1 <?xml version='
1.0'
?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC
"-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 SPDX-License-Identifier: LGPL-2.1+
9 <refentry id=
"journald.conf"
10 xmlns:
xi=
"http://www.w3.org/2001/XInclude">
12 <title>journald.conf
</title>
13 <productname>systemd
</productname>
17 <refentrytitle>journald.conf
</refentrytitle>
18 <manvolnum>5</manvolnum>
22 <refname>journald.conf
</refname>
23 <refname>journald.conf.d
</refname>
24 <refpurpose>Journal service configuration files
</refpurpose>
28 <para><filename>/etc/systemd/journald.conf
</filename></para>
29 <para><filename>/etc/systemd/journald.conf.d/*.conf
</filename></para>
30 <para><filename>/run/systemd/journald.conf.d/*.conf
</filename></para>
31 <para><filename>/usr/lib/systemd/journald.conf.d/*.conf
</filename></para>
35 <title>Description
</title>
37 <para>These files configure various parameters of the systemd journal service,
38 <citerefentry><refentrytitle>systemd-journald.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
40 <citerefentry><refentrytitle>systemd.syntax
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
41 for a general description of the syntax.
</para>
45 <xi:include href=
"standard-conf.xml" xpointer=
"main-conf" />
48 <title>Options
</title>
50 <para>All options are configured in the
51 <literal>[Journal]
</literal> section:
</para>
56 <term><varname>Storage=
</varname></term>
58 <listitem><para>Controls where to store journal data. One of
59 <literal>volatile
</literal>,
60 <literal>persistent
</literal>,
61 <literal>auto
</literal> and
62 <literal>none
</literal>. If
63 <literal>volatile
</literal>, journal
64 log data will be stored only in memory, i.e. below the
65 <filename>/run/log/journal
</filename> hierarchy (which is
66 created if needed). If
<literal>persistent
</literal>, data
67 will be stored preferably on disk, i.e. below the
68 <filename>/var/log/journal
</filename> hierarchy (which is
69 created if needed), with a fallback to
70 <filename>/run/log/journal
</filename> (which is created if
71 needed), during early boot and if the disk is not writable.
72 <literal>auto
</literal> is similar to
73 <literal>persistent
</literal> but the directory
74 <filename>/var/log/journal
</filename> is not created if
75 needed, so that its existence controls where log data goes.
76 <literal>none
</literal> turns off all storage, all log data
77 received will be dropped. Forwarding to other targets, such as
78 the console, the kernel log buffer, or a syslog socket will
79 still work however. Defaults to
80 <literal>auto
</literal>.
</para></listitem>
84 <term><varname>Compress=
</varname></term>
86 <listitem><para>Can take a boolean value. If enabled (the
87 default), data objects that shall be stored in the journal
88 and are larger than the default threshold of
512 bytes are
89 compressed before they are written to the file system. It
90 can also be set to a number of bytes to specify the
91 compression threshold directly. Suffixes like K, M, and G
92 can be used to specify larger units.
</para></listitem>
96 <term><varname>Seal=
</varname></term>
98 <listitem><para>Takes a boolean value. If enabled (the
99 default), and a sealing key is available (as created by
100 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
101 <option>--setup-keys
</option> command), Forward Secure Sealing
102 (FSS) for all persistent journal files is enabled. FSS is
104 url=
"https://eprint.iacr.org/2013/397">Seekable Sequential Key
105 Generators
</ulink> by G. A. Marson and B. Poettering
106 (doi:
10.1007/
978-
3-
642-
40203-
6_7) and may be used to protect
107 journal files from unnoticed alteration.
</para></listitem>
111 <term><varname>SplitMode=
</varname></term>
113 <listitem><para>Controls whether to split up journal files per user, either
<literal>uid
</literal> or
114 <literal>none
</literal>. Split journal files are primarily useful for access control: on UNIX/Linux access
115 control is managed per file, and the journal daemon will assign users read access to their journal files. If
116 <literal>uid
</literal>, all regular users will each get their own journal files, and system users will log to
117 the system journal. If
<literal>none
</literal>, journal files are not split up by user and all messages are
118 instead stored in the single system journal. In this mode unprivileged users generally do not have access to
119 their own log data. Note that splitting up journal files by user is only available for journals stored
120 persistently. If journals are stored on volatile storage (see
<varname>Storage=
</varname> above), only a single
121 journal file is used. Defaults to
<literal>uid
</literal>.
</para></listitem>
125 <term><varname>RateLimitIntervalSec=
</varname></term>
126 <term><varname>RateLimitBurst=
</varname></term>
128 <listitem><para>Configures the rate limiting that is applied
129 to all messages generated on the system. If, in the time
130 interval defined by
<varname>RateLimitIntervalSec=
</varname>,
131 more messages than specified in
132 <varname>RateLimitBurst=
</varname> are logged by a service,
133 all further messages within the interval are dropped until the
134 interval is over. A message about the number of dropped
135 messages is generated. This rate limiting is applied
136 per-service, so that two services which log do not interfere
137 with each other's limits. Defaults to
10000 messages in
30s.
138 The time specification for
139 <varname>RateLimitIntervalSec=
</varname> may be specified in the
140 following units:
<literal>s
</literal>,
<literal>min
</literal>,
141 <literal>h
</literal>,
<literal>ms
</literal>,
142 <literal>us
</literal>. To turn off any kind of rate limiting,
143 set either value to
0.
</para></listitem>
147 <term><varname>SystemMaxUse=
</varname></term>
148 <term><varname>SystemKeepFree=
</varname></term>
149 <term><varname>SystemMaxFileSize=
</varname></term>
150 <term><varname>SystemMaxFiles=
</varname></term>
151 <term><varname>RuntimeMaxUse=
</varname></term>
152 <term><varname>RuntimeKeepFree=
</varname></term>
153 <term><varname>RuntimeMaxFileSize=
</varname></term>
154 <term><varname>RuntimeMaxFiles=
</varname></term>
156 <listitem><para>Enforce size limits on the journal files
157 stored. The options prefixed with
<literal>System
</literal>
158 apply to the journal files when stored on a persistent file
159 system, more specifically
160 <filename>/var/log/journal
</filename>. The options prefixed
161 with
<literal>Runtime
</literal> apply to the journal files
162 when stored on a volatile in-memory file system, more
163 specifically
<filename>/run/log/journal
</filename>. The former
164 is used only when
<filename>/var
</filename> is mounted,
165 writable, and the directory
166 <filename>/var/log/journal
</filename> exists. Otherwise, only
167 the latter applies. Note that this means that during early
168 boot and if the administrator disabled persistent logging,
169 only the latter options apply, while the former apply if
170 persistent logging is enabled and the system is fully booted
171 up.
<command>journalctl
</command> and
172 <command>systemd-journald
</command> ignore all files with
173 names not ending with
<literal>.journal
</literal> or
174 <literal>.journal~
</literal>, so only such files, located in
175 the appropriate directories, are taken into account when
176 calculating current disk usage.
</para>
178 <para><varname>SystemMaxUse=
</varname> and
179 <varname>RuntimeMaxUse=
</varname> control how much disk space
180 the journal may use up at most.
181 <varname>SystemKeepFree=
</varname> and
182 <varname>RuntimeKeepFree=
</varname> control how much disk
183 space systemd-journald shall leave free for other uses.
184 <command>systemd-journald
</command> will respect both limits
185 and use the smaller of the two values.
</para>
187 <para>The first pair defaults to
10% and the second to
15% of
188 the size of the respective file system, but each value is
189 capped to
4G. If the file system is nearly full and either
190 <varname>SystemKeepFree=
</varname> or
191 <varname>RuntimeKeepFree=
</varname> are violated when
192 systemd-journald is started, the limit will be raised to the
193 percentage that is actually free. This means that if there was
194 enough free space before and journal files were created, and
195 subsequently something else causes the file system to fill up,
196 journald will stop using more space, but it will not be
197 removing existing files to reduce the footprint again,
200 <para><varname>SystemMaxFileSize=
</varname> and
201 <varname>RuntimeMaxFileSize=
</varname> control how large
202 individual journal files may grow at most. This influences
203 the granularity in which disk space is made available through
204 rotation, i.e. deletion of historic data. Defaults to one
205 eighth of the values configured with
206 <varname>SystemMaxUse=
</varname> and
207 <varname>RuntimeMaxUse=
</varname>, so that usually seven
208 rotated journal files are kept as history.
</para>
210 <para>Specify values in bytes or use K, M, G, T, P, E as
211 units for the specified sizes (equal to
1024,
1024², … bytes).
212 Note that size limits are enforced synchronously when journal
213 files are extended, and no explicit rotation step triggered by
214 time is needed.
</para>
216 <para><varname>SystemMaxFiles=
</varname> and
217 <varname>RuntimeMaxFiles=
</varname> control how many
218 individual journal files to keep at most. Note that only
219 archived files are deleted to reduce the number of files until
220 this limit is reached; active files will stay around. This
221 means that, in effect, there might still be more journal files
222 around in total than this limit after a vacuuming operation is
223 complete. This setting defaults to
100.
</para></listitem>
227 <term><varname>MaxFileSec=
</varname></term>
229 <listitem><para>The maximum time to store entries in a single
230 journal file before rotating to the next one. Normally,
231 time-based rotation should not be required as size-based
232 rotation with options such as
233 <varname>SystemMaxFileSize=
</varname> should be sufficient to
234 ensure that journal files do not grow without bounds. However,
235 to ensure that not too much data is lost at once when old
236 journal files are deleted, it might make sense to change this
237 value from the default of one month. Set to
0 to turn off this
238 feature. This setting takes time values which may be suffixed
239 with the units
<literal>year
</literal>,
240 <literal>month
</literal>,
<literal>week
</literal>,
241 <literal>day
</literal>,
<literal>h
</literal> or
242 <literal>m
</literal> to override the default time unit of
243 seconds.
</para></listitem>
247 <term><varname>MaxRetentionSec=
</varname></term>
249 <listitem><para>The maximum time to store journal entries.
250 This controls whether journal files containing entries older
251 then the specified time span are deleted. Normally, time-based
252 deletion of old journal files should not be required as
253 size-based deletion with options such as
254 <varname>SystemMaxUse=
</varname> should be sufficient to
255 ensure that journal files do not grow without bounds. However,
256 to enforce data retention policies, it might make sense to
257 change this value from the default of
0 (which turns off this
258 feature). This setting also takes time values which may be
259 suffixed with the units
<literal>year
</literal>,
260 <literal>month
</literal>,
<literal>week
</literal>,
261 <literal>day
</literal>,
<literal>h
</literal> or
<literal>
262 m
</literal> to override the default time unit of
263 seconds.
</para></listitem>
267 <term><varname>SyncIntervalSec=
</varname></term>
269 <listitem><para>The timeout before synchronizing journal files
270 to disk. After syncing, journal files are placed in the
271 OFFLINE state. Note that syncing is unconditionally done
272 immediately after a log message of priority CRIT, ALERT or
273 EMERG has been logged. This setting hence applies only to
274 messages of the levels ERR, WARNING, NOTICE, INFO, DEBUG. The
275 default timeout is
5 minutes.
</para></listitem>
279 <term><varname>ForwardToSyslog=
</varname></term>
280 <term><varname>ForwardToKMsg=
</varname></term>
281 <term><varname>ForwardToConsole=
</varname></term>
282 <term><varname>ForwardToWall=
</varname></term>
284 <listitem><para>Control whether log messages received by the journal daemon shall
285 be forwarded to a traditional syslog daemon, to the kernel log buffer (kmsg), to
286 the system console, or sent as wall messages to all logged-in users. These
287 options take boolean arguments. If forwarding to syslog is enabled but nothing
288 reads messages from the socket, forwarding to syslog has no effect. By default,
289 only forwarding to wall is enabled. These settings may be overridden at boot time
290 with the kernel command line options
291 <literal>systemd.journald.forward_to_syslog
</literal>,
292 <literal>systemd.journald.forward_to_kmsg
</literal>,
293 <literal>systemd.journald.forward_to_console
</literal>, and
294 <literal>systemd.journald.forward_to_wall
</literal>. If the option name is
295 specified without
<literal>=
</literal> and the following argument, true is
296 assumed. Otherwise, the argument is parsed as a boolean. When forwarding to the
297 console, the TTY to log to can be changed with
<varname>TTYPath=
</varname>,
298 described below.
</para></listitem>
302 <term><varname>MaxLevelStore=
</varname></term>
303 <term><varname>MaxLevelSyslog=
</varname></term>
304 <term><varname>MaxLevelKMsg=
</varname></term>
305 <term><varname>MaxLevelConsole=
</varname></term>
306 <term><varname>MaxLevelWall=
</varname></term>
308 <listitem><para>Controls the maximum log level of messages
309 that are stored on disk, forwarded to syslog, kmsg, the
310 console or wall (if that is enabled, see above). As argument,
312 <literal>emerg
</literal>,
313 <literal>alert
</literal>,
314 <literal>crit
</literal>,
315 <literal>err
</literal>,
316 <literal>warning
</literal>,
317 <literal>notice
</literal>,
318 <literal>info
</literal>,
319 <literal>debug
</literal>,
320 or integer values in the range of
0–
7 (corresponding to the
321 same levels). Messages equal or below the log level specified
322 are stored/forwarded, messages above are dropped. Defaults to
323 <literal>debug
</literal> for
<varname>MaxLevelStore=
</varname>
324 and
<varname>MaxLevelSyslog=
</varname>, to ensure that the all
325 messages are written to disk and forwarded to syslog. Defaults
327 <literal>notice
</literal> for
<varname>MaxLevelKMsg=
</varname>,
328 <literal>info
</literal> for
<varname>MaxLevelConsole=
</varname>,
329 and
<literal>emerg
</literal> for
330 <varname>MaxLevelWall=
</varname>. These settings may be
331 overridden at boot time with the kernel command line options
332 <literal>systemd.journald.max_level_store=
</literal>,
333 <literal>systemd.journald.max_level_syslog=
</literal>,
334 <literal>systemd.journald.max_level_kmsg=
</literal>,
335 <literal>systemd.journald.max_level_console=
</literal>,
336 <literal>systemd.journald.max_level_wall=
</literal>.
</para>
341 <term><varname>ReadKMsg=
</varname></term>
343 <listitem><para>Takes a boolean value. If enabled (the
344 default), journal reads
<filename>/dev/kmsg
</filename>
345 messages generated by the kernel.
</para></listitem>
349 <term><varname>TTYPath=
</varname></term>
351 <listitem><para>Change the console TTY to use if
352 <varname>ForwardToConsole=yes
</varname> is used. Defaults to
353 <filename>/dev/console
</filename>.
</para></listitem>
357 <term><varname>LineMax=
</varname></term>
359 <listitem><para>The maximum line length to permit when converting stream logs into record logs. When a systemd
360 unit's standard output/error are connected to the journal via a stream socket, the data read is split into
361 individual log records at newline (
<literal>\n
</literal>, ASCII
10) and NUL characters. If no such delimiter is
362 read for the specified number of bytes a hard log record boundary is artificially inserted, breaking up overly
363 long lines into multiple log records. Selecting overly large values increases the possible memory usage of the
364 Journal daemon for each stream client, as in the worst case the journal daemon needs to buffer the specified
365 number of bytes in memory before it can flush a new log record to disk. Also note that permitting overly large
366 line maximum line lengths affects compatibility with traditional log protocols as log records might not fit
367 anymore into a single
<constant>AF_UNIX
</constant> or
<constant>AF_INET
</constant> datagram. Takes a size in
368 bytes. If the value is suffixed with K, M, G or T, the specified size is parsed as Kilobytes, Megabytes,
369 Gigabytes, or Terabytes (with the base
1024), respectively. Defaults to
48K, which is relatively large but
370 still small enough so that log records likely fit into network datagrams along with extra room for
371 metadata. Note that values below
79 are not accepted and will be bumped to
79.
</para></listitem>
379 <title>Forwarding to traditional syslog daemons
</title>
382 Journal events can be transferred to a different logging daemon
383 in two different ways. With the first method, messages are
384 immediately forwarded to a socket
385 (
<filename>/run/systemd/journal/syslog
</filename>), where the
386 traditional syslog daemon can read them. This method is
387 controlled by the
<varname>ForwardToSyslog=
</varname> option. With a
388 second method, a syslog daemon behaves like a normal journal
389 client, and reads messages from the journal files, similarly to
390 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
391 With this, messages do not have to be read immediately,
392 which allows a logging daemon which is only started late in boot
393 to access all messages since the start of the system. In
394 addition, full structured meta-data is available to it. This
395 method of course is available only if the messages are stored in
396 a journal file at all. So it will not work if
397 <varname>Storage=none
</varname> is set. It should be noted that
398 usually the
<emphasis>second
</emphasis> method is used by syslog
399 daemons, so the
<varname>Storage=
</varname> option, and not the
400 <varname>ForwardToSyslog=
</varname> option, is relevant for them.
405 <title>See Also
</title>
407 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
408 <citerefentry><refentrytitle>systemd-journald.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
409 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
410 <citerefentry><refentrytitle>systemd.journal-fields
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
411 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>