get their own journal files, and system users will log to the system journal. | |
145 | See <ulink url="https://systemd.io/UIDS-GIDS">Users, Groups, UIDs and GIDs on systemd systems</ulink> | |
146 | for more details about UID ranges. | |
147 | If <literal>none</literal>, journal files are not split up by user and all messages are | |
76153ad4 ZJS |
148 | instead stored in the single system journal. In this mode unprivileged users generally do not have access to |
149 | their own log data. Note that splitting up journal files by user is only available for journals stored | |
150 | persistently. If journals are stored on volatile storage (see <varname>Storage=</varname> above), only a single | |
ec07c3c8 AK |
151 | journal file is used. Defaults to <literal>uid</literal>.</para> |
152 | ||
153 | <xi:include href="version-info.xml" xpointer="v190"/></listitem> | |
798d3a52 ZJS |
154 | </varlistentry> |
155 | ||
156 | <varlistentry> | |
f0367da7 | 157 | <term><varname>RateLimitIntervalSec=</varname></term> |
798d3a52 ZJS |
158 | <term><varname>RateLimitBurst=</varname></term> |
159 | ||
160 | <listitem><para>Configures the rate limiting that is applied | |
161 | to all messages generated on the system. If, in the time | |
f0367da7 | 162 | interval defined by <varname>RateLimitIntervalSec=</varname>, |
798d3a52 ZJS |
163 | more messages than specified in |
164 | <varname>RateLimitBurst=</varname> are logged by a service, | |
165 | all further messages within the interval are dropped until the | |
166 | interval is over. A message about the number of dropped | |
167 | messages is generated. This rate limiting is applied | |
168 | per-service, so that two services which log do not interfere | |
3de8ff5a | 169 | with each other's limits. Defaults to 10000 messages in 30s. |
798d3a52 | 170 | The time specification for |
f0367da7 | 171 | <varname>RateLimitIntervalSec=</varname> may be specified in the |
798d3a52 ZJS |
172 | following units: <literal>s</literal>, <literal>min</literal>, |
173 | <literal>h</literal>, <literal>ms</literal>, | |
174 | <literal>us</literal>. To turn off any kind of rate limiting, | |
90fc172e AZ |
175 | set either value to 0.</para> |
176 | ||
69123c21 | 177 | <para>Note that the effective rate limit is multiplied by a |
c0dd3269 CCW |
178 | factor derived from the available free disk space for the journal. |
179 | Currently, this factor is calculated using the base 2 logarithm.</para> | |
180 | ||
181 | <table> | |
182 | <title>Example <varname>RateLimitBurst=</varname> rate | |
183 | modifications by the available disk space</title> | |
184 | <tgroup cols='2'> | |
185 | <colspec colname='freespace' /> | |
186 | <colspec colname='multiplier' /> | |
187 | <thead> | |
188 | <row> | |
189 | <entry>Available Disk Space</entry> | |
190 | <entry>Burst Multiplier</entry> | |
191 | </row> | |
192 | </thead> | |
193 | <tbody> | |
194 | <row> | |
195 | <entry><= 1MB</entry> | |
196 | <entry>1</entry> | |
197 | </row> | |
198 | <row> | |
199 | <entry><= 16MB</entry> | |
200 | <entry>2</entry> | |
201 | </row> | |
202 | <row> | |
203 | <entry><= 256MB</entry> | |
204 | <entry>3</entry> | |
205 | </row> | |
206 | <row> | |
207 | <entry><= 4GB</entry> | |
208 | <entry>4</entry> | |
209 | </row> | |
210 | <row> | |
211 | <entry><= 64GB</entry> | |
212 | <entry>5</entry> | |
213 | </row> | |
214 | <row> | |
215 | <entry><= 1TB</entry> | |
216 | <entry>6</entry> | |
217 | </row> | |
218 | </tbody> | |
219 | </tgroup> | |
220 | </table> | |
221 | ||
90fc172e AZ |
222 | <para>If a service provides rate limits for itself through |
223 | <varname>LogRateLimitIntervalSec=</varname> and/or <varname>LogRateLimitBurst=</varname> | |
224 | in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
225 | those values will override the settings specified here.</para> | |
226 | </listitem> | |
798d3a52 ZJS |
227 | </varlistentry> |
228 | ||
229 | <varlistentry> | |
230 | <term><varname>SystemMaxUse=</varname></term> | |
231 | <term><varname>SystemKeepFree=</varname></term> | |
232 | <term><varname>SystemMaxFileSize=</varname></term> | |
8580d1f7 | 233 | <term><varname>SystemMaxFiles=</varname></term> |
798d3a52 ZJS |
234 | <term><varname>RuntimeMaxUse=</varname></term> |
235 | <term><varname>RuntimeKeepFree=</varname></term> | |
236 | <term><varname>RuntimeMaxFileSize=</varname></term> | |
8580d1f7 | 237 | <term><varname>RuntimeMaxFiles=</varname></term> |
798d3a52 ZJS |
238 | |
239 | <listitem><para>Enforce size limits on the journal files | |
240 | stored. The options prefixed with <literal>System</literal> | |
241 | apply to the journal files when stored on a persistent file | |
242 | system, more specifically | |
243 | <filename>/var/log/journal</filename>. The options prefixed | |
244 | with <literal>Runtime</literal> apply to the journal files | |
245 | when stored on a volatile in-memory file system, more | |
246 | specifically <filename>/run/log/journal</filename>. The former | |
3b121157 | 247 | is used only when <filename>/var/</filename> is mounted, |
798d3a52 ZJS |
248 | writable, and the directory |
249 | <filename>/var/log/journal</filename> exists. Otherwise, only | |
250 | the latter applies. Note that this means that during early | |
251 | boot and if the administrator disabled persistent logging, | |
252 | only the latter options apply, while the former apply if | |
253 | persistent logging is enabled and the system is fully booted | |
254 | up. <command>journalctl</command> and | |
255 | <command>systemd-journald</command> ignore all files with | |
256 | names not ending with <literal>.journal</literal> or | |
257 | <literal>.journal~</literal>, so only such files, located in | |
258 | the appropriate directories, are taken into account when | |
8580d1f7 | 259 | calculating current disk usage.</para> |
798d3a52 ZJS |
260 | |
261 | <para><varname>SystemMaxUse=</varname> and | |
262 | <varname>RuntimeMaxUse=</varname> control how much disk space | |
a8eaaee7 | 263 | the journal may use up at most. |
798d3a52 ZJS |
264 | <varname>SystemKeepFree=</varname> and |
265 | <varname>RuntimeKeepFree=</varname> control how much disk | |
266 | space systemd-journald shall leave free for other uses. | |
267 | <command>systemd-journald</command> will respect both limits | |
268 | and use the smaller of the two values.</para> | |
269 | ||
270 | <para>The first pair defaults to 10% and the second to 15% of | |
32252660 LP |
271 | the size of the respective file system, but each value is |
272 | capped to 4G. If the file system is nearly full and either | |
273 | <varname>SystemKeepFree=</varname> or | |
8580d1f7 LP |
274 | <varname>RuntimeKeepFree=</varname> are violated when |
275 | systemd-journald is started, the limit will be raised to the | |
798d3a52 ZJS |
276 | percentage that is actually free. This means that if there was |
277 | enough free space before and journal files were created, and | |
278 | subsequently something else causes the file system to fill up, | |
279 | journald will stop using more space, but it will not be | |
a8eaaee7 | 280 | removing existing files to reduce the footprint again, |
1a0d353b MK |
281 | either. Also note that only archived files are deleted to reduce the |
282 | space occupied by journal files. This means that, in effect, there might | |
283 | still be more space used than <varname>SystemMaxUse=</varname> or | |
284 | <varname>RuntimeMaxUse=</varname> limit after a vacuuming operation is | |
285 | complete.</para> | |
798d3a52 | 286 | |
bb6a971c DDM |
287 | <para><varname>SystemMaxFileSize=</varname> and <varname>RuntimeMaxFileSize=</varname> control how |
288 | large individual journal files may grow at most. This influences the granularity in which disk space | |
289 | is made available through rotation, i.e. deletion of historic data. Defaults to one eighth of the | |
d397191b AP |
290 | values configured with <varname>SystemMaxUse=</varname> and <varname>RuntimeMaxUse=</varname> capped |
291 | to 128M, so that usually seven rotated journal files are kept as history. If the journal compact | |
292 | mode is enabled (enabled by default), the maximum file size is capped to 4G.</para> | |
bb6a971c DDM |
293 | |
294 | <para>Specify values in bytes or use K, M, G, T, P, E as units for the specified sizes (equal to | |
295 | 1024, 1024², … bytes). Note that size limits are enforced synchronously when journal files are | |
296 | extended, and no explicit rotation step triggered by time is needed.</para> | |
8580d1f7 LP |
297 | |
298 | <para><varname>SystemMaxFiles=</varname> and | |
299 | <varname>RuntimeMaxFiles=</varname> control how many | |
a8eaaee7 | 300 | individual journal files to keep at most. Note that only |
8580d1f7 LP |
301 | archived files are deleted to reduce the number of files until |
302 | this limit is reached; active files will stay around. This | |
b938cb90 | 303 | means that, in effect, there might still be more journal files |
8580d1f7 LP |
304 | around in total than this limit after a vacuuming operation is |
305 | complete. This setting defaults to 100.</para></listitem> | |
798d3a52 ZJS |
306 | </varlistentry> |
307 | ||
308 | <varlistentry> | |
309 | <term><varname>MaxFileSec=</varname></term> | |
310 | ||
311 | <listitem><para>The maximum time to store entries in a single | |
312 | journal file before rotating to the next one. Normally, | |
313 | time-based rotation should not be required as size-based | |
314 | rotation with options such as | |
315 | <varname>SystemMaxFileSize=</varname> should be sufficient to | |
316 | ensure that journal files do not grow without bounds. However, | |
317 | to ensure that not too much data is lost at once when old | |
318 | journal files are deleted, it might make sense to change this | |
319 | value from the default of one month. Set to 0 to turn off this | |
320 | feature. This setting takes time values which may be suffixed | |
321 | with the units <literal>year</literal>, | |
322 | <literal>month</literal>, <literal>week</literal>, | |
323 | <literal>day</literal>, <literal>h</literal> or | |
324 | <literal>m</literal> to override the default time unit of | |
ec07c3c8 AK |
325 | seconds.</para> |
326 | ||
327 | <xi:include href="version-info.xml" xpointer="v195"/></listitem> | |
798d3a52 ZJS |
328 | </varlistentry> |
329 | ||
330 | <varlistentry> | |
331 | <term><varname>MaxRetentionSec=</varname></term> | |
332 | ||
333 | <listitem><para>The maximum time to store journal entries. | |
334 | This controls whether journal files containing entries older | |
ad7c65e6 | 335 | than the specified time span are deleted. Normally, time-based |
798d3a52 ZJS |
336 | deletion of old journal files should not be required as |
337 | size-based deletion with options such as | |
338 | <varname>SystemMaxUse=</varname> should be sufficient to | |
339 | ensure that journal files do not grow without bounds. However, | |
340 | to enforce data retention policies, it might make sense to | |
341 | change this value from the default of 0 (which turns off this | |
342 | feature). This setting also takes time values which may be | |
343 | suffixed with the units <literal>year</literal>, | |
344 | <literal>month</literal>, <literal>week</literal>, | |
345 | <literal>day</literal>, <literal>h</literal> or <literal> | |
346 | m</literal> to override the default time unit of | |
ec07c3c8 AK |
347 | seconds.</para> |
348 | ||
349 | <xi:include href="version-info.xml" xpointer="v195"/></listitem> | |
798d3a52 ZJS |
350 | </varlistentry> |
351 | ||
798d3a52 ZJS |
352 | <varlistentry> |
353 | <term><varname>SyncIntervalSec=</varname></term> | |
354 | ||
355 | <listitem><para>The timeout before synchronizing journal files | |
356 | to disk. After syncing, journal files are placed in the | |
357 | OFFLINE state. Note that syncing is unconditionally done | |
358 | immediately after a log message of priority CRIT, ALERT or | |
359 | EMERG has been logged. This setting hence applies only to | |
360 | messages of the levels ERR, WARNING, NOTICE, INFO, DEBUG. The | |
ec07c3c8 AK |
361 | default timeout is 5 minutes. </para> |
362 | ||
363 | <xi:include href="version-info.xml" xpointer="v199"/></listitem> | |
798d3a52 ZJS |
364 | </varlistentry> |
365 | ||
366 | <varlistentry> | |
367 | <term><varname>ForwardToSyslog=</varname></term> | |
368 | <term><varname>ForwardToKMsg=</varname></term> | |
369 | <term><varname>ForwardToConsole=</varname></term> | |
370 | <term><varname>ForwardToWall=</varname></term> | |
371 | ||
77ce88c1 LP |
372 | <listitem><para>Control whether log messages received by the journal daemon shall be forwarded to a |
373 | traditional syslog daemon, to the kernel log buffer (kmsg), to the system console, or sent as wall | |
374 | messages to all logged-in users. These options take boolean arguments. If forwarding to syslog is | |
375 | enabled but nothing reads messages from the socket, forwarding to syslog has no effect. By default, | |
376 | only forwarding to wall is enabled. These settings may be overridden at boot time with the kernel | |
377 | command line options <literal>systemd.journald.forward_to_syslog</literal>, | |
5707ecf3 ZJS |
378 | <literal>systemd.journald.forward_to_kmsg</literal>, |
379 | <literal>systemd.journald.forward_to_console</literal>, and | |
77ce88c1 LP |
380 | <literal>systemd.journald.forward_to_wall</literal>. If the option name is specified without |
381 | <literal>=</literal> and the following argument, true is assumed. Otherwise, the argument is parsed | |
382 | as a boolean.</para> | |
383 | ||
384 | <para>When forwarding to the console, the TTY to log to can be changed with | |
385 | <varname>TTYPath=</varname>, described below.</para> | |
386 | ||
387 | <para>When forwarding to the kernel log buffer (kmsg), make sure to select a suitably large size for | |
33eb1f24 ZJS |
388 | the log buffer, for example by adding <literal>log_buf_len=8M</literal> to the kernel command line. |
389 | <command>systemd</command> will automatically disable kernel's rate-limiting applied to userspace | |
390 | processes (equivalent to setting <literal>printk.devkmsg=on</literal>).</para></listitem> | |
165fb931 VC |
391 | |
392 | <para>Note: Forwarding is performed synchronously within journald, and may significantly affect its | |
393 | performance. This is particularly relevant when using ForwardToConsole=yes in cloud environments, | |
394 | where the console is often a slow, virtual serial port. Since journald is implemented as a | |
395 | conventional single-process daemon, forwarding to a completely hung console will block journald. | |
396 | This can have a cascading effect resulting in any services synchronously logging to the blocked | |
397 | journal also becoming blocked. Unless actively debugging/developing something, it's generally | |
398 | preferable to setup a <command>journalctl --follow</command> style service redirected to the | |
399 | console, instead of ForwardToConsole=yes, for production use.</para> | |
798d3a52 ZJS |
400 | </varlistentry> |
401 | ||
402 | <varlistentry> | |
403 | <term><varname>MaxLevelStore=</varname></term> | |
404 | <term><varname>MaxLevelSyslog=</varname></term> | |
405 | <term><varname>MaxLevelKMsg=</varname></term> | |
406 | <term><varname>MaxLevelConsole=</varname></term> | |
407 | <term><varname>MaxLevelWall=</varname></term> | |
408 | ||
409 | <listitem><para>Controls the maximum log level of messages | |
c97ae2b2 | 410 | that are stored in the journal, forwarded to syslog, kmsg, the |
798d3a52 ZJS |
411 | console or wall (if that is enabled, see above). As argument, |
412 | takes one of | |
413 | <literal>emerg</literal>, | |
414 | <literal>alert</literal>, | |
415 | <literal>crit</literal>, | |
416 | <literal>err</literal>, | |
417 | <literal>warning</literal>, | |
418 | <literal>notice</literal>, | |
419 | <literal>info</literal>, | |
420 | <literal>debug</literal>, | |
b938cb90 | 421 | or integer values in the range of 0–7 (corresponding to the |
798d3a52 ZJS |
422 | same levels). Messages equal or below the log level specified |
423 | are stored/forwarded, messages above are dropped. Defaults to | |
424 | <literal>debug</literal> for <varname>MaxLevelStore=</varname> | |
425 | and <varname>MaxLevelSyslog=</varname>, to ensure that the all | |
c97ae2b2 LB |
426 | messages are stored in the journal and forwarded to syslog. |
427 | Defaults to | |
798d3a52 ZJS |
428 | <literal>notice</literal> for <varname>MaxLevelKMsg=</varname>, |
429 | <literal>info</literal> for <varname>MaxLevelConsole=</varname>, | |
430 | and <literal>emerg</literal> for | |
863a5610 UTL |
431 | <varname>MaxLevelWall=</varname>. These settings may be |
432 | overridden at boot time with the kernel command line options | |
433 | <literal>systemd.journald.max_level_store=</literal>, | |
434 | <literal>systemd.journald.max_level_syslog=</literal>, | |
435 | <literal>systemd.journald.max_level_kmsg=</literal>, | |
436 | <literal>systemd.journald.max_level_console=</literal>, | |
437 | <literal>systemd.journald.max_level_wall=</literal>.</para> | |
aefdc112 AK |
438 | |
439 | <xi:include href="version-info.xml" xpointer="v185"/> | |
863a5610 | 440 | </listitem> |
798d3a52 ZJS |
441 | </varlistentry> |
442 | ||
b2392ff3 SS |
443 | <varlistentry> |
444 | <term><varname>ReadKMsg=</varname></term> | |
445 | ||
6bc43619 LP |
446 | <listitem><para>Takes a boolean value. If enabled <command>systemd-journal</command> processes |
447 | <filename>/dev/kmsg</filename> messages generated by the kernel. In the default journal namespace | |
ec07c3c8 AK |
448 | this option is enabled by default, it is disabled in all others.</para> |
449 | ||
450 | <xi:include href="version-info.xml" xpointer="v235"/></listitem> | |
b2392ff3 SS |
451 | </varlistentry> |
452 | ||
511e03a3 LP |
453 | <varlistentry> |
454 | <term><varname>Audit=</varname></term> | |
455 | ||
2aba7705 | 456 | <listitem><para>Takes a boolean value. If enabled <command>systemd-journald</command> will turn on |
511e03a3 | 457 | kernel auditing on start-up. If disabled it will turn it off. If unset it will neither enable nor |
2aba7705 FB |
458 | disable it, leaving the previous state unchanged. This means if another tool turns on auditing even |
459 | if <command>systemd-journald</command> left it off, it will still collect the generated | |
460 | messages. Defaults to on.</para> | |
461 | ||
462 | <para>Note that this option does not control whether <command>systemd-journald</command> collects | |
463 | generated audit records, it just controls whether it tells the kernel to generate them. If you need | |
464 | to prevent <command>systemd-journald</command> from collecting the generated messages, the socket | |
465 | unit <literal>systemd-journald-audit.socket</literal> can be disabled and in this case this setting | |
466 | is without effect.</para> | |
ec07c3c8 AK |
467 | |
468 | <xi:include href="version-info.xml" xpointer="v246"/> | |
2aba7705 | 469 | </listitem> |
511e03a3 LP |
470 | </varlistentry> |
471 | ||
798d3a52 ZJS |
472 | <varlistentry> |
473 | <term><varname>TTYPath=</varname></term> | |
474 | ||
475 | <listitem><para>Change the console TTY to use if | |
476 | <varname>ForwardToConsole=yes</varname> is used. Defaults to | |
ec07c3c8 AK |
477 | <filename>/dev/console</filename>.</para> |
478 | ||
479 | <xi:include href="version-info.xml" xpointer="v185"/></listitem> | |
798d3a52 ZJS |
480 | </varlistentry> |
481 | ||
ec20fe5f LP |
482 | <varlistentry> |
483 | <term><varname>LineMax=</varname></term> | |
484 | ||
485 | <listitem><para>The maximum line length to permit when converting stream logs into record logs. When a systemd | |
486 | unit's standard output/error are connected to the journal via a stream socket, the data read is split into | |
6b44ad0b | 487 | individual log records at newline (<literal>\n</literal>, ASCII 10) and <constant>NUL</constant> characters. If no such delimiter is |
dcfaecc7 | 488 | read for the specified number of bytes a hard log record boundary is artificially inserted, breaking up overly |
ec20fe5f LP |
489 | long lines into multiple log records. Selecting overly large values increases the possible memory usage of the |
490 | Journal daemon for each stream client, as in the worst case the journal daemon needs to buffer the specified | |
491 | number of bytes in memory before it can flush a new log record to disk. Also note that permitting overly large | |
492 | line maximum line lengths affects compatibility with traditional log protocols as log records might not fit | |
493 | anymore into a single <constant>AF_UNIX</constant> or <constant>AF_INET</constant> datagram. Takes a size in | |
494 | bytes. If the value is suffixed with K, M, G or T, the specified size is parsed as Kilobytes, Megabytes, | |
495 | Gigabytes, or Terabytes (with the base 1024), respectively. Defaults to 48K, which is relatively large but | |
496 | still small enough so that log records likely fit into network datagrams along with extra room for | |
ec07c3c8 AK |
497 | metadata. Note that values below 79 are not accepted and will be bumped to 79.</para> |
498 | ||
499 | <xi:include href="version-info.xml" xpointer="v235"/></listitem> | |
ec20fe5f LP |
500 | </varlistentry> |
501 | ||
798d3a52 ZJS |
502 | </variablelist> |
503 | ||
504 | </refsect1> | |
505 | ||
589532d0 ZJS |
506 | <refsect1> |
507 | <title>Forwarding to traditional syslog daemons</title> | |
508 | ||
509 | <para> | |
7703bd4d | 510 | Journal events can be transferred to a different logging daemon |
a8eaaee7 | 511 | in two different ways. With the first method, messages are |
589532d0 ZJS |
512 | immediately forwarded to a socket |
513 | (<filename>/run/systemd/journal/syslog</filename>), where the | |
514 | traditional syslog daemon can read them. This method is | |
a8eaaee7 | 515 | controlled by the <varname>ForwardToSyslog=</varname> option. With a |
589532d0 ZJS |
516 | second method, a syslog daemon behaves like a normal journal |
517 | client, and reads messages from the journal files, similarly to | |
518 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>. | |
a8eaaee7 | 519 | With this, messages do not have to be read immediately, |
589532d0 ZJS |
520 | which allows a logging daemon which is only started late in boot |
521 | to access all messages since the start of the system. In | |
522 | addition, full structured meta-data is available to it. This | |
523 | method of course is available only if the messages are stored in | |
7703bd4d | 524 | a journal file at all. So it will not work if |
589532d0 | 525 | <varname>Storage=none</varname> is set. It should be noted that |
7703bd4d | 526 | usually the <emphasis>second</emphasis> method is used by syslog |
589532d0 ZJS |
527 | daemons, so the <varname>Storage=</varname> option, and not the |
528 | <varname>ForwardToSyslog=</varname> option, is relevant for them. | |
529 | </para> | |
530 | </refsect1> | |
531 | ||
798d3a52 ZJS |
532 | <refsect1> |
533 | <title>See Also</title> | |
534 | <para> | |
535 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
536 | <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
537 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
538 | <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>, | |
539 | <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
540 | </para> | |
541 | </refsect1> | |
b47ffcfd LP |
542 | |
543 | </refentry> |