CentOS Stream 9
Sponsored Link

Journald : Basic Usage2022/06/30

 
This is Basic Usage of Journald that is the Log Management Service Daemon.
[1] By default, Journald is running and almost all logging data on the System are collected by Journald.
Therefore, if [Journald (systemd-journald.service, systemd-journald.socket, systemd-journald-dev-log.socket)] would be down, collecting of almost all logging data will also stop.
[root@dlp ~]#
systemctl status systemd-journald.service

*  systemd-journald.service - Journal Service
     Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)
     Active: active (running) since Thu 2022-06-30 10:32:03 JST; 17min ago
TriggeredBy: *  systemd-journald-dev-log.socket
             *  systemd-journald.socket
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
   Main PID: 627 (systemd-journal)
     Status: "Processing requests..."
      Tasks: 1 (limit: 23560)
     Memory: 1.7M
        CPU: 88ms
     CGroup: /system.slice/systemd-journald.service
[2] It's possible to change settings of Journald on [/etc/systemd/journald.conf].
All options are commented out by default, however they are the default parameters of Journald on CentOS Stream 8.
[root@dlp ~]#
cat /etc/systemd/journald.conf

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
Audit=
[3] The place of stored logging data is set on [Storage=***] of [/etc/systemd/journald.conf].
# parameters of [Storage=***]
#
# volatile   : stored only in memory : under the [/run/log/journal]
# persistent : stored on disk : under the [/var/log/journal]
#              but if impossible to write on disk like  early boot, fallback to memory
# auto       : stored on disk if [/var/log/journal] exists
#              if not exists, stored in memory
# none       : not stored all data
#              but forwarding to other targets like Syslog daemon if they are configured
#
# * storing in memory is not persistent, when system restarted, logging data are cleared

# on default settings of CentOS Stream 9, it's set [auto] and also
# [/var/log/journal] does not exist, so logging data are stored in [/run/log/journal]

[root@dlp ~]#
grep Storage /etc/systemd/journald.conf

#Storage=auto
[root@dlp ~]#
ll -d /var/log/journal

ls: cannot access '/var/log/journal': No such file or directory
[root@dlp ~]#
ll /run/log/journal

total 0
drwxr-s---+ 2 root systemd-journal 60 Jun 30 10:32 ab414d4792d04b9dbc1e2361f936e849

# [/run/log] on CentOS Stream 9 is [tmpfs] filesystem
# [tmpfs] is on memory
# for [tmpfs] partition size, it's set as half of physical memory size if not set manually
# the size is not kept always on memory but it's used dynamically as needed

[root@dlp ~]#
df -h /run/log

Filesystem      Size  Used Avail Use% Mounted on
tmpfs           744M  8.6M  736M   2% /run

# if you'd like to change stored place to disk, create the [/var/log/journal] directory

[root@dlp ~]#
mkdir /var/log/journal

[root@dlp ~]#
systemctl restart systemd-journald.service \
systemd-journald.socket \
systemd-journal-flush.service
[root@dlp ~]#
ll /run/log/journal

total 0
[root@dlp ~]#
ll /var/log/journal

total 0
drwxr-xr-x. 2 root root 28 Jun 30 10:59 ab414d4792d04b9dbc1e2361f936e849

# * Note
# on default settings of CentOS Stream 9, Rsyslog which is the syslog daemon is also running and 
# it stores logging data received from Journald in [/var/log] directory
# so logging data are stored on disk even if not change storage setting of Journald
# Rsyslog imports logging data from Journald with Rsyslog [imjournal] module, so
# [ForwardToSyslog=***] parameters on Journald does not influence to sending data to Rsyslog
[4] To show stored logging data by Journald, it's possible with [journalctl] command.
# show all data without any option : results are send to [less] command
# if not send to [less], add [--no-pager] option
# if use pager and would like to display all content of a line, send to [more] command

[root@dlp ~]#
journalctl

Jun 30 10:32:01 localhost kernel: Linux version 5.14.0-115.el9.x86_64 (mockbuil>
Jun 30 10:32:01 localhost kernel: The list of certified hardware and cloud inst>
Jun 30 10:32:01 localhost kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz>
Jun 30 10:32:01 localhost kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87>
.....
.....

# [-u UNIT] : show logs of a specific UNIT

[root@dlp ~]#
journalctl -u sshd.service

Jun 30 10:32:04 dlp.srv.world systemd[1]: Starting OpenSSH server daemon...
Jun 30 10:32:04 dlp.srv.world sshd[742]: Server listening on 0.0.0.0 port 22.
Jun 30 10:32:04 dlp.srv.world sshd[742]: Server listening on :: port 22.
Jun 30 10:32:04 dlp.srv.world systemd[1]: Started OpenSSH server daemon.
.....
.....

[root@dlp ~]#
journalctl -u systemd-tmpfiles-clean.timer

Jun 30 10:32:03 dlp.srv.world systemd[1]: Started Daily Cleanup of Temporary Di>
.....
.....

# [-k] : show logs of kernel message

[root@dlp ~]#
journalctl -k

Jun 30 10:32:01 localhost kernel: Linux version 5.14.0-115.el9.x86_64 (mockbuil>
Jun 30 10:32:01 localhost kernel: The list of certified hardware and cloud inst>
Jun 30 10:32:01 localhost kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz>
.....
.....

# [-p Priority] : show logs of a specific priority

[root@dlp ~]#
journalctl -p err

Jun 30 10:32:01 localhost systemd-vconsole-setup[249]: /usr/bin/setfont failed >
Jun 30 10:44:51 dlp.srv.world systemd[1]: Failed to start Live Syncing (Mirror)>
Jun 30 10:45:29 dlp.srv.world systemd[1]: Failed to start Live Syncing (Mirror)>
.....
.....

# [-g PATTERN] : show logs that include specific word [PATTERN] in [MESSAGE] field

[root@dlp ~]#
journalctl -g "sealert"

Jun 30 11:13:30 dlp.srv.world setroubleshoot[2122]: SELinux is preventing /usr/>
.....
.....

# [-S DATE] : show logs Since DATE
# [-U DATE] : show logs Until DATE

[root@dlp ~]#
journalctl -S "2022-06-30 00:00:00" -U "2022-07-01 23:59:59"

Jun 30 10:32:01 localhost kernel: Linux version 5.14.0-115.el9.x86_64 (mockbuil>
Jun 30 10:32:01 localhost kernel: The list of certified hardware and cloud inst>
Jun 30 10:32:01 localhost kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz>
.....
.....

# show help

[root@dlp ~]#
journalctl --help --no-pager

journalctl [OPTIONS...] [MATCHES...]

Query the journal.

Options:
     --system                Show the system journal
     --user                  Show the user journal for the current user
.....
.....
Matched Content