Journald : Basic Usage2026/01/06 |
|
This is Basic Usage of Journald that is the Log Management Service Daemon. |
|
| [1] | By default, Journald is running and almost all logging data on the System are collected by Journald. Therefore, if [Journald (systemd-journald.service, systemd-journald.socket, systemd-journald-dev-log.socket)] would be down, collecting of almost all logging data will also stop. |
|
dlp:~ # systemctl status systemd-journald.service
● systemd-journald.service - Journal Service
Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)
Active: active (running) since Tue 2026-01-06 09:33:13 JST; 2min 3s ago
Invocation: ba529dd6fac4496a917b656645ff6f78
TriggeredBy: ○ systemd-journald-audit.socket
● systemd-journald-dev-log.socket
● systemd-journald.socket
Docs: man:systemd-journald.service(8)
man:journald.conf(5)
Main PID: 614 (systemd-journal)
Status: "Processing requests..."
Tasks: 1 (limit: 4663)
FD Store: 9 (limit: 4224)
CPU: 68ms
CGroup: /system.slice/systemd-journald.service
+-- 614 /usr/lib/systemd/systemd-journald
|
| [2] | The default settings for journald can be viewed in [/usr/lib/systemd/journald.conf]. By default, all settings are commented, but the values listed are the default values. If you want to override the default values, create [/etc/systemd/journald.conf] and set the values. |
|
dlp:~ # cat /usr/lib/systemd/journald.conf [Journal] #Storage=auto #Compress=yes #Seal=yes #SplitMode=uid #SyncIntervalSec=5m #RateLimitIntervalSec=30s #RateLimitBurst=10000 #SystemMaxUse= #SystemKeepFree= #SystemMaxFileSize= #SystemMaxFiles=100 #RuntimeMaxUse= #RuntimeKeepFree= #RuntimeMaxFileSize= #RuntimeMaxFiles=100 #MaxRetentionSec=0 #MaxFileSec=1month #ForwardToSyslog=no #ForwardToKMsg=no #ForwardToConsole=no #ForwardToWall=yes #TTYPath=/dev/console #MaxLevelStore=debug #MaxLevelSyslog=debug #MaxLevelKMsg=notice #MaxLevelConsole=info #MaxLevelWall=emerg #MaxLevelSocket=debug #LineMax=48K #ReadKMsg=yes #Audit=yes |
| [3] | The place of stored logging data is set on [Storage=***] of [/usr/lib/systemd/journald.conf]. |
# parameters of [Storage=***] # # volatile : stored only in memory : under the [/run/log/journal] # persistent : stored on disk : under the [/var/log/journal] # but if impossible to write on disk like early boot, fallback to memory # auto : stored on disk if [/var/log/journal] exists # if not exists, stored in memory # none : not stored all data # but forwarding to other targets like Syslog daemon if they are configured # # * storing in memory is not persistent, when system restarted, logging data are cleared # on default settings, it's set [auto] and also # [/var/log/journal] exists, so logging data are stored in [/var/log/journal]
dlp:~ #
dlp:~ # grep Storage /usr/lib/systemd/journald.conf #Storage=auto ll -d /var/log/journal drwxr-sr-x. 1 root systemd-journal 64 Oct 9 14:06 /var/log/journal |
| [4] | To show stored logging data by Journald, it's possible with [journalctl] command. |
|
# show all data without any option : results are send to [less] command # if not send to [less], add [--no-pager] option # if use pager and would like to display all content of a line, send to [more] command dlp:~ # journalctl Oct 09 14:05:55 localhost kernel: Linux version 6.12.0-160000.5-default (geeko@buildhost) (gcc-13 (SUSE Linux) 13.4.0, GNU ld (> Oct 09 14:05:55 localhost kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-6.12.0-160000.5-default root=UUID=80a1a466-5fb2-4a54-9> Oct 09 14:05:55 localhost kernel: BIOS-provided physical RAM map: ..... ..... # [-u UNIT] : show logs of a specific UNIT dlp:~ # journalctl -u sshd.service Jan 06 09:44:58 dlp.srv.world systemd[1]: Starting OpenSSH Daemon... Jan 06 09:44:58 dlp.srv.world sshd-gen-keys-start[1210]: Checking for missing server keys in /etc/ssh Jan 06 09:44:58 dlp.srv.world sshd-gen-keys-start[1212]: ssh-keygen: generating new host keys: RSA ECDSA ED25519 Jan 06 09:44:58 dlp.srv.world sshd[1216]: Server listening on 0.0.0.0 port 22. Jan 06 09:44:58 dlp.srv.world sshd[1216]: Server listening on :: port 22. Jan 06 09:44:58 dlp.srv.world systemd[1]: Started OpenSSH Daemon. ..... .....dlp:~ # journalctl -u systemd-tmpfiles-clean.timer Oct 09 14:06:02 localhost systemd[1]: Started Daily Cleanup of Temporary Directories. Oct 09 14:07:06 localhost systemd[1]: systemd-tmpfiles-clean.timer: Deactivated successfully. Oct 09 14:07:06 localhost systemd[1]: Stopped Daily Cleanup of Temporary Directories. ..... ..... # [-k] : show logs of kernel message dlp:~ # journalctl -k Jan 06 09:33:11 localhost kernel: Linux version 6.12.0-160000.6-default (geeko@buildhost) (gcc-13 (SUSE Linux) 13.4.0, GNU ld (> Jan 06 09:33:11 localhost kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-6.12.0-160000.6-default root=UUID=80a1a466-5fb2-4a54-9> Jan 06 09:33:11 localhost kernel: BIOS-provided physical RAM map: ..... ..... # [-p Priority] : show logs of a specific priority dlp:~ # journalctl -p err Oct 09 14:07:06 localhost dbus-broker-launch[967]: Activation request for 'org.freedesktop.nm_dispatcher' failed. -- Boot e6cf78d46c3648e2a0974bb19f90278a -- ..... ..... # [-g PATTERN] : show logs that include specific word [PATTERN] in [MESSAGE] field dlp:~ # journalctl -g "sealert" Jan 04 10:55:11 dlp.srv.world setroubleshoot[1998]: SELinux is preventing /usr/> ..... ..... # [-S DATE] : show logs Since DATE # [-U DATE] : show logs Until DATE dlp:~ # journalctl -S "2026-01-01 00:00:00" -U "2026-01-06 23:59:59" Jan 06 09:31:35 localhost kernel: Linux version 6.12.0-160000.6-default (geeko@buildhost) (gcc-13 (SUSE Linux) 13.4.0, GNU ld (> Jan 06 09:31:35 localhost kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-6.12.0-160000.6-default root=UUID=80a1a466-5fb2-4a54-9> Jan 06 09:31:35 localhost kernel: BIOS-provided physical RAM map: ..... ..... # show help dlp:~ # journalctl --help
journalctl [OPTIONS...] [MATCHES...]
Query the journal.
Options:
--system Show the system journal
--user Show the user journal for the current user
.....
.....
|
|
|