Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [systemd-journald]

journald is part of systemd and responsible for collecting system logs

0
votes
0answers
21 views

How to mount a partition's subdirectory for /var/log/journal?

Our server (Ubuntu 18) has a large partition mounted as /publish/data (its a VM, provided as IaaS so that is how it is mounted when extra disk space is requested), it is defined in fstab as follows: /...
1
vote
1answer
24 views

Journald Storage=persistent - Just disk or RAM & disk

I am trying to understand what journald does in relation to persistent storage of log entries. I have an SDCard setup so I am looking to keep disk writes to a minimum, but would like some persistence ...
2
votes
0answers
26 views

Customize journald config for a single service

I have a service (systemd unit) that logs very long messages (~700K), which means that the default LineMax setting of 48K doesn't suffice. Setting the LineMax field to 1M in /etc/systemd/journald....
0
votes
1answer
37 views

prevent systemd / journald from logging socket-calls

I just set up a new server (OpenSuse Leap 15.0) and installed the Check_MK-Agent. Every time my Check_MK-Servers polls this agent, this socket-access ist logged: Apr 14 20:05:26 static systemd[1]: ...
-1
votes
1answer
33 views

How to let a specific group have read-access to systemd's journal?

How do I grant read-only permission to somegroup to read the system journal? (I'm on Debian10 buster). $ journalctl Hint: You are currently not seeing messages from other users and the system. ...
0
votes
1answer
18 views

Use journalctl to show logs of specific unit which has a parameter?

I have one systemd service which runs with systemctl --user start test_unit@random_arguments. How could I use journalctl to filter all logs of test_unit? If it supports "follow mode", that's even ...
1
vote
0answers
16 views

journald flooded by kernel messages

My journald log was at some point filled up with kernel messages like this. Mar 12 05:03:53 workstation.mydomain kernel: FAT-fs (sdd1): FAT read failed (blocknr 1785) Each followed by a message ...
0
votes
1answer
37 views

How to append systemd service logs to the journal

I am trying to control a continuously running license server on a workstation using systemd. The service itself is started by a shell script, which is essentially Usage: ./rlm_control.sh {start|stop|...
1
vote
1answer
25 views

Can a UBIFS be set as ACL?

Running Debian Buster on Kernel 4.20.17 with systemd 241: +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 ...
1
vote
1answer
33 views

Can be the journal path on a filesystem other than /?

I would like to store the default journal directory /var/log/journal/ on a mounted device, but I am not sure if I can do it due to the fact that journal is an important service which may already run ...
1
vote
1answer
42 views

Getting systemd service logs faster from my service

I'm having a systemd service defined as follows, that works fine: [Unit] Description=my service After=network.target [Service] User=myuser Group=mygroup WorkingDirectory=/home/myuser/myapp ...
1
vote
1answer
24 views

change the name of the journal files in /var/log/journal/remote coming from /var/log/journal/upload

I have several hosts using systemd-journal-upload to send their logs to my systemd-journal-remote server. The name of the files in /var/log/journal/remote are remote-[IP_ADDR].journal but I'd like ...
2
votes
2answers
120 views

How can I view journalctl logs by unit and identifier with one command?

I have a vpn service unit for which I can view the logs with... journalctl -u vpn I also have a script that interacts with the vpn manually and is logged to journal with... exec > >(systemd-...
3
votes
1answer
34 views

How do I work out which process/service/program is sending systemd dbus messages?

Currently my systemd journal is filling up with messages of the form: Feb 01 16:40:31 host systemd[1]: Got message type=method_call sender=:1.58666 destination=org.freedesktop.systemd1 object=/org /...
3
votes
1answer
334 views

The Systemd Journald use too much memory and don't respect SystemMaxUse and RuntimeMaxUse?

I found the systemd-journald takes like 1GB+ of memory. After some searching I set the value of SystemMaxUse and RuntimeMaxUse both to 8M in "/etc/systemd/journald.conf". Then restart the journald. ...
3
votes
0answers
42 views

journalctl log disappear?

Service is still active: systemctl -l status foo.service ● foo.service - My Foo service Loaded: loaded (/etc/systemd/system/foo.service; static; vendor preset: disabled) Active: activating (...
2
votes
2answers
198 views

How does journald know the PID of a process that produces log data?

When I look at journalctl, it tells me the PID and the program name(or service name?) of a log entry. Then I wondered, logs are created by other processes, how do systemd-journald know the PID of ...
2
votes
2answers
345 views

Store more logs in-memory with systemd-journald

I know systemd-journald keeps its logs in-memory by default. Does anyone know what the limit is for these logs and how to increase it? From the banner at the top it seems like it is only keeping them ...
0
votes
1answer
69 views

journald socket buffering for option ForwardToSyslog

I have a configuration in which journald is set with ForwardToSyslog=yes. Quote from the documentation: If forwarding to syslog is enabled but nothing reads messages from the socket, ...
0
votes
1answer
38 views

How does systemd provide data to the service triggered by a socket?

The concept behind systemd sockets is to provide a "cheap listener service" that will start the "service that would normally bind that socket but we don't want to run it all the time" once data on the ...
4
votes
1answer
116 views

How to prevent a process from writing to the systemd journal?

I am using a third party .NET Core application (a binary distribution used by a VS Code extension) that unfortunately has diagnostic logging enabled with no apparent way to disable it (I did already ...
1
vote
1answer
105 views

journald - resent archived logs to logging socket

I have an embedded device that has both systemd and rsyslog. journald is the main mechanism for local logging and rsyslog for remote logging. rsyslog isn't always running and is started only when ...
0
votes
1answer
193 views

What triggers journald to free up space, to comply with SystemMaxUse, SystemKeepFree?

When I do a software update (Ubuntu upgrade) and e.g. install new Linux kernels, sometimes I run out of space, which is a BAD THING. This is on Ubuntu Bionic 18.04, with systemd, so journald is ...
1
vote
2answers
383 views

How do I analyze journalctl logs outside of journalctl?

I need to collect some stats from my systemd log files, like how many users pass in a certain query string parameter to my service. I know I can view this information in journalctl but I can't figure ...
0
votes
1answer
291 views

How to omit PAM log messages for specific user (pam_succeed_if quiet)

I'm using a monitoring agent (telegraf) to monitor fail2ban. Unfortunately, it requires SuperUser rights to execute fail2ban-client, which causes 24 system log messages every 10 seconds... Do the math,...
0
votes
0answers
91 views

How to remove bloat from journald systemlog?

tl;dr The "managed-by-journald" syslog is littered with repeated error message created by one-buggy-software. How to remove those entries from the journal? Being one of the blessed users of ...
1
vote
0answers
128 views

automated tool (or script) for cleaning systemd journal of corrupted files?

It is my understanding that the systemd journal cannot repair or fix errors revealed by: journalctl --verify Here's an example of an error I just saw. I routinely see errors like this on all the ...
0
votes
1answer
225 views

Capture text log files to journald

Per Journald man page. This command can capture stdout/stderr, only, for running services. However, sometimes we would like to capture text logs into journald, For example, nginx access.log. Is it ...
0
votes
0answers
213 views

How to prevent “Kernel messages have been lost as the journal system has been unable to process them quickly enough.”?

$ sudo journalctl -x -b 0 shows: Sep 05 00:44:54 dom0 qrexec[4471]: qubes.GetDate: sys-firewall -> @default: allowed to dom0 Sep 05 00:44:54 dom0 runuser[4480]: pam_unix(runuser:session): session ...
1
vote
1answer
101 views

How to configure systemd-journald on NixOS?

What is the proper way to configure systemd-journald on NixOS? There seems to be no relevant configuration options. On Ubuntu, for example, I could edit /etc/systemd/journald.conf. Context: I have ...
5
votes
2answers
2k views

Examining /dev/log

/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix ...
1
vote
2answers
81 views

Log all scp transfers with systemd-journald

Does systemd-jurnald log incoming scp connections and what file they copied to what place? I would either like to access these logs or change the config so all of these file transfers are logged.
1
vote
0answers
51 views

journald to rsyslog paging issues

I'm using rsyslog to dump journald entries to a log file so that they can be sent to Logstash. The issue I'm having is that some of the log lines are getting split across two lines. When viewing ...
2
votes
0answers
490 views

Why do “journalctl --disk-usage” and “journalctl | wc” not correspond well?

TL;DR how comes that journald stores about 770 MiB while displaying the logs only yields 90MiB of data? #UPDATE# I did a journalctl -a -o verbose which at least yielded some 530MiB, yet less than ...
1
vote
1answer
123 views

Error starting service in Ubuntu 16.04:

I have created a systemd unit file like this: [Unit] Description=Menu Core Prices Update Daemon After=network.target [Service] Environment="APP_CP=/opt/menu/menu-core-price-update" Environment="...
1
vote
0answers
79 views

Systemd showing partial output in the logs

I want to have output output of iostat printed periodically and logged. Executing the command in the shell prints out the normal fields as expected: # iostat avg-cpu: %user %nice %system %iowait ...
3
votes
0answers
387 views

Remove single line from journalctl file

I have an Ubuntu 18.04 server that is running a service I'm developing. The output is being sent to the system journal for logging. I accidentally failed to sanitize some logging and a plaintext ...
0
votes
0answers
99 views

Starting as a systemd service, no journal files were found. Cannot start service

i have recently downloaded and installed node-red on my rp1 via the bash command as suggested in their docs. I run raspbian Jessie. I want to run 2 services at the same time.The first service is a ...
0
votes
0answers
77 views

systemd-journal-remote with https always looks for SSL CA

I'm setting up remote logging with systemd. systemd-journal-remote has been set on the server (which will receive the logs) and systemd-journal-upload on the client side. The initial setup was done ...
0
votes
1answer
76 views

Which one should I choose for log management, systemd-journald or rsyslog?

We have both systemd-journald and rsyslog running on our linux box, and we have to make a decision bewteen these two for managing our application logs. From what we've known (please correct me if I'm ...
0
votes
0answers
444 views

Fail to mount an external disk on Debian

I have a Debian 8 server with an external disk attached $ sudo lsblk --fs NAME FSTYPE LABEL UUID MOUNTPOINT sda ext4 7169e849-0d6d-4094-b0f7-...
1
vote
1answer
284 views

systemd.service : use pty so force flush of stdout?

I have a service that I want to run under systemd. It is written in perl, where by default output is line buffered if STDOUT is connected to a terminal. (Which seems similar to python) The ...
1
vote
1answer
132 views

redundant systemd-journal-remote for systemd-journal-upload instances

I'm using systemd-journal-upload on serveral nodes to forward their journals to a single systemd-journal-remote sink, loghost01: /var/log/journal ├── <foo-bar> │ ├── system.journal │ └── ...
0
votes
1answer
98 views

Specify a systemd unit for cronjob

When I run a cronjob, it's nice being able to follow its logs. If I want to see all logs from cron with journalctl, I can select the cron unit (journalctl -u cron). But when I have multiple cronjobs, ...
4
votes
1answer
429 views

What does “org.gnome.Shell.desktop[1711]: ” mean in the systemd journal?

$ journalctl -b ... Mar 23 18:18:50 alan-laptop pkexec[31408]: pam_unix(polkit-1:session): session opened for user root by (uid=1001) Mar 23 18:19:47 alan-laptop org.gnome.Shell.desktop[1711]: ...
5
votes
2answers
210 views

systemd DynamicUser= services v.s. journald splits

systemd-journald has the default config SplitMode=uid, to create individual journal (log) files for each user, which they are allowed to read. When running services with DynamicUser=, does this mean ...
-1
votes
1answer
697 views

Bypass systemd-journald to send messages directly to ryslog daemon

As a follow-up of my earlier question Prevent syslogs from being logged under journalctl, and this wonderful JdeBP's answer I want to know how do I bypass systemd-journald to send syslog messages ...
0
votes
1answer
2k views

Safe to clear files in /run/log/journal CentOS 7.4

There a log entries on my CentOS 7.4 server in /run/log/journal/ that are up to 1.3GB. IS it safe to clear the older files out? [root@fbds journal]# pwd /run/log/journal [root@fbds journal]# ll ...
4
votes
0answers
320 views

systemd-journald: Missed 685 kernel messages

At boot and some other times I see missed kernel logs on my system. After that I set Rate limits at jornald.conf but no luck. I still have the issue. Do you have any advice? Kernel: 4.14.19-1-lts ...
1
vote
0answers
418 views

How to configure journald to discard entries older than a certain time span

From the documentation I know that I can configure the time after which journal files are deleted via MaxRetentionSec. the time after which journal files are rotated via MaxFileSec. However my goal ...