</refsect1>
- <xi:include href="standard-conf.xml" xpointer="confd" />
- <xi:include href="standard-conf.xml" xpointer="conf" />
+ <xi:include href="standard-conf.xml" xpointer="main-conf" />
<refsect1>
<title>Options</title>
needed, so that its existence controls where log data goes.
<literal>none</literal> turns off all storage, all log data
received will be dropped. Forwarding to other targets, such as
- the console, the kernel log buffer or a syslog daemon will
+ the console, the kernel log buffer, or a syslog socket will
still work however. Defaults to
<literal>auto</literal>.</para></listitem>
</varlistentry>
<term><varname>SystemMaxUse=</varname></term>
<term><varname>SystemKeepFree=</varname></term>
<term><varname>SystemMaxFileSize=</varname></term>
+ <term><varname>SystemMaxFiles=</varname></term>
<term><varname>RuntimeMaxUse=</varname></term>
<term><varname>RuntimeKeepFree=</varname></term>
<term><varname>RuntimeMaxFileSize=</varname></term>
+ <term><varname>RuntimeMaxFiles=</varname></term>
<listitem><para>Enforce size limits on the journal files
stored. The options prefixed with <literal>System</literal>
names not ending with <literal>.journal</literal> or
<literal>.journal~</literal>, so only such files, located in
the appropriate directories, are taken into account when
- calculating current disk usage.
- </para>
+ calculating current disk usage.</para>
<para><varname>SystemMaxUse=</varname> and
<varname>RuntimeMaxUse=</varname> control how much disk space
- the journal may use up at maximum.
+ the journal may use up at most.
<varname>SystemKeepFree=</varname> and
<varname>RuntimeKeepFree=</varname> control how much disk
space systemd-journald shall leave free for other uses.
and use the smaller of the two values.</para>
<para>The first pair defaults to 10% and the second to 15% of
- the size of the respective file system. If the file system is
- nearly full and either <varname>SystemKeepFree=</varname> or
- <varname>RuntimeKeepFree=</varname> is violated when
- systemd-journald is started, the value will be raised to
+ the size of the respective file system, but each value is
+ capped to 4G. If the file system is nearly full and either
+ <varname>SystemKeepFree=</varname> or
+ <varname>RuntimeKeepFree=</varname> are violated when
+ systemd-journald is started, the limit will be raised to the
percentage that is actually free. This means that if there was
enough free space before and journal files were created, and
subsequently something else causes the file system to fill up,
journald will stop using more space, but it will not be
- removing existing files to go reduce footprint either.</para>
-
- <para><varname>SystemMaxFileSize=</varname>
- and
- <varname>RuntimeMaxFileSize=</varname>
- control how large individual journal
- files may grow at maximum. This
- influences the granularity in which
- disk space is made available through
- rotation, i.e. deletion of historic
- data. Defaults to one eighth of the
- values configured with
+ removing existing files to reduce the footprint again,
+ either.</para>
+
+ <para><varname>SystemMaxFileSize=</varname> and
+ <varname>RuntimeMaxFileSize=</varname> control how large
+ individual journal files may grow at most. This influences
+ the granularity in which disk space is made available through
+ rotation, i.e. deletion of historic data. Defaults to one
+ eighth of the values configured with
<varname>SystemMaxUse=</varname> and
- <varname>RuntimeMaxUse=</varname>, so
- that usually seven rotated journal
- files are kept as history. Specify
- values in bytes or use K, M, G, T, P,
- E as units for the specified sizes
- (equal to 1024, 1024²,... bytes).
- Note that size limits are enforced
- synchronously when journal files are
- extended, and no explicit rotation
- step triggered by time is
- needed.</para></listitem>
+ <varname>RuntimeMaxUse=</varname>, so that usually seven
+ rotated journal files are kept as history.</para>
+
+ <para>Specify values in bytes or use K, M, G, T, P, E as
+ units for the specified sizes (equal to 1024, 1024², ... bytes).
+ Note that size limits are enforced synchronously when journal
+ files are extended, and no explicit rotation step triggered by
+ time is needed.</para>
+
+ <para><varname>SystemMaxFiles=</varname> and
+ <varname>RuntimeMaxFiles=</varname> control how many
+ individual journal files to keep at most. Note that only
+ archived files are deleted to reduce the number of files until
+ this limit is reached; active files will stay around. This
+ means that, in effect, there might still be more journal files
+ around in total than this limit after a vacuuming operation is
+ complete. This setting defaults to 100.</para></listitem>
</varlistentry>
<varlistentry>
daemon, to the kernel log buffer (kmsg), to the system
console, or sent as wall messages to all logged-in users.
These options take boolean arguments. If forwarding to syslog
- is enabled but no syslog daemon is running, the respective
- option has no effect. By default, only forwarding wall is
- enabled. These settings may be overridden at boot time with
- the kernel command line options
+ is enabled but nothing reads messages from the socket,
+ forwarding to syslog has no effect. By default, only
+ forwarding to wall is enabled. These settings may be
+ overridden at boot time with the kernel command line options
<literal>systemd.journald.forward_to_syslog=</literal>,
<literal>systemd.journald.forward_to_kmsg=</literal>,
- <literal>systemd.journald.forward_to_console=</literal> and
+ <literal>systemd.journald.forward_to_console=</literal>, and
<literal>systemd.journald.forward_to_wall=</literal>. When
forwarding to the console, the TTY to log to can be changed
with <varname>TTYPath=</varname>, described
<literal>notice</literal>,
<literal>info</literal>,
<literal>debug</literal>,
- or integer values in the range of 0..7 (corresponding to the
+ or integer values in the range of 0–7 (corresponding to the
same levels). Messages equal or below the log level specified
are stored/forwarded, messages above are dropped. Defaults to
<literal>debug</literal> for <varname>MaxLevelStore=</varname>
</refsect1>
+ <refsect1>
+ <title>Forwarding to traditional syslog daemons</title>
+
+ <para>
+ Journal events can be transferred to a different logging daemon
+ in two different ways. With the first method, messages are
+ immediately forwarded to a socket
+ (<filename>/run/systemd/journal/syslog</filename>), where the
+ traditional syslog daemon can read them. This method is
+ controlled by the <varname>ForwardToSyslog=</varname> option. With a
+ second method, a syslog daemon behaves like a normal journal
+ client, and reads messages from the journal files, similarly to
+ <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
+ With this, messages do not have to be read immediately,
+ which allows a logging daemon which is only started late in boot
+ to access all messages since the start of the system. In
+ addition, full structured meta-data is available to it. This
+ method of course is available only if the messages are stored in
+ a journal file at all. So it will not work if
+ <varname>Storage=none</varname> is set. It should be noted that
+ usually the <emphasis>second</emphasis> method is used by syslog
+ daemons, so the <varname>Storage=</varname> option, and not the
+ <varname>ForwardToSyslog=</varname> option, is relevant for them.
+ </para>
+ </refsect1>
+
<refsect1>
<title>See Also</title>
<para>
projects / thirdparty / systemd.git / blobdiff