'\" t
.TH "SYSTEMD\-JOURNALD\&.SERVICE" "8" "" "systemd 232" "systemd-journald.service"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
systemd-journald.service, systemd-journald.socket, systemd-journald-dev-log.socket, systemd-journald-audit.socket, systemd-journald \- Journal service
.SH "SYNOPSIS"
.PP
systemd\-journald\&.service
.PP
systemd\-journald\&.socket
.PP
systemd\-journald\-dev\-log\&.socket
.PP
systemd\-journald\-audit\&.socket
.PP
/lib/systemd/systemd\-journald
.SH "DESCRIPTION"
.PP
systemd\-journald
is a system service that collects and stores logging data\&. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sources:
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Kernel log messages, via kmsg
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Simple system log messages, via the libc
\fBsyslog\fR(3)
call
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Structured system log messages via the native Journal API, see
\fBsd_journal_print\fR(4)
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Standard output and standard error of system services
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Audit records, via the audit subsystem
.RE
.PP
The daemon will implicitly collect numerous metadata fields for each log messages in a secure and unfakeable way\&. See
\fBsystemd.journal-fields\fR(7)
for more information about the collected metadata\&.
.PP
Log data collected by the journal is primarily text\-based but can also include binary data where necessary\&. All objects stored in the journal can be up to 2^64\-1 bytes in size\&.
.PP
By default, the journal stores log data in
/run/log/journal/\&. Since
/run/
is volatile, log data is lost at reboot\&. To make the data persistent, it is sufficient to create
/var/log/journal/
where
systemd\-journald
will then store the data:
.sp
.if n \{\
.RS 4
.\}
.nf
mkdir \-p /var/log/journal
systemd\-tmpfiles \-\-create \-\-prefix /var/log/journal
.fi
.if n \{\
.RE
.\}
.PP
See
\fBjournald.conf\fR(5)
for information about the configuration of this service\&.
.SH "SIGNALS"
.PP
SIGUSR1
.RS 4
Request that journal data from
/run/
is flushed to
/var/
in order to make it persistent (if this is enabled)\&. This must be used after
/var/
is mounted, as otherwise log data from
/run
is never flushed to
/var
regardless of the configuration\&. The
\fBjournalctl \-\-flush\fR
command uses this signal to request flushing of the journal files, and then waits for the operation to complete\&. See
\fBjournalctl\fR(1)
for details\&.
.RE
.PP
SIGUSR2
.RS 4
Request immediate rotation of the journal files\&. The
\fBjournalctl \-\-rotate\fR
command uses this signal to request journal file rotation\&.
.RE
.PP
SIGRTMIN+1
.RS 4
Request that all unwritten log data is written to disk\&. The
\fBjournalctl \-\-sync\fR
command uses this signal to trigger journal synchronization, and then waits for the operation to complete\&.
.RE
.SH "KERNEL COMMAND LINE"
.PP
A few configuration parameters from
journald\&.conf
may be overridden on the kernel command line:
.PP
\fIsystemd\&.journald\&.forward_to_syslog=\fR, \fIsystemd\&.journald\&.forward_to_kmsg=\fR, \fIsystemd\&.journald\&.forward_to_console=\fR, \fIsystemd\&.journald\&.forward_to_wall=\fR
.RS 4
Enables/disables forwarding of collected log messages to syslog, the kernel log buffer, the system console or wall\&.
.sp
See
\fBjournald.conf\fR(5)
for information about these settings\&.
.RE
.SH "ACCESS CONTROL"
.PP
Journal files are, by default, owned and readable by the
"systemd\-journal"
system group but are not writable\&. Adding a user to this group thus enables her/him to read the journal files\&.
.PP
By default, each logged in user will get her/his own set of journal files in
/var/log/journal/\&. These files will not be owned by the user, however, in order to avoid that the user can write to them directly\&. Instead, file system ACLs are used to ensure the user gets read access only\&.
.PP
Additional users and groups may be granted access to journal files via file system access control lists (ACL)\&. Distributions and administrators may choose to grant read access to all members of the
"wheel"
and
"adm"
system groups with a command such as the following:
.sp
.if n \{\
.RS 4
.\}
.nf
# setfacl \-Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/
.fi
.if n \{\
.RE
.\}
.PP
Note that this command will update the ACLs both for existing journal files and for future journal files created in the
/var/log/journal/
directory\&.
.SH "FILES"
.PP
/etc/systemd/journald\&.conf
.RS 4
Configure
\fBsystemd\-journald\fR
behavior\&. See
\fBjournald.conf\fR(5)\&.
.RE
.PP
/run/log/journal/\fImachine\-id\fR/*\&.journal, /run/log/journal/\fImachine\-id\fR/*\&.journal~, /var/log/journal/\fImachine\-id\fR/*\&.journal, /var/log/journal/\fImachine\-id\fR/*\&.journal~
.RS 4
\fBsystemd\-journald\fR
writes entries to files in
/run/log/journal/\fImachine\-id\fR/
or
/var/log/journal/\fImachine\-id\fR/
with the
"\&.journal"
suffix\&. If the daemon is stopped uncleanly, or if the files are found to be corrupted, they are renamed using the
"\&.journal~"
suffix, and
\fBsystemd\-journald\fR
starts writing to a new file\&.
/run
is used when
/var/log/journal
is not available, or when
\fBStorage=volatile\fR
is set in the
\fBjournald.conf\fR(5)
configuration file\&.
.RE
.PP
/dev/kmsg, /dev/log, /run/systemd/journal/dev\-log, /run/systemd/journal/socket, /run/systemd/journal/stdout
.RS 4
Sockets and other paths that
\fBsystemd\-journald\fR
will listen on that are visible in the file system\&. In addition to these, journald can listen for audit events using netlink\&.
.RE
.SH "SEE ALSO"
.PP
\fBsystemd\fR(1),
\fBjournalctl\fR(1),
\fBjournald.conf\fR(5),
\fBsystemd.journal-fields\fR(7),
\fBsd-journal\fR(3),
\fBsystemd-coredump\fR(8),
\fBsetfacl\fR(1),
\fBsd_journal_print\fR(4),
\fBpydoc systemd\&.journal\fR