Questions tagged [systemd-journald]

journald is part of systemd and responsible for collecting system logs

Filter by
Sorted by
Tagged with
1
vote
1answer
27 views

How to see logs between right before midnight to right after?

I am trying to see what was logged on my system between "right before midnight" (so the last moments of yesterday), to right afterwards. ~ # journalctl --since "2019-09-09 23:59" --until "2019-09-10 ...
4
votes
1answer
4k views

Why does journalctl say “— no entries --”?

For example: ┌─[10:50:38/hypership/root/~] └─╼ journalctl -b No journal files were found. -- No entries -- ┌─[10:50:46/hypership/root/~] └─╼ journalctl --verify No journal files were found. /var/...
2
votes
1answer
1k views

Does journalctl give access to all logs?

In my university we studied about rsyslog, and how it stores logs and where it stores them (/var/log/), and how to configure it ... Now, I learned (by surfing on the internet) that a new way of ...
206
votes
10answers
223k views

How to clear journalctl

I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so? Let's say I was experimenting with something and my logs got cluttered with various ...
3
votes
1answer
3k views

Is it possible to reduce systemd-journald size stored format (and thus size)?

I'm using systemd on raspberrypi machine with yocto based system. Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of rsyslog completely in favour of of ...
4
votes
1answer
2k views

Reloading systemd-journald config

Not sure why this is happening. I have a test service logging some arbitrary text to stdout every 10 seconds. Here is my service file /etc/systemd/system/samplego.service: [Unit] Description=Sample ...
1
vote
2answers
729 views

How to configure journald to discard entries older than a certain time span

From the documentation I know that I can configure the time after which journal files are deleted via MaxRetentionSec. the time after which journal files are rotated via MaxFileSec. However my goal ...
1
vote
1answer
962 views

clamd randomly stops

I am using clamav in conjuction with c-icap to filter content with squid. I am also using the safebrowsing functionality of clamav to block access to bad domains. For some reason or another, clamav (...
78
votes
2answers
108k views

How do I display log messages from previous boots under CentOS 7?

Executing journalctl under a CentOS 7 system just prints messages generated after the last boot. The command # journalctl --boot=-1 prints Failed to look up boot -1: Cannot assign requested ...
0
votes
1answer
21 views

Can't see previous boot journal log

I found that CentOS/Redhat will not store systemd-journal log to disk, Ubuntu will. For CentOS/Redhat, each time I reboot, the journal log were removed ( it seems write to tmpfs only ) Why CentOS/...
1
vote
0answers
47 views

Auditd, syslog and journald

I have been investigating about these 3 logging solutions, but still there are thing that unclear to me. According to the things i read, auditd audits events in the kernel and it has very deep and ...
1
vote
0answers
13 views

systemd: repeated vacuum cleaning looks like dry run

I'm trying to remove all log records for particular unit but there always seems to be 8M of log. Why? root@lian:midenok# jctl -u networking --rotate --vacuum-time=1s Vacuuming done, freed 0B of ...
3
votes
0answers
35 views

How to get the current systemd-journald running configuration?

I'd like to get the current configuration of journald, similarly to question How to view systemd's runtime global config? How can I do this? Specifically, I have set some of the available ...
1
vote
0answers
25 views

Emergency mode using some kernels in CentOS

I did some mistake of fiddling with an old VirtualBox installation, trying to build kernel modules. I got rid of dkms. Still, I have the strange problem that the two latest kernel I have results in ...
1
vote
1answer
258 views

Getting systemd service logs faster from my service

I'm having a systemd service defined as follows, that works fine: [Unit] Description=my service After=network.target [Service] User=myuser Group=mygroup WorkingDirectory=/home/myuser/myapp ...
0
votes
0answers
19 views

journalctl: show messages from the last (current) instance of a systemd unit

I would like to process log of the last instance (which is usually still running) of a systemd unit. This unit gets restarted from outside under certain conditions, logs from previous runs are not ...
2
votes
2answers
401 views

How to get the current _BOOT_ID in journald

How to obtain the current value of _BOOT_ID in systemd-journald? I can do something ugly such like: journalctl -o verbose --since '2016-05-17' | egrep '^[ ]+_BOOT_ID' | tail -n 1| cut -d"=" -f2 Is ...
1
vote
0answers
43 views

What causes log output to the active console?

I'm running Manjaro ARM 64bit on a Raspberry Pi (more specific question there), but this question is more general: Which settings might cause log output to be always displayed on the active console? I ...
1
vote
2answers
3k views

How to read *.journal files in Fedora 21?

I want to see the previous dmesg log before the reboot. In previous versions of fedora, It used to be in /var/log/messages. But from Fedora 20, it's being stored through systemd i.e. journalctl. I've ...
0
votes
0answers
28 views

Can I redirect logs from journald inside container to docker logs?

I have a container using systemd inside it. The command into the container is /usr/sbin/init. This is a requirement so I cannot change that. I also have a custom service running inside that container ...
9
votes
4answers
8k views

How to configure fail2ban with systemd journal?

I've install fail2ban on Debian Jessie LXC container, currently it's failing due to: Starting authentication failure monitor: fail2ban ERROR No file(s) found for glob /var/log/auth.log ERROR Failed ...
0
votes
1answer
40 views

Restart systemd service if no log produced in timeout

Is it possible to monitor systemd service (unit), if it produces logs, and if no log is produced in (lets say 5 minutes), restart the service?
0
votes
0answers
28 views

Is there a tool that feeds journalctl log updates to the program of your choice?

I have a log processing tool that takes lines in stdin and does some sort of processing that I need. Currently my application does log rotation so that it archives log file according to certain ...
0
votes
0answers
15 views

What does journal hostname field refer to?

I have a question about hostname field that journalctl displays. From journalctl documentation I know that _hostname= is displaying the name of the originating host. So in that case this log: march ...
0
votes
0answers
77 views

Systemd playing sound (service Linux)

I have this service, running on Xubuntu. [Unit] Description= Controller After=graphical.target [Service] ExecStart=/usr/bin/controller StandardInput=tty-force StandardOutput=journal Restart=always ...
11
votes
2answers
1k views

How to configure per-unit log storage policy with journald?

I have one particular service, that logs rare, but important information. I've set it up few months ago, and today I've run journalctl -n 50 --unit=my-service only to find there are no entries. I'm ...
0
votes
0answers
87 views

How to mount a partition's subdirectory for /var/log/journal?

Our server (Ubuntu 18) has a large partition mounted as /publish/data (its a VM, provided as IaaS so that is how it is mounted when extra disk space is requested), it is defined in fstab as follows: /...
4
votes
0answers
565 views

Remove single line from journalctl file

I have an Ubuntu 18.04 server that is running a service I'm developing. The output is being sent to the system journal for logging. I accidentally failed to sanitize some logging and a plaintext ...
18
votes
2answers
26k views

Where does `logger` log its messages to in Arch Linux?

The logger command logs an entry via syslog, which usually puts that line to some file like /var/log/messages. If I understand the documentation correctly in Arch Linux all the logging is done ...
0
votes
1answer
54 views

prevent systemd / journald from logging socket-calls

I just set up a new server (OpenSuse Leap 15.0) and installed the Check_MK-Agent. Every time my Check_MK-Servers polls this agent, this socket-access ist logged: Apr 14 20:05:26 static systemd[1]: ...
2
votes
1answer
275 views

Journald Storage=persistent - Just disk or RAM & disk

I am trying to understand what journald does in relation to persistent storage of log entries. I have an SDCard setup so I am looking to keep disk writes to a minimum, but would like some persistence ...
2
votes
1answer
514 views

How should I manage the logs from my own systemd services?

I have deployed a couple of daemons on ubuntu boxes and wrapped them as systemd services. Their standard output is redirected to the journal by default which is what I was hoping for. Now, it turns ...
2
votes
2answers
304 views

Relation between systemd service names and journald entries

Example [from Ubuntu 17.04] The service is known as network-manager by systemd. $ systemctl list-unit-files | grep network network-manager.service enabled Looking for log ...
3
votes
0answers
111 views

Customize journald config for a single service

I have a service (systemd unit) that logs very long messages (~700K), which means that the default LineMax setting of 48K doesn't suffice. Setting the LineMax field to 1M in /etc/systemd/journald....
4
votes
3answers
16k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
-1
votes
1answer
187 views

How to let a specific group have read-access to systemd's journal?

How do I grant read-only permission to somegroup to read the system journal? (I'm on Debian10 buster). $ journalctl Hint: You are currently not seeing messages from other users and the system. ...
0
votes
1answer
60 views

Use journalctl to show logs of specific unit which has a parameter?

I have one systemd service which runs with systemctl --user start test_unit@random_arguments. How could I use journalctl to filter all logs of test_unit? If it supports "follow mode", that's even ...
4
votes
3answers
12k views

How to get see error message in journald

I've created a program that intentionally has an divide by zero error. If I run it in the command line it returns: "Floating point exception" But if I run this as a systemd service I can not see ...
4
votes
2answers
433 views

systemd: lie about process name using sh -c exec idiom

I'm using the sh -c exec idiom in an ExecStart statement (in a service unit file) to interpolate some shell commands. For example: ExecStart=/bin/sh -ec "exec /usr/bin/foo $(/usr/bin/foo-config)" It ...
1
vote
0answers
33 views

journald flooded by kernel messages

My journald log was at some point filled up with kernel messages like this. Mar 12 05:03:53 workstation.mydomain kernel: FAT-fs (sdd1): FAT read failed (blocknr 1785) Each followed by a message ...
1
vote
1answer
43 views

Can be the journal path on a filesystem other than /?

I would like to store the default journal directory /var/log/journal/ on a mounted device, but I am not sure if I can do it due to the fact that journal is an important service which may already run ...
0
votes
1answer
104 views

How to append systemd service logs to the journal

I am trying to control a continuously running license server on a workstation using systemd. The service itself is started by a shell script, which is essentially Usage: ./rlm_control.sh {start|stop|...
1
vote
1answer
81 views

Can a UBIFS be set as ACL?

Running Debian Buster on Kernel 4.20.17 with systemd 241: +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 ...
0
votes
1answer
150 views

journald socket buffering for option ForwardToSyslog

I have a configuration in which journald is set with ForwardToSyslog=yes. Quote from the documentation: If forwarding to syslog is enabled but nothing reads messages from the socket, ...
4
votes
3answers
3k views

Redirecting stderr and stdout separately to a function in a bash script

I'm working on a wrapper script to log cronjob output to journald. I have several goals: must log stderr and stdout to journald with different priority levels and prefix-tags must also output stderr ...
0
votes
1answer
173 views

Default Interactive TTY prints daemon output

I work for a company that deploys clustered products using coreos and docker, and as part of our deployment, we automatically start up a few docker containers to expose, among others, a web interface ...
1
vote
1answer
49 views

change the name of the journal files in /var/log/journal/remote coming from /var/log/journal/upload

I have several hosts using systemd-journal-upload to send their logs to my systemd-journal-remote server. The name of the files in /var/log/journal/remote are remote-[IP_ADDR].journal but I'd like ...
2
votes
2answers
495 views

How can I view journalctl logs by unit and identifier with one command?

I have a vpn service unit for which I can view the logs with... journalctl -u vpn I also have a script that interacts with the vpn manually and is logged to journal with... exec > >(systemd-...
4
votes
1answer
50 views

How do I work out which process/service/program is sending systemd dbus messages?

Currently my systemd journal is filling up with messages of the form: Feb 01 16:40:31 host systemd[1]: Got message type=method_call sender=:1.58666 destination=org.freedesktop.systemd1 object=/org /...
3
votes
1answer
1k views

The Systemd Journald use too much memory and don't respect SystemMaxUse and RuntimeMaxUse?

I found the systemd-journald takes like 1GB+ of memory. After some searching I set the value of SystemMaxUse and RuntimeMaxUse both to 8M in "/etc/systemd/journald.conf". Then restart the journald. ...