Questions tagged [systemd-journald]
For questions pertaining to systemd-journald, a system service that collects and stores logging data. Use this tag for questions about systemd-journald itself, using systemd-journald, or questions about issues arising from collecting and storing logging data in systems where this task is performed by systemd-journald.
286
questions
0
votes
0
answers
13
views
is it possible to prevent rsyslog messages going to systemd-journal log and how?
I have an iptables rule that is logging some of my networks activities into a log file using the jump LOG rule.
I filter the events to go to a specific file using the following rsyslog configuration ...
- 81
0
votes
1
answer
17
views
Trying to periodically backup /var/log while using journald
I'm trying to periodically backup my /var/log directory, but journald manages the logging on my system. Is the correct way to just tar -cf log.tar /var/log?
The way journald saves it's log files in /...
- 1
0
votes
0
answers
18
views
How can I set journald settings for non-root users?
I have a bunch of services that run under non-root users automatically. I've modified my /etc/systemd/journald.conf to limit the maximum allowed filesize, but it doesn't work on systemd services that ...
- 1,253
0
votes
0
answers
23
views
What needs to be done, based on the following in order to successfully boot into the system?
Ran this command:
sudo fsck -fvy /dev/mapper/root_vg-home
Here's the output:
fsck from util-linux 2.30
e2fsck 1.46.5 (30Dec-2021)
fsck.ext2: No such file or directory while trying to open /dev/mapper/...
- 1
0
votes
0
answers
55
views
Why jouranlctl uses --utc by default when running without root privigies?
On a host running Ubuntu 20.04 LTS I notice that, by default, journalctl (without root privileges) is the same as journalctl --utc, but with root privileges journalctl honors the time zone (as shown ...
- 2,427
0
votes
0
answers
224
views
systemd-journald.service fails to load during boot
I've accidentally unplugged my NAS and after plugging back it fails to boot because of the following error:
[ 105.556720] systemd[1]: systemd-timesyncd.service: Main process exited, code=killed, ...
- 1
0
votes
1
answer
32
views
Journal: which services are filling up the allowed journal-size?
On a Debian machine, by default the systemd-journal is caring about the logs.
It's configuration limits the max disk space it can use:
$ cat /etc/systemd/journald.conf
SystemMaxUse=100M
SystemKeepFree=...
- 339
0
votes
0
answers
201
views
systemd, journalctl, and suspend/resume (sleep/wake): marked by default in the logs? Or how to add? And scripting around suspend/resume in general?
(
First of all, I'm not completely sure what the official terms are.
I think it's "suspend"/"resume",
with "sleep"/"wake" being synonyms
(and I'm not sure if ...
- 23
0
votes
0
answers
154
views
Audit Logging Discrepancy: Journald vs Rsyslog
After installing Debian 12 and rsyslog 8.2302 (for TLS remote syslog), I noticed that apparmor logs (or any audit logs) were not being sent remotely.
After reviewing the local system, journald DOES ...
user432564
3
votes
2
answers
315
views
`journald` vs `systemd-journald` - are they the same notions?
I am new to systemd.
I have read that along with systemd boot system comes it's own logging daemon - journald. But there is also a lot of mention of systemd-journald daemon over the Internet.
At first ...
- 133
-1
votes
1
answer
603
views
How to use journalctl with custom log file
I would like to make a backup of journal log files from a different machine and analyze them locally (while the other machine will get reformatted).
How can I:
Create a full backup of journal logs ...
- 193
0
votes
1
answer
164
views
Can I mount `/var/log/journal` as `tmpfs`?
I have read this question, but it discusses syslog and my question is about journald. Can I mount /var/log/journal as tmpfs using fstab, or will journald be run (and therefore maybe write to the ...
- 214
0
votes
1
answer
287
views
Why all Xorg log messages are written to journal at level 4 (warning)?
All the content of Xorg.n.log can be viewed with journalctl. As Xorg is launched by GDM (if I understand it correctly), it always has the --identifier=/usr/libexec/gdm-x-session. But despite this hint ...
0
votes
1
answer
275
views
How to filter journalctl logs by human readable facility?
I can do the following to get local3 logs:
journalctl SYSLOG_FACILITY=19
The magic number 19 is uterly confusing. How can I do the following:
journalctl WHAT_TO_PUT_HERE=local3
?
I do not see ...
- 860
0
votes
1
answer
231
views
rtkit daemon: setting logging for systemd service
My journal is littered with instances of
rtkit-daemon[1407]: Supervising 8 threads of 5 processes of 1 users1
I see this excellent post from @MC68020
Stop rtkit-daemon from spamming logs with "...
- 1,968
1
vote
2
answers
476
views
Why all output of my C program directed to stdout is sent to journald?
I work on yocto based linux distribution. I'm no expert on systemd and neither on systemd-journald.
My C program my_c_program is started at boot by the script my_script.sh. Below there is the file ...
- 247
0
votes
0
answers
268
views
Why is /fd/1 (stdout) a socket?
I'm running a game server as a systemd service, and in the .service file, I see that StandardOutput defaults to journal.
Ihsan@IhsanServerVM:/proc/28617/fd$ file 1
1: symbolic link to socket:[510374]
...
- 101
2
votes
2
answers
5k
views
systemd-journal-flush.service Failed with result timeout - Failed to start Flush Journal to Persistent Storage
I see this on my systemctl log, the systemd-journal-flush.service fails to start with a timeout error. Server is apparently running fine though. OS is CentOS 8. Logs don't tell much about the error. ...
- 123
3
votes
2
answers
982
views
What are the .journal files that have a ~ on the end?
I have some files in my /var/log/journal/f7e928ba68a9449e85bd828252981fc6/ that have a .journal~ extension.
Can I remove these?
example:
-rw-r-----+ 1 root systemd-journal 16777216 Dec 21 08:46 ...
- 53
2
votes
1
answer
210
views
Log particular systemd service logs only to syslog bypasing journald
For a while looking for a solution that with systemd tools will give me an opportunity to bypass the journal and log directly to syslog. Potentially that can be also filtered, but only on journal not ...
- 123
0
votes
1
answer
122
views
Why is a gap between `journalctl -k -b -0` and `ps ho lstart 1`?
I encounter a strange observation:
If I do: journalctl -k -b -0 | sed -e 's/^\(.\{76\}\).*/\1.../;3q'
I will see something like:
-- Journal begins at Sun 2022-08-07 12:06:55 CEST, ends at Mon 2023-02-...
2
votes
2
answers
331
views
How is syslog entangled with journald?
I set up my journald to limit the log size to 5GB in /etc/systemd/journald.conf
and thought everything was fine. Then, yesterday, I realized that my /var/log/syslog file is in fact 12GB big.
What I ...
- 288
0
votes
1
answer
263
views
Do kernel messages go through syslogd or journald?
I'm using Debian. Debian ships with rsyslogd for its syslogd. It also ships journald. Does the kernel log to rsyslogd first, or journald?
I want to filter one of the messages out of the logs which is ...
- 29.6k
0
votes
0
answers
507
views
Failed to Start Journal Service Error on Pop! OS (Ubuntu) Boot
I recently was booting my laptop when I accidentally plugged in an RFID scanner device and scanned a card during the Pop! OS boot sequence (after cryptsetup and before login screen). The system then ...
- 101
0
votes
0
answers
203
views
Disable journalctl logging for systemd user unit without entirely suppressing stdout
I'd like to suppress a certain user unit's output to the journalctl log without entirely suppressing output as I'd still like to be able to check it with systemctl status --user whatever_unit. I ...
1
vote
1
answer
55
views
What does it mean to say journald collects logs in an "unfakeable way"?
It is said in the systemd-journald.service man page:
The daemon will implicitly collect numerous metadata fields for each log messages in a secure and unfakeable way. See systemd.journal-fields(7) ...
1
vote
2
answers
432
views
Systemd `journalctl` - Unable to change default $PAGER
I'm on Arch Linux.
I came across some new pager software called OV and installed it. It has more features than less and I like it so I want to set it as my default pager.
I added the following to my ....
- 113
2
votes
2
answers
3k
views
How to setup syslog forwarding for systemd journal namespace
I have a configuration /etc/systemd/[email protected] which contains the setting ForwardToSyslog=yes and a systemd service unit configured with LogNamespace=my-namespace.
The documentation ...
- 51
0
votes
0
answers
93
views
journald and systemd-netlogd: problems switching from volatile to persistent log
I'm working on an embedded device running Linux. In certain situations logging is supposed to be switched from volatile to persistent logging.
The system is based on systemd version 250:
$ systemctl --...
- 165
1
vote
0
answers
785
views
systemd-journal-remote claims that the logfile is corrupt
I am trying to upload my journald logs from a server to a centralized server. I am using systemd-journal-remote and systemd-journal-upload for this.
The initial sync of existing logs goes perfectly. ...
- 11
0
votes
0
answers
217
views
How to get logs from journald prior to time change
The journald service is designed to rotate logs when the system time is changed significantly. This is done to prevent the log from becoming too large and to ensure that the log is up to date.
I also ...
3
votes
2
answers
1k
views
Run systemd service only if script condion is True
I have a systemd service that writes to a LCD screen as below;
[Unit]
Description=LCD Screen
[Service]
Type=simple
User=admin
WorkingDirectory=/lcd
ExecStart=sudo /run_lcd.py
StandardOutput=syslog
...
- 145
0
votes
0
answers
905
views
Systemd service does not print output to console/syslog/journal
UPDATED: SEE BOTTOM
I have created a systemd service on debian Linux with systemd version 241 whose purpose is to start up a compiled accelMonitor.c that connects to a kernel module. This kernel ...
3
votes
1
answer
299
views
How does journald get the very starting up message from kernel?
I believe systemd-journald starts logging after the kernel starts up and need some time to set systems up like storage and network services.
But journal log has the kernel messages like dmesg has even ...
- 143
0
votes
1
answer
434
views
How to prevent journald from writing to console?
When I check my Centos Stream 9 console, I see messages written by journald to the console even before logging in. Above are some example messages.
How can I prevent journald from witing ANY message ...
- 98
1
vote
0
answers
7k
views
systemd-journal is using 100% cpu
This is the result of top command
I caught it at 99.7% but It even uses 170%. this is the output of journalctl
I thought it is something related to Bluetooth, so I turned it off but still got the ...
- 319
2
votes
0
answers
458
views
/dev/log: Connection refused after boot, but only on one system
I have two systems running NVIDIA jetpack 5.0.2, based on Ubuntu 20.04. /etc and /boot are identical on both systems. On the first system, after boot, if I try to run logger I get an error /dev/log: ...
- 211
8
votes
1
answer
596
views
Firefox spamming SECCOMP events to journal/syslog - how to fix?
Since I updated to the snap-based Firefox on Ubuntu recently, I see it reporting SECCOMP_RET_TRAP messages to the journal whenever some application is drawing a canvas.
And since applications drawing ...
- 134
0
votes
1
answer
282
views
Why does journaltcl logs start only today when the last reboot was done 5 days before?
Why does journaltcl logs start only today when the last reboot was done 5 days before ? :
$ journalctl -e | grep Logs.begin
-- Logs begin at Tue 2022-09-06 09:42:37 CEST, end at Tue 2022-09-06 11:04:...
- 2,041
2
votes
0
answers
621
views
WSL service logging like journald
I am running a WSL instance on my machine which starts a bunch of services like atd. What I would like to have is to have an ability to lookup the logs of a specific service like I would do using ...
- 133
2
votes
1
answer
612
views
How to display echo messages from a systemd-timer script in journalctl?
I run via a systemd timer a shell script that starts some programs (they display some output) and uses echo to provide some feedback.
root@srv ~ [127]# cat /etc/systemd/system/borg.timer
[Unit]
...
- 1,465
0
votes
0
answers
1k
views
Failed to get D-Bus connection: No such file or directory when systemctl is run from docker as a non-root user
I am trying to run a centos+python3 based docker container as a non-root user and then trying to get the systemctl status of a host service from the container.
docker run --user=3001:3001 --userns=...
- 1
4
votes
4
answers
5k
views
How to keep systemd journal for one year?
By default my system had about ~500MB max size which had about 1 month of logs.
System Journal (/var/log/journal/dd35c7606a5645c5acc9908470c45159) is 483.2M, max 491.5M, 8.2M free.
No idea how the ...
- 4,367
2
votes
2
answers
766
views
How to disable log duplication with systemd-journald
I just installed a raspberry pi with debian bullseye and I noticed that /var/log has both the traditional log files in text format, such as kern.log, daemon.log, and syslog, as well as the new ...
- 161
2
votes
1
answer
898
views
Can a single unix domain socket connect to multiple peers simultaneously?
Since this is the socket that syslog's /dev/log is symlinked to, I expect there is at least one listening socket from systemd-journald, and possibly some additional connected ones, with different &...
- 545
3
votes
2
answers
339
views
How to follow systemd journald logs for template units that come and go (i.e. socket-activated units)?
I have a inetd-style service deployed as a systemd socket unit and its accompanying service unit, say, my-service.socket with Accept=true and my-[email protected].
Each time a new connection is ...
1
vote
1
answer
293
views
What causes journal logs to end with tilde (~)? [duplicate]
Many of my journal log files consistently are named ending with tilde, e.g. -
/var/log/journal/dc104498c02e4392903c4b68c856a662 $ ls -ltrh
total 768M
-rw-r-----+ 1 root systemd-journal 8.0M Jun 11 11:...
- 113
2
votes
1
answer
3k
views
systemd: my service stopped working with code=killed
My service has suddenly stopped working, systemctl status reports:
Main PID: 5459 (code=killed, signal=TERM)
Also, I checked through journald for my service (journalctl -u myservice.service) and the ...
- 1,783
8
votes
3
answers
13k
views
How can journald be disabled?
I've recently learned that journalctl is occupying a big chunk of my 16GB SD card (Raspberry Pi):
$ journalctl --disk-usage
Archived and active journals take up 312.1M in the file system.
I don't ...
- 2,765
2
votes
0
answers
713
views
Reducing flash wear from Systemd Journald (embedded device)
I'm experimenting with Systemd and in particular Journald on a Yocto Poky (Linux) based embedded device with eMMC storage but I'm worried about flash wear since the write stats are excessively high as ...
- 71