Journald : Basic Usage2025/08/17 |
|
This is Basic Usage of Journald that is the Log Management Service Daemon. |
|
| [1] | By default, Journald is running and many logging data on the System are collected by Journald. Therefore, if [Journald (systemd-journald.service systemd-journald.socket systemd-journald-dev-log.socket)] would be down, collecting of many logging data will also stop. |
|
root@dlp:~# systemctl status systemd-journald.service
● systemd-journald.service - Journal Service
Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)
Active: active (running) since Fri 2025-08-15 15:27:26 JST; 3min 58s ago
Invocation: 0c781c79728f4afd8ddd9d2b12122234
TriggeredBy: ○ systemd-journald-audit.socket
● systemd-journald.socket
● systemd-journald-dev-log.socket
Docs: man:systemd-journald.service(8)
man:journald.conf(5)
Main PID: 324 (systemd-journal)
Status: "Processing requests..."
Tasks: 1 (limit: 4635)
FD Store: 7 (limit: 4224)
Memory: 10M (peak: 15M)
CPU: 71ms
CGroup: /system.slice/systemd-journald.service
.....
.....
|
| [2] | It's possible to change settings of Journald on [/etc/systemd/journald.conf]. All options are commented out by default, however they are the default parameters of Journald on Ubuntu. |
|
root@dlp:~# cat /etc/systemd/journald.conf [Journal] #Storage=auto #Compress=yes #Seal=yes #SplitMode=uid #SyncIntervalSec=5m #RateLimitIntervalSec=30s #RateLimitBurst=10000 #SystemMaxUse= #SystemKeepFree= #SystemMaxFileSize= #SystemMaxFiles=100 #RuntimeMaxUse= #RuntimeKeepFree= #RuntimeMaxFileSize= #RuntimeMaxFiles=100 #MaxRetentionSec=0 #MaxFileSec=1month #ForwardToSyslog=no #ForwardToKMsg=no #ForwardToConsole=no #ForwardToWall=yes #TTYPath=/dev/console #MaxLevelStore=debug #MaxLevelSyslog=debug #MaxLevelKMsg=notice #MaxLevelConsole=info #MaxLevelWall=emerg #MaxLevelSocket=debug #LineMax=48K #ReadKMsg=yes #Audit=yes |
| [3] | The place of stored logging data is set on [Storage=***] of [/etc/systemd/journald.conf]. For the place of stored logging data, if syslog service like Rsyslog are installed and running, they are also stored in conventional files like [/var/log/syslog] and so on by syslog service with the setting [ForwardToSyslog=yes] on Journald. |
# parameters of [Storage=***] # # volatile : stored only in memory : under the [/run/log/journal] # persistent : stored on disk : under the [/var/log/journal] # but if impossible to write on disk like early boot, fallback to memory # auto : stored on disk if [/var/log/journal] exists # if not exists, stored in memory # none : not stored all data # but forwarding to other targets like Syslog daemon if they are configured # # * storing in memory is not persistent, when system restarted, logging data are cleared # on default settings of Ubuntu, it's set [auto] and also # [/var/log/journal] exists, so logging data are stored in [/var/log/journal]
root@dlp:~#
root@dlp:~# grep Storage /etc/systemd/journald.conf #Storage=auto ll -d /var/log/journal drwxr-sr-x+ 3 root systemd-journal 4096 Aug 10 16:20 /var/log/journalroot@dlp:~# ll -Rh /var/log/journal /var/log/journal: total 4.0K drwxr-sr-x+ 2 root systemd-journal 4.0K Aug 10 16:32 d5f37d1d4f2b4eabb671e1b36d45aeda /var/log/journal/d5f37d1d4f2b4eabb671e1b36d45aeda: total 25M -rw-r-----+ 1 root systemd-journal 8.0M Aug 10 16:21 system@00063bfdc82a84e1-e144688e3f873bda.journal~ -rw-r-----+ 1 root systemd-journal 8.0M Aug 15 15:32 system.journal -rw-r-----+ 1 root systemd-journal 8.0M Aug 10 16:33 user-1000.journal |
| [4] | To show stored logging data by Journald, it's possible with [journalctl] command. |
|
# show all data without any option : results are send to [less] command # if not send to [less], add [--no-pager] option root@dlp:~# journalctl Aug 10 16:20:01 debian kernel: Linux version 6.12.38+deb13-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc> Aug 10 16:20:01 debian kernel: Command line: BOOT_IMAGE=/vmlinuz-6.12.38+deb13-amd64 root=/dev/mapper/debian--vg-root r> Aug 10 16:20:01 debian kernel: BIOS-provided physical RAM map: Aug 10 16:20:01 debian kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable Aug 10 16:20:01 debian kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved Aug 10 16:20:01 debian kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved Aug 10 16:20:01 debian kernel: BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable Aug 10 16:20:01 debian kernel: BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved Aug 10 16:20:01 debian kernel: BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved ..... ..... # [-u UNIT] : show logs of a specific UNIT root@dlp:~# journalctl -u cron.service Aug 10 16:20:03 debian systemd[1]: Started cron.service - Regular background program processing daemon. Aug 10 16:20:03 debian cron[666]: (CRON) INFO (pidfile fd = 3) Aug 10 16:20:03 debian cron[666]: (CRON) INFO (Running @reboot jobs) -- Boot 63155b1870654d6fa4e90ce762c0417e -- Aug 10 16:30:32 debian systemd[1]: Started cron.service - Regular background program processing daemon. Aug 10 16:30:32 debian cron[691]: (CRON) INFO (pidfile fd = 3) Aug 10 16:30:32 debian cron[691]: (CRON) INFO (Running @reboot jobs) Aug 10 16:31:51 debian systemd[1]: Stopping cron.service - Regular background program processing daemon... Aug 10 16:31:51 debian systemd[1]: cron.service: Deactivated successfully. Aug 10 16:31:51 debian systemd[1]: Stopped cron.service - Regular background program processing daemon. ..... .....root@dlp:~# journalctl -u systemd-tmpfiles-clean.timer Aug 15 15:27:26 dlp.srv.world kernel: Linux version 6.12.38+deb13-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-> Aug 15 15:27:26 dlp.srv.world kernel: Command line: BOOT_IMAGE=/vmlinuz-6.12.38+deb13-amd64 root=/dev/mapper/debian--vg> Aug 15 15:27:26 dlp.srv.world kernel: BIOS-provided physical RAM map: Aug 15 15:27:26 dlp.srv.world kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable Aug 15 15:27:26 dlp.srv.world kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved Aug 15 15:27:26 dlp.srv.world kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved Aug 15 15:27:26 dlp.srv.world kernel: BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable ..... ..... # [-k] : show logs of kernel message root@dlp:~# journalctl -k Jul 16 21:33:17 dlp.srv.world kernel: Linux version 6.1.0-9-amd64 (debian-kerne> Jul 16 21:33:17 dlp.srv.world kernel: Command line: BOOT_IMAGE=/vmlinuz-6.1.0-9> Jul 16 21:33:17 dlp.srv.world kernel: x86/fpu: Supporting XSAVE feature 0x001: > Jul 16 21:33:17 dlp.srv.world kernel: x86/fpu: Supporting XSAVE feature 0x002: > Jul 16 21:33:17 dlp.srv.world kernel: x86/fpu: Supporting XSAVE feature 0x004: > Jul 16 21:33:17 dlp.srv.world kernel: x86/fpu: Supporting XSAVE feature 0x020: > Jul 16 21:33:17 dlp.srv.world kernel: x86/fpu: Supporting XSAVE feature 0x040: > ..... ..... # [-p Priority] : show logs of a specific priority root@dlp:~# journalctl -p err Aug 10 16:30:39 debian dhcpcd[713]: enp1s0: DHCP lease expired -- Boot 26bc7a4690454e2087b4258ac2e4f201 -- Aug 15 14:51:12 dlp.srv.world dhcpcd[682]: ps_bpf_recvmsg: Network is down Aug 15 14:51:13 dlp.srv.world kernel: watchdog: watchdog0: watchdog did not stop! ..... ..... # [-g PATTERN] : show logs that include specific word [PATTERN] in [MESSAGE] field root@dlp:~# journalctl -g "apparmor" Aug 10 16:20:01 debian kernel: LSM: initializing lsm=lockdown,capability,landlock,yama,apparmor,tomoyo,bpf,ipe,ima,evm Aug 10 16:20:01 debian kernel: AppArmor: AppArmor initialized Aug 10 16:20:01 debian kernel: AppArmor: AppArmor Filesystem Enabled Aug 10 16:20:02 debian kernel: AppArmor: AppArmor sha256 policy hashing enabled Aug 10 16:20:02 debian kernel: evm: security.apparmor Aug 10 16:20:02 debian systemd[1]: systemd 257.7-1 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +IPE +SM> Aug 10 16:20:02 debian systemd[1]: Starting apparmor.service - Load AppArmor profiles... Aug 10 16:20:02 debian apparmor.systemd[536]: Restarting AppArmor Aug 10 16:20:02 debian apparmor.systemd[536]: Reloading AppArmor profiles Aug 10 16:20:02 debian kernel: audit: type=1400 audit(1754810402.988:2): apparmor="STATUS" operation="profile_load" pro> Aug 10 16:20:02 debian kernel: audit: type=1400 audit(1754810402.988:3): apparmor="STATUS" operation="profile_load" pro> Aug 10 16:20:02 debian kernel: audit: type=1400 audit(1754810402.988:4): apparmor="STATUS" operation="profile_load" pro> ..... ..... # [-S DATE] : show logs Since DATE # [-U DATE] : show logs Until DATE root@dlp:~# journalctl -S "2025-08-14 00:00:00" -U "2025-08-15 23:59:59" Aug 15 14:50:45 debian kernel: Linux version 6.12.38+deb13-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc> Aug 15 14:50:45 debian kernel: Command line: BOOT_IMAGE=/vmlinuz-6.12.38+deb13-amd64 root=/dev/mapper/debian--vg-root r> Aug 15 14:50:45 debian kernel: BIOS-provided physical RAM map: Aug 15 14:50:45 debian kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable Aug 15 14:50:45 debian kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved ..... ..... # show help root@dlp:~# journalctl --help
journalctl [OPTIONS...] [MATCHES...]
Query the journal.
Options:
--system Show the system journal
--user Show the user journal for the current user
-M --machine=CONTAINER Operate on local container
-S --since=DATE Show entries not older than the specified date
.....
.....
|
| Sponsored Link |
|
|