Questions tagged [systemd-journald]

journald is part of systemd and responsible for collecting system logs

Filter by
Sorted by
Tagged with
9
votes
2answers
4k views

How to determine exactly why Systemd enters emergency mode

My desktop computer running Debian Jessie started dropping into an emergency mode shell on every boot up. The screen says to use journalctl -xb to find the reason, and to use systemctl default to ...
5
votes
3answers
13k views

How to get kernel boot log with journalctl?

I have a systemd/journald running on my board. The system was built by means of yocto; systemd version is 216. What I want to get is a kernel boot log, which can be obtained with journalctl -k. But ...
4
votes
0answers
306 views

systemd stdout logging for long lines

systemd appears to split very long log lines in multiple log messages: $ journalctl -u myunit Nov 12 08:00:18 ovh7 uwsgi[32441]: SHORT LINE Nov 12 08:00:18 ovh7 uwsgi[32441]: START of VERY VERY LONG ...
1
vote
1answer
2k views

Configure systemd journald to both forward and store in persistent journal?

With systemd some things changed. So instead of tailing a specific file, I could now use journalctl to access the journal. However, in /etc/systemd/journald.conf under [Journal] the option Storage=...
1
vote
0answers
62 views

Accessing a systemd journal of an offline systemd instance

TL;DR: how to access the systemd journal of an offline systemd instance. So I am migrating some machines over to Ubuntu 16.04 now from the previous LTS version. This means everything is now based on ...
9
votes
2answers
9k views

How do I restore `/dev/log` in systemd+rsyslog host?

On RHEL7, systemd-journald takes over many of the responsibilites of what was once done by rsyslogd. Whether by bug or conflict between these two daemons, sometimes /dev/log will go missing. As a ...
1
vote
2answers
766 views

Detect if program should log to systemd journal or stdout

I am updating a suite of programs for RHEL7, some c++, some java. If they're started as systemd services I would like them to write to the systemd journal. If they're run directly at the terminal, say ...
2
votes
0answers
654 views

Why is systemd-journald doing some massive disk writes?

For some reason my computer shut down recently. I have also fairly recently done a pacman -Syu to upgrade all the things. However, now systemd-journald is doing a massive amount of disk writes - like ...
10
votes
2answers
1k views

How to configure per-unit log storage policy with journald?

I have one particular service, that logs rare, but important information. I've set it up few months ago, and today I've run journalctl -n 50 --unit=my-service only to find there are no entries. I'm ...
3
votes
1answer
327 views

Can we specify percentage value for RuntimeMaxUse attribute in journald.conf

From man page of Journald.conf I came to know that, by default Journal use 10% of file system size for storing journal files. I have configured below values in journald.conf. RuntimeMaxUse=10 #...
5
votes
2answers
371 views

How to fix unit attribution of last lines of systemd logging before exit?

I have a systemd service which logs to stdout. From there, systemd captures STDOUT and writes it to the journal. I use a common idiom for handling an error where I echo some diagnostics, then exit ...
4
votes
2answers
389 views

systemd: lie about process name using sh -c exec idiom

I'm using the sh -c exec idiom in an ExecStart statement (in a service unit file) to interpolate some shell commands. For example: ExecStart=/bin/sh -ec "exec /usr/bin/foo $(/usr/bin/foo-config)" It ...
4
votes
0answers
3k views

Why does journalctl say “— no entries --”?

For example: ┌─[10:50:38/hypership/root/~] └─╼ journalctl -b No journal files were found. -- No entries -- ┌─[10:50:46/hypership/root/~] └─╼ journalctl --verify No journal files were found. /var/...
3
votes
0answers
215 views

filter journalctl output, preserve color [duplicate]

I am using journalctl to watch the system by journalctl -f -p 4, but I'd like to grep-out some information. This works: journalctl -f -p 4|grep -v "maximal mount", but grep discards any color info, a ...
2
votes
2answers
363 views

How to get the current _BOOT_ID in journald

How to obtain the current value of _BOOT_ID in systemd-journald? I can do something ugly such like: journalctl -o verbose --since '2016-05-17' | egrep '^[ ]+_BOOT_ID' | tail -n 1| cut -d"=" -f2 Is ...
1
vote
1answer
121 views

Store messages from previous boots while keeping immediate log output

As this answer suggests, the way to enable storing logs across boots is: # mkdir /var/log/journal # systemd-tmpfiles --create --prefix /var/log/journal # systemctl restart systemd-journald But when ...
4
votes
1answer
744 views

In journald, why are some sshd log entries not attributed to ssh.service

When using journalctl to inspect my journald logs the output from the commands journalctl -u ssh.service and journalctl _COMM=sshd differ. The first command produces just a subset of the log ...
16
votes
2answers
12k views

How do I clear journalctl entries for a specific unit only?

I spent a few days writing a python script, and creating a systemd unit file for it. During testing, the script logged a lot of errors to journald. I would like to clear those errors from journald now ...
3
votes
0answers
569 views

How would I limit users' sudo permissions for journalctl to a specific unit?

I want to provide our users access to journalctl of a specific unit. For e.g., httpd. My initial thought was to specify the command spec like this: /usr/bin/journalctl -u httpd.service * This will ...
7
votes
4answers
8k views

How to configure fail2ban with systemd journal?

I've install fail2ban on Debian Jessie LXC container, currently it's failing due to: Starting authentication failure monitor: fail2ban ERROR No file(s) found for glob /var/log/auth.log ERROR Failed ...
1
vote
0answers
741 views

Filter logs with journald

A monitoring service that executes every minute requires sudo. With this my logs are full of pam_unix entries, telling me that this service logged in with sudo. Now that I have journald on this ...
4
votes
0answers
2k views

Why does my user's login cause systemd to use up a CPU?

Recently I asked this question and this one about systemd and a few related processes using 100% CPU just 5 minutes after every boot. I have a quadcore Intel processor, each core has two virtual ...
42
votes
2answers
30k views

How to tell journald to re-read its configuration?

My question is simple: how do I tell journald to re-read its configuration file without rebooting? I've made some changes to /etc/systemd/journald.conf and I'd like to see if they are correct and ...
1
vote
1answer
1k views

How can I see all journald entries in Centos 7?

From what I have learned, Centos 7 (by default) keeps log journal entries in memory only so these are lost when machine is rebooted. I'm comfortable with the fact that I can only see messages from ...
0
votes
1answer
238 views

Remove header in journalctl results

Sample Command run on RHEL 7: $ journalctl -n1 -- Logs begin at Tue 2015-09-29 17:44:38 PDT, end at Thu 2015-10-22 10:51:35 PDT. -- Oct 22 10:46:00 linuxdev sshd[9730]: pam_unix(sshd:session): ...
5
votes
2answers
4k views

script can't write to systemd journal

to make it short: I want to write to the systemd journal from a script. printf "%s\n%s\n%s\n" CODE_FILE=/etc/zsh/zprofile CODE_LINE=31 MESSAGE="could not read /etc/dircolors" | logger --journald ...
12
votes
1answer
3k views

How to avoid /usr/bin/env being marked in systemd logs as the executable

I've created a systemd service to run a tomcat application based on the information found in this article. The short version of the article recommends avoiding the shell script wrappers, and executing ...
8
votes
3answers
27k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However I am receiving the logs inside ...
0
votes
1answer
2k views

Wrong timestamp in systemd log

I read systemd log of my home server using journalctl and I've noticed that the timestamp of log is totally out of order. Here's some logs from my server using journalctl -o=short-iso --since=...
1
vote
2answers
3k views

How to read *.journal files in Fedora 21?

I want to see the previous dmesg log before the reboot. In previous versions of fedora, It used to be in /var/log/messages. But from Fedora 20, it's being stored through systemd i.e. journalctl. I've ...
22
votes
1answer
22k views

Howto inspect systemd system.journal from another system

I have arch linux failing on a device. The device doesn't have any screen, it doesn't respond to network. So I take its SD card, insert it in ubuntu desktop, see a fresh system.journal there and... ...
1
vote
1answer
288 views

How do I get xconsole to show the messages on a system with journald?

I would like an old style xconsole on my desktop, ie a terminal which display a scrolling list of syslog message. Does the journald system have a nice desktop app or is there a simple way to get it ...
6
votes
2answers
5k views

Rsyslog `logger` message duplicated

I just had a problem with rsyslog's imjournal module, possibly the issue described here, whereby complications with systemd's journal cause the journal to return the same data endlessly in a tight ...
1
vote
1answer
823 views

Configure systemd-journal-gateway on CentOS7

I installed systemd-journal-gatewayd on CentOS7 and started it. If I connect to the given port the HTTP server is answering but the response is always emtpy. Neither /entries?follow nor /entries?boot ...
8
votes
1answer
4k views

Why is my systemd journal not persistent across reboots?

I'm experiencing a very weird issue with a fresh Fedora 21 image on a Linode instance. I cannot reproduce it outside of Linode. The issue is that my systemd journal is not persistent across reboots. ...
5
votes
3answers
7k views

How can I get a list of login attempts with journalctl?

According to the systemd docs, journalctl is recommended for browsing logs, rather than the /var/log/* file tree. While man 1 journalctl describes how to use it, I still don't know what arguments it ...
3
votes
0answers
1k views

Should I use separate log files or log everything to the journal?

On my personal server I currently have multiple services (web server, mail server, etc) and some of them have their own log files while others log everything to stdout and that gets picked up by the ...
3
votes
1answer
1k views

How can I change the save location of the system journal?

(for an Arch Linux system) Is it possible to change the storage location of the system journal to a specific directory?
10
votes
1answer
13k views

How to direct the journal output of certain units to a particular file?

I've got a system with several daemons running (as systemd units) that output log information to the journal in Arch Linux. I want to direct the journal output of some of those unit files into a ...
6
votes
1answer
7k views

Output of a python script running as unit is out of order while shells seems unnafected

How would I get all outputs of systemd managed python2 script instantly into journal, just like it appears in terminal I'm on centos 7, but seems to be same on arch according to systemd manual, ...
76
votes
2answers
105k views

How do I display log messages from previous boots under CentOS 7?

Executing journalctl under a CentOS 7 system just prints messages generated after the last boot. The command # journalctl --boot=-1 prints Failed to look up boot -1: Cannot assign requested ...
2
votes
1answer
969 views

Missing systemd journal log

While reviewing my journal log, I find that only logs for the recent three days are present. There is only 8 lines worth of log from between September 19 and 27: # journalctl --since="2014-09-19" --...
2
votes
1answer
6k views

How to surpress audit daemon rotating log messages?

On a CentOS 7 system messages like these are logged several times a day: Sep 24 00:11:42 example.org auditd[756]: Audit daemon rotating log files Sep 24 00:26:23 example.org auditd[756]: Audit daemon ...
2
votes
1answer
554 views

How to determine a log's source process spawned from a systemd service?

I have a systemd service which starts multiple 3rd-party processes which output to standard output. Is there anyway to easily determine which logs are from specific process from the system journal? ...
1
vote
1answer
930 views

clamd randomly stops

I am using clamav in conjuction with c-icap to filter content with squid. I am also using the safebrowsing functionality of clamav to block access to bad domains. For some reason or another, clamav (...
189
votes
9answers
209k views

How to clear journalctl

I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so? Let's say I was experimenting with something and my logs got cluttered with various ...
7
votes
1answer
4k views

How to get access to the root journal for systemd?

When I execute journalctl -f -a under Fedora 20 for different users I get different results. For root I get something similar to tail -f /var/log/syslog on older systems. As normal user I get gnome-...
1
vote
1answer
561 views

journalctl process groups

I recently tried setting up the ChrootDirectory property in sshd_config and ran into the ownership problems for chroot targets. After i have fixed the problem i noticed that syslog-ng had created log ...
4
votes
3answers
16k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
18
votes
2answers
26k views

Where does `logger` log its messages to in Arch Linux?

The logger command logs an entry via syslog, which usually puts that line to some file like /var/log/messages. If I understand the documentation correctly in Arch Linux all the logging is done ...