]>
Commit | Line | Data |
---|---|---|
01cf0ca8 | 1 | <?xml version='1.0'?> <!--*-nxml-*--> |
3a54a157 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
eea10b26 | 3 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"> |
db9ecf05 | 4 | <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
01cf0ca8 | 5 | |
4623eecb AK |
6 | <refentry id="systemd-journald.service" |
7 | xmlns:xi="http://www.w3.org/2001/XInclude"> | |
01cf0ca8 | 8 | |
798d3a52 ZJS |
9 | <refentryinfo> |
10 | <title>systemd-journald.service</title> | |
11 | <productname>systemd</productname> | |
798d3a52 ZJS |
12 | </refentryinfo> |
13 | ||
14 | <refmeta> | |
15 | <refentrytitle>systemd-journald.service</refentrytitle> | |
16 | <manvolnum>8</manvolnum> | |
17 | </refmeta> | |
18 | ||
19 | <refnamediv> | |
20 | <refname>systemd-journald.service</refname> | |
21 | <refname>systemd-journald.socket</refname> | |
22 | <refname>systemd-journald-dev-log.socket</refname> | |
37b7affe | 23 | <refname>systemd-journald-audit.socket</refname> |
efcbcd0d LP |
24 | <refname>systemd-journald@.service</refname> |
25 | <refname>systemd-journald@.socket</refname> | |
26 | <refname>systemd-journald-varlink@.socket</refname> | |
798d3a52 ZJS |
27 | <refname>systemd-journald</refname> |
28 | <refpurpose>Journal service</refpurpose> | |
29 | </refnamediv> | |
30 | ||
31 | <refsynopsisdiv> | |
73e97bb0 ZJS |
32 | <para><simplelist> |
33 | <member><filename>systemd-journald.service</filename></member> | |
34 | <member><filename>systemd-journald.socket</filename></member> | |
35 | <member><filename>systemd-journald-dev-log.socket</filename></member> | |
36 | <member><filename>systemd-journald-audit.socket</filename></member> | |
37 | <member><filename>systemd-journald@.service</filename></member> | |
38 | <member><filename>systemd-journald@.socket</filename></member> | |
39 | <member><filename>systemd-journald-varlink@.socket</filename></member> | |
40 | <member><filename>/usr/lib/systemd/systemd-journald</filename></member> | |
41 | </simplelist></para> | |
798d3a52 ZJS |
42 | </refsynopsisdiv> |
43 | ||
44 | <refsect1> | |
45 | <title>Description</title> | |
46 | ||
47 | <para><filename>systemd-journald</filename> is a system service | |
48 | that collects and stores logging data. It creates and maintains | |
49 | structured, indexed journals based on logging information that is | |
50 | received from a variety of sources:</para> | |
51 | ||
52 | <itemizedlist> | |
53 | <listitem><para>Kernel log messages, via kmsg</para></listitem> | |
54 | ||
157148d6 LP |
55 | <listitem><para>Simple system log messages, via the <filename>libc</filename> <citerefentry |
56 | project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry> | |
798d3a52 ZJS |
57 | call</para></listitem> |
58 | ||
8ee62e53 LP |
59 | <listitem><para>Structured system log messages via the native Journal API, see |
60 | <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry> | |
61 | and <ulink url="https://systemd.io/JOURNAL_NATIVE_PROTOCOL">Native Journal | |
62 | Protocol</ulink></para></listitem> | |
798d3a52 | 63 | |
157148d6 LP |
64 | <listitem><para>Standard output and standard error of service units. For further details see |
65 | below.</para></listitem> | |
798d3a52 | 66 | |
157148d6 | 67 | <listitem><para>Audit records, originating from the kernel audit subsystem</para></listitem> |
798d3a52 ZJS |
68 | </itemizedlist> |
69 | ||
70 | <para>The daemon will implicitly collect numerous metadata fields | |
71 | for each log messages in a secure and unfakeable way. See | |
72 | <citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry> | |
73 | for more information about the collected metadata. | |
74 | </para> | |
75 | ||
fc5f5706 | 76 | <para>Log data collected by the journal is primarily text-based but can also include binary data where |
a2968e83 | 77 | necessary. Individual fields making up a log record stored in the journal may be up to 2⁶⁴-1 bytes in size.</para> |
fc5f5706 LP |
78 | |
79 | <para>The journal service stores log data either persistently below <filename>/var/log/journal</filename> or in a | |
80 | volatile way below <filename>/run/log/journal/</filename> (in the latter case it is lost at reboot). By default, log | |
81 | data is stored persistently if <filename>/var/log/journal/</filename> exists during boot, with an implicit fallback | |
82 | to volatile storage otherwise. Use <varname>Storage=</varname> in | |
83 | <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> to configure | |
84 | where log data is placed, independently of the existence of <filename>/var/log/journal/</filename>.</para> | |
85 | ||
9854ac4a LP |
86 | <para>Note that journald will initially use volatile storage, until a call to |
87 | <command>journalctl --flush</command> (or sending <constant>SIGUSR1</constant> to journald) will cause | |
19d25fde LA |
88 | it to switch to persistent logging (under the conditions mentioned above). This is done automatically |
89 | on boot via <literal>systemd-journal-flush.service</literal>.</para> | |
90 | ||
fc5f5706 LP |
91 | <para>On systems where <filename>/var/log/journal/</filename> does not exist yet but where persistent logging is |
92 | desired (and the default <filename>journald.conf</filename> is used), it is sufficient to create the directory, and | |
93 | ensure it has the correct access modes and ownership:</para> | |
c214ee6f EV |
94 | |
95 | <programlisting>mkdir -p /var/log/journal | |
96 | systemd-tmpfiles --create --prefix /var/log/journal</programlisting> | |
798d3a52 | 97 | |
798d3a52 ZJS |
98 | <para>See |
99 | <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
100 | for information about the configuration of this service.</para> | |
101 | </refsect1> | |
102 | ||
157148d6 LP |
103 | <refsect1> |
104 | <title>Stream logging</title> | |
105 | ||
106 | <para>The systemd service manager invokes all service processes with standard output and standard error connected | |
107 | to the journal by default. This behaviour may be altered via the | |
108 | <varname>StandardOutput=</varname>/<varname>StandardError=</varname> unit file settings, see | |
109 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details. The | |
110 | journal converts the log byte stream received this way into individual log records, splitting the stream at newline | |
111 | (<literal>\n</literal>, ASCII <constant>10</constant>) and <constant>NUL</constant> bytes.</para> | |
112 | ||
113 | <para>If <filename>systemd-journald.service</filename> is stopped, the stream connections associated with all | |
114 | services are terminated. Further writes to those streams by the service will result in <constant>EPIPE</constant> | |
115 | errors. In order to react gracefully in this case it is recommended that programs logging to standard output/error | |
dcfaecc7 | 116 | ignore such errors. If the <constant>SIGPIPE</constant> UNIX signal handler is not blocked or turned off, such |
157148d6 | 117 | write attempts will also result in such process signals being generated, see |
b7a47345 ZJS |
118 | <citerefentry project='man-pages'><refentrytitle>signal</refentrytitle><manvolnum>7</manvolnum></citerefentry>. |
119 | To mitigate this issue, systemd service manager explicitly turns off the <constant>SIGPIPE</constant> | |
120 | signal for all invoked processes by default (this may be changed for each unit individually via the | |
121 | <varname>IgnoreSIGPIPE=</varname> option, see | |
157148d6 | 122 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for |
b7a47345 ZJS |
123 | details). After the standard output/standard error streams have been terminated they may not be recovered |
124 | until the services they are associated with are restarted. Note that during normal operation, | |
125 | <filename>systemd-journald.service</filename> stores copies of the file descriptors for those streams in | |
126 | the service manager. If <filename>systemd-journald.service</filename> is restarted using | |
127 | <command>systemctl restart</command> or equivalent operation instead of a pair of separate | |
128 | <command>systemctl stop</command> and <command>systemctl start</command> commands (or equivalent | |
129 | operations), these stream connections are not terminated and survive the restart. It is thus safe to | |
130 | restart <filename>systemd-journald.service</filename>, but stopping it is not recommended.</para> | |
157148d6 LP |
131 | |
132 | <para>Note that the log record metadata for records transferred via such standard output/error streams reflect the | |
133 | metadata of the peer the stream was originally created for. If the stream connection is passed on to other | |
134 | processes (such as further child processes forked off the main service process), the log records will not reflect | |
135 | their metadata, but will continue to describe the original process. This is different from the other logging | |
136 | transports listed above, which are inherently record based and where the metadata is always associated with the | |
137 | individual record.</para> | |
138 | ||
dcfaecc7 | 139 | <para>In addition to the implicit standard output/error logging of services, stream logging is also available |
157148d6 LP |
140 | via the <citerefentry><refentrytitle>systemd-cat</refentrytitle><manvolnum>1</manvolnum></citerefentry> command |
141 | line tool.</para> | |
142 | ||
ec20fe5f | 143 | <para>Currently, the number of parallel log streams <filename>systemd-journald</filename> will accept is limited to |
dcfaecc7 | 144 | 4096. When this limit is reached further log streams may be established but will receive |
ec20fe5f | 145 | <constant>EPIPE</constant> right from the beginning.</para> |
157148d6 LP |
146 | </refsect1> |
147 | ||
efcbcd0d LP |
148 | <refsect1> |
149 | <title>Journal Namespaces</title> | |
150 | ||
151 | <para>Journal 'namespaces' are both a mechanism for logically isolating the log stream of projects | |
152 | consisting of one or more services from the rest of the system and a mechanism for improving | |
153 | performance. Multiple journal namespaces may exist simultaneously, each defining its own, independent log | |
154 | stream managed by its own instance of <command>systemd-journald</command>. Namespaces are independent of | |
155 | each other, both in the data store and in the IPC interface. By default only a single 'default' namespace | |
156 | exists, managed by <filename>systemd-journald.service</filename> (and its associated socket | |
157 | units). Additional namespaces are created by starting an instance of the | |
158 | <filename>systemd-journald@.service</filename> service template. The instance name is the namespace | |
159 | identifier, which is a short string used for referencing the journal namespace. Service units may be | |
160 | assigned to a specific journal namespace through the <varname>LogNamespace=</varname> unit file setting, | |
161 | see <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for | |
162 | details. The <option>--namespace=</option> switch of | |
163 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> may be | |
164 | used to view the log stream of a specific namespace. If the switch is not used the log stream of the | |
165 | default namespace is shown, i.e. log data from other namespaces is not visible.</para> | |
166 | ||
167 | <para>Services associated with a specific log namespace may log via syslog, the native logging protocol | |
168 | of the journal and via stdout/stderr; the logging from all three transports is associated with the | |
169 | namespace.</para> | |
170 | ||
171 | <para>By default only the default namespace will collect kernel and audit log messages.</para> | |
172 | ||
173 | <para>The <command>systemd-journald</command> instance of the default namespace is configured through | |
174 | <filename>/etc/systemd/journald.conf</filename> (see below), while the other instances are configured | |
175 | through <filename>/etc/systemd/journald@<replaceable>NAMESPACE</replaceable>.conf</filename>. The journal | |
176 | log data for the default namespace is placed in | |
177 | <filename>/var/log/journal/<replaceable>MACHINE_ID</replaceable></filename> (see below) while the data | |
178 | for the other namespaces is located in | |
179 | <filename>/var/log/journal/<replaceable>MACHINE_ID</replaceable>.<replaceable>NAMESPACE</replaceable></filename>.</para> | |
180 | </refsect1> | |
181 | ||
798d3a52 ZJS |
182 | <refsect1> |
183 | <title>Signals</title> | |
184 | ||
185 | <variablelist> | |
186 | <varlistentry> | |
187 | <term>SIGUSR1</term> | |
188 | ||
870a2d85 LP |
189 | <listitem><para>Request that journal data from <filename>/run/</filename> is flushed to |
190 | <filename>/var/</filename> in order to make it persistent (if this is enabled). This must be used | |
3b121157 ZJS |
191 | after <filename>/var/</filename> is mounted, as otherwise log data from <filename>/run/</filename> is |
192 | never flushed to <filename>/var/</filename> regardless of the configuration. Use the | |
870a2d85 | 193 | <command>journalctl --flush</command> command to request flushing of the journal files, and wait for |
94b65516 | 194 | the operation to complete. See |
870a2d85 | 195 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> for |
ec07c3c8 AK |
196 | details.</para> |
197 | ||
198 | <xi:include href="version-info.xml" xpointer="v186"/></listitem> | |
798d3a52 ZJS |
199 | </varlistentry> |
200 | ||
201 | <varlistentry> | |
202 | <term>SIGUSR2</term> | |
203 | ||
870a2d85 LP |
204 | <listitem><para>Request immediate rotation of the journal files. Use the <command>journalctl |
205 | --rotate</command> command to request journal file rotation, and wait for the operation to | |
ec07c3c8 AK |
206 | complete.</para> |
207 | ||
208 | <xi:include href="version-info.xml" xpointer="v186"/></listitem> | |
94b65516 LP |
209 | </varlistentry> |
210 | ||
211 | <varlistentry> | |
212 | <term>SIGRTMIN+1</term> | |
213 | ||
870a2d85 LP |
214 | <listitem><para>Request that all unwritten log data is written to disk. Use the <command>journalctl |
215 | --sync</command> command to trigger journal synchronization, and wait for the operation to | |
ec07c3c8 AK |
216 | complete.</para> |
217 | ||
218 | <xi:include href="version-info.xml" xpointer="v228"/></listitem> | |
798d3a52 ZJS |
219 | </varlistentry> |
220 | </variablelist> | |
221 | </refsect1> | |
222 | ||
223 | <refsect1> | |
224 | <title>Kernel Command Line</title> | |
225 | ||
226 | <para>A few configuration parameters from | |
227 | <filename>journald.conf</filename> may be overridden on the kernel | |
228 | command line:</para> | |
229 | ||
230 | <variablelist class='kernel-commandline-options'> | |
231 | <varlistentry> | |
232 | <term><varname>systemd.journald.forward_to_syslog=</varname></term> | |
233 | <term><varname>systemd.journald.forward_to_kmsg=</varname></term> | |
234 | <term><varname>systemd.journald.forward_to_console=</varname></term> | |
235 | <term><varname>systemd.journald.forward_to_wall=</varname></term> | |
236 | ||
237 | <listitem><para>Enables/disables forwarding of collected log | |
238 | messages to syslog, the kernel log buffer, the system console | |
239 | or wall. | |
240 | </para> | |
241 | ||
242 | <para>See | |
243 | <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
244 | for information about these settings.</para> | |
aefdc112 AK |
245 | |
246 | <xi:include href="version-info.xml" xpointer="v186"/> | |
798d3a52 ZJS |
247 | </listitem> |
248 | ||
249 | </varlistentry> | |
250 | </variablelist> | |
efcbcd0d LP |
251 | |
252 | <para>Note that these kernel command line options are only honoured by the default namespace, see | |
253 | above.</para> | |
798d3a52 ZJS |
254 | </refsect1> |
255 | ||
256 | <refsect1> | |
257 | <title>Access Control</title> | |
258 | ||
259 | <para>Journal files are, by default, owned and readable by the | |
260 | <literal>systemd-journal</literal> system group but are not | |
f16eb8b0 | 261 | writable. Adding a user to this group thus enables them to read |
798d3a52 ZJS |
262 | the journal files.</para> |
263 | ||
a1533ad7 AZ |
264 | <para>By default, each user, with a UID outside the range of system users, |
265 | dynamic service users, and the nobody user, will get their own set of | |
266 | journal files in <filename>/var/log/journal/</filename>. See | |
267 | <ulink url="https://systemd.io/UIDS-GIDS">Users, Groups, UIDs and GIDs on systemd systems</ulink> | |
268 | for more details about UID ranges. These journal | |
798d3a52 ZJS |
269 | files will not be owned by the user, however, in order to avoid |
270 | that the user can write to them directly. Instead, file system | |
271 | ACLs are used to ensure the user gets read access only.</para> | |
272 | ||
273 | <para>Additional users and groups may be granted access to journal | |
274 | files via file system access control lists (ACL). Distributions | |
275 | and administrators may choose to grant read access to all members | |
276 | of the <literal>wheel</literal> and <literal>adm</literal> system | |
277 | groups with a command such as the following:</para> | |
278 | ||
279 | <programlisting># setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/</programlisting> | |
280 | ||
281 | <para>Note that this command will update the ACLs both for | |
282 | existing journal files and for future journal files created in the | |
283 | <filename>/var/log/journal/</filename> directory.</para> | |
284 | </refsect1> | |
285 | ||
286 | <refsect1> | |
287 | <title>Files</title> | |
288 | ||
289 | <variablelist> | |
290 | <varlistentry> | |
12b42c76 | 291 | <term><filename>/etc/systemd/journald.conf</filename></term> |
798d3a52 | 292 | |
4bb890bc | 293 | <listitem><para>Configure <command>systemd-journald</command> behavior. See |
798d3a52 | 294 | <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. |
ec07c3c8 AK |
295 | </para> |
296 | ||
297 | <xi:include href="version-info.xml" xpointer="v206"/></listitem> | |
798d3a52 ZJS |
298 | </varlistentry> |
299 | ||
300 | <varlistentry> | |
301 | <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term> | |
302 | <term><filename>/run/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term> | |
303 | <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal</filename></term> | |
304 | <term><filename>/var/log/journal/<replaceable>machine-id</replaceable>/*.journal~</filename></term> | |
305 | ||
4bb890bc | 306 | <listitem><para><command>systemd-journald</command> writes entries to files in |
798d3a52 ZJS |
307 | <filename>/run/log/journal/<replaceable>machine-id</replaceable>/</filename> |
308 | or | |
309 | <filename>/var/log/journal/<replaceable>machine-id</replaceable>/</filename> | |
310 | with the <literal>.journal</literal> suffix. If the daemon is | |
311 | stopped uncleanly, or if the files are found to be corrupted, | |
312 | they are renamed using the <literal>.journal~</literal> | |
313 | suffix, and <command>systemd-journald</command> starts writing | |
3b121157 | 314 | to a new file. <filename>/run/</filename> is used when |
798d3a52 ZJS |
315 | <filename>/var/log/journal</filename> is not available, or |
316 | when <option>Storage=volatile</option> is set in the | |
317 | <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
4bb890bc ZJS |
318 | configuration file.</para> |
319 | ||
320 | <para>When <filename>systemd-journald</filename> ceases writing to a journal file, | |
321 | it will be renamed to <literal><replaceable>original-name</replaceable>@<replaceable>suffix.journal</replaceable></literal> | |
322 | (or <literal><replaceable>original-name</replaceable>@<replaceable>suffix.journal~</replaceable></literal>). | |
323 | Such files are "archived" and will not be written to any more.</para> | |
324 | ||
325 | <para>In general, it is safe to read or copy any journal file (active or archived). | |
326 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
327 | and the functions in the | |
328 | <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry> | |
329 | library should be able to read all entries that have been fully written.</para> | |
752ce396 ZJS |
330 | |
331 | <para><filename>systemd-journald</filename> will automatically remove the oldest | |
332 | archived journal files to limit disk use. See <varname>SystemMaxUse=</varname> | |
333 | and related settings in | |
334 | <citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. | |
ec07c3c8 AK |
335 | </para> |
336 | ||
337 | <xi:include href="version-info.xml" xpointer="v206"/></listitem> | |
37b7affe ZJS |
338 | </varlistentry> |
339 | ||
340 | <varlistentry> | |
341 | <term><filename>/dev/kmsg</filename></term> | |
342 | <term><filename>/dev/log</filename></term> | |
343 | <term><filename>/run/systemd/journal/dev-log</filename></term> | |
344 | <term><filename>/run/systemd/journal/socket</filename></term> | |
345 | <term><filename>/run/systemd/journal/stdout</filename></term> | |
346 | ||
efcbcd0d LP |
347 | <listitem><para>Sockets and other file node paths that <command>systemd-journald</command> will |
348 | listen on and are visible in the file system. In addition to these, | |
349 | <command>systemd-journald</command> can listen for audit events using <citerefentry | |
2aba7705 FB |
350 | project='man-pages'><refentrytitle>netlink</refentrytitle><manvolnum>7</manvolnum></citerefentry>, |
351 | depending on whether <literal>systemd-journald-audit.socket</literal> is enabled or | |
ec07c3c8 AK |
352 | not.</para> |
353 | ||
354 | <xi:include href="version-info.xml" xpointer="v228"/></listitem> | |
798d3a52 ZJS |
355 | </varlistentry> |
356 | </variablelist> | |
efcbcd0d LP |
357 | |
358 | <para>If journal namespacing is used these paths are slightly altered to include a namespace identifier, see above.</para> | |
798d3a52 ZJS |
359 | </refsect1> |
360 | ||
361 | <refsect1> | |
362 | <title>See Also</title> | |
13a69c12 DT |
363 | <para><simplelist type="inline"> |
364 | <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
365 | <member><citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
366 | <member><citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member> | |
367 | <member><citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry></member> | |
368 | <member><citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry></member> | |
369 | <member><citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry></member> | |
370 | <member><citerefentry project='man-pages'><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
371 | <member><citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry></member> | |
372 | <member><command>pydoc systemd.journal</command></member> | |
373 | </simplelist></para> | |
798d3a52 | 374 | </refsect1> |
01cf0ca8 LP |
375 | |
376 | </refentry> |