JOURNALD.CONF(5) journald.conf JOURNALD.CONF(5) (NAME) journald.conf - (SYNOPSIS) /etc/systemd/journald.conf /run/systemd/journald.conf /usr/local/lib/systemd/journald.conf /usr/lib/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf /run/systemd/journald.conf.d/*.conf /usr/local/lib/systemd/journald.conf.d/*.conf /usr/lib/systemd/journald.conf.d/*.conf /etc/systemd/journald@NAMESPACE.conf /etc/systemd/journald@NAMESPACE.conf.d/*.conf /run/systemd/journald@NAMESPACE.conf.d/*.conf /usr/local/lib/systemd/journald@NAMESPACE.conf.d/*.conf /usr/lib/systemd/journald@NAMESPACE.conf.d/*.conf (DESCRIPTION) systemd-journald.service(8) . systemd.syntax(7) . systemd-journald /etc/systemd/journald.conf . /etc/systemd/journald@NAMESPACE.conf . . systemd-journald.service(8) . (CONFIGURATION DIRECTORIES AND PRECEDENCE) . : /etc/systemd/, /run/systemd/, /usr/local/lib/systemd/ [1], /usr/lib/systemd/. . (drop-ins) . ( /etc/ /usr/ ) . : /usr/lib/systemd/*.conf.d/, /usr/local/lib/systemd/*.conf.d/, /etc/systemd/*.conf.d/. (override) . *.conf.d/ . . /usr/ . /etc/ . . . . . 10-40 /usr/ 60-90 /etc/ /run/ . /dev/null /etc/ . (OPTIONS) [Journal] : Storage= . "volatile" "persistent" "auto" "none". "volatile" /run/log/journal ( ) . "persistent" /var/log/journal ( ) (fallback) /run/log/journal ( ) . "auto" /var/log/journal "persistent" "volatile" ( ). "none" ( syslog ). "persistent" ( ) "persistent" . journald journalctl --flush ( SIGUSR1 journald) ( ). "systemd-journal-flush.service" . "volatile" . journalctl(1) --flush . ( LogNamespace= systemd.exec(5)) Storage= "volatile" "auto" /var/log/journal/ systemd-journald@.service LogsDirectory= . LogsDirectory= . journalctl --user . "journal.storage" . . 186. Compress= . ( ) . . K M G . Seal= . ( ) ( --setup-keys journalctl(1) ) (Forward Secure Sealing FSS) . FSS Seekable Sequential Key Generators[2] G. A. Marson B. Poettering ( doi:10.1007/978-3-642-40203-6_7) . 189. SplitMode= "uid" "none" . : / . "uid" ( UID nobody) . UID Users, Groups, UIDs and GIDs on systemd systems[3] . "none" . . . ( Storage= ) . "uid" . 190. RateLimitIntervalSec=, RateLimitBurst= (rate limiting) . RateLimitIntervalSec= RateLimitBurst= . . . . RateLimitIntervalSec= : "s" "min" "h" "ms" "us". . . . 1. RateLimitBurst= +---------------------+------------------+ |Available Disk Space | Burst Multiplier | +---------------------+------------------+ |<= 1MB | 1 | +---------------------+------------------+ |<= 16MB | 2 | +---------------------+------------------+ |<= 256MB | 3 | +---------------------+------------------+ |<= 4GB | 4 | +---------------------+------------------+ |<= 64GB | 5 | +---------------------+------------------+ |<= 1TB | 6 | +---------------------+------------------+ LogRateLimitIntervalSec= / LogRateLimitBurst= systemd.exec(5) . SystemMaxUse=, SystemKeepFree=, SystemMaxFileSize=, SystemMaxFiles=, RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize=, RuntimeMaxFiles= . "System" /var/log/journal . "Runtime" /run/log/journal . /var/ (mount) /var/log/journal . . . journalctl systemd-journald ".journal" ".journal~" . SystemMaxUse= RuntimeMaxUse= . SystemKeepFree= RuntimeKeepFree= systemd-journald . systemd-journald . 4G . SystemKeepFree= RuntimeKeepFree= systemd-journald . journald . . (vacuuming) SystemMaxUse= RuntimeMaxUse= . SystemMaxFileSize= RuntimeMaxFileSize= . (rotation) . SystemMaxUse= RuntimeMaxUse= 128M . ( ) 4G . K M G T P E ( ). . SystemMaxFiles= RuntimeMaxFiles= . . . . MaxFileSec= . SystemMaxFileSize= . . . "year" "month" "week" "day" "h" "m" . 195. MaxRetentionSec= . . SystemMaxUse= . (data retention) ( ) . "year" "month" "week" "day" "h" "m" . 195. SyncIntervalSec= (sync) . OFFLINE . CRIT ALERT EMERG . ERR WARNING NOTICE INFO DEBUG . . 199. ForwardToSyslog=, ForwardToKMsg=, ForwardToConsole=, ForwardToWall=, ForwardToSocket= syslog (kmsg) wall . "ForwardToSocket=" . syslog syslog . wall . "systemd.journald.forward_to_syslog" "systemd.journald.forward_to_kmsg" "systemd.journald.forward_to_console" "systemd.journald.forward_to_wall" . "=" true . . "journal.forward_to_socket" . : AF_INET ( "192.168.0.11:4444") AF_INET6 ( "[2001:db8::ff00:42:8329]:4444") AF_UNIX ( "/run/host/journal/socket") AF_VSOCK ( "vsock:2:1234") TTY TTYPath= . (kmsg) "log_buf_len=8M" . systemd ( "printk.devkmsg=on"). Journal Export Format[4] . __REALTIME_TIMESTAMP systemd-journal-remote ( systemd-journal- remote.service(8)) . : journald (synchronous) . ForwardToConsole=yes . journald journald . . ForwardToConsole=yes journalctl --follow . : ForwardToSocket= IPv4/IPv6 . . IP journald initrd . AF_VSOCK/AF_UNIX . MaxLevelStore=, MaxLevelSyslog=, MaxLevelKMsg=, MaxLevelConsole=, MaxLevelWall=, MaxLevelSocket= syslog kmsg wall ( ) . "emerg" "alert" "crit" "err" "warning" "notice" "info" "debug" 0-7 ( ) . / . "debug" MaxLevelStore= MaxLevelSyslog= MaxLevelSocket= syslog . "notice" MaxLevelKMsg= "info" MaxLevelConsole= "emerg" MaxLevelWall= . "systemd.journald.max_level_store=" "systemd.journald.max_level_syslog=" "systemd.journald.max_level_kmsg=" "systemd.journald.max_level_console=" "systemd.journald.max_level_wall=" "systemd.journald.max_level_socket=" . 185. ReadKMsg= . systemd-journal /dev/kmsg . . 235. Audit= "keep" . systemd-journald (kernel auditing) . . "keep" . systemd-journald . yes "keep" . systemd-journald . systemd-journald "systemd-journald-audit.socket" . 246. TTYPath= ForwardToConsole=yes TTY . /dev/console . 185. LineMax= . / systemd ("\n" ) NUL . . . AF_UNIX AF_INET . . K M G T ( ) . 48K . . 235. (FORWARDING TO OTHER FACILITIES) . (/run/systemd/journal/syslog) syslog . ForwardToSyslog= . syslog journalctl(1) . . . . Storage=none . syslog Storage= ForwardToSyslog= . (SEE ALSO) systemd(1), systemd-journald.service(8), journalctl(1), systemd.journal-fields(7), systemd-system.conf(5) (NOTES) 1. . /usr/local/ . 2. Seekable Sequential Key Generators https://eprint.iacr.org/2013/397 3. Users, Groups, UIDs and GIDs on systemd systems https://systemd.io/UIDS-GIDS 4. Journal Export Format https://systemd.io/JOURNAL_EXPORT_FORMATS/#journal-export-format systemd 261.2 JOURNALD.CONF(5)