Questions tagged [systemd-journald]

journald is part of systemd and responsible for collecting system logs

59 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
1answer
47 views

How do I work out which process/service/program is sending systemd dbus messages?

Currently my systemd journal is filling up with messages of the form: Feb 01 16:40:31 host systemd[1]: Got message type=method_call sender=:1.58666 destination=org.freedesktop.systemd1 object=/org /...
4
votes
0answers
533 views

Remove single line from journalctl file

I have an Ubuntu 18.04 server that is running a service I'm developing. The output is being sent to the system journal for logging. I accidentally failed to sanitize some logging and a plaintext ...
4
votes
0answers
310 views

systemd stdout logging for long lines

systemd appears to split very long log lines in multiple log messages: $ journalctl -u myunit Nov 12 08:00:18 ovh7 uwsgi[32441]: SHORT LINE Nov 12 08:00:18 ovh7 uwsgi[32441]: START of VERY VERY LONG ...
4
votes
0answers
4k views

Why does journalctl say “— no entries --”?

For example: ┌─[10:50:38/hypership/root/~] └─╼ journalctl -b No journal files were found. -- No entries -- ┌─[10:50:46/hypership/root/~] └─╼ journalctl --verify No journal files were found. /var/...
4
votes
0answers
2k views

Why does my user's login cause systemd to use up a CPU?

Recently I asked this question and this one about systemd and a few related processes using 100% CPU just 5 minutes after every boot. I have a quadcore Intel processor, each core has two virtual ...
3
votes
0answers
29 views

How to get the current systemd-journald running configuration?

I'd like to get the current configuration of journald, similarly to question How to view systemd's runtime global config? How can I do this? Specifically, I have set some of the available ...
3
votes
0answers
102 views

Customize journald config for a single service

I have a service (systemd unit) that logs very long messages (~700K), which means that the default LineMax setting of 48K doesn't suffice. Setting the LineMax field to 1M in /etc/systemd/journald....
3
votes
0answers
106 views

journalctl log disappear?

Service is still active: systemctl -l status foo.service ● foo.service - My Foo service Loaded: loaded (/etc/systemd/system/foo.service; static; vendor preset: disabled) Active: activating (...
3
votes
0answers
374 views

systemd-journald: Missed 685 kernel messages

At boot and some other times I see missed kernel logs on my system. After that I set Rate limits at jornald.conf but no luck. I still have the issue. Do you have any advice? Kernel: 4.14.19-1-lts ...
3
votes
0answers
3k views

systemd Journal Service takes two hours to start

I have a relatively fresh debian install on which I changed the hostname in /etc/hostname. It gives me the following message during boot: [ 7406.882872] systemd[1]: Starting Journal Service... [ 7406....
3
votes
0answers
169 views

pam_winbind is logging passwords

Occasionally, a systemd unit using a pam module that uses pam_winbind logs a users password. Systemd unit log: Mar 25 15:47:41 display-server node[5969]: pam_succeed_if(grooming:auth): requirement "...
3
votes
1answer
3k views

Is it possible to reduce systemd-journald size stored format (and thus size)?

I'm using systemd on raspberrypi machine with yocto based system. Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of rsyslog completely in favour of of ...
3
votes
0answers
598 views

How would I limit users' sudo permissions for journalctl to a specific unit?

I want to provide our users access to journalctl of a specific unit. For e.g., httpd. My initial thought was to specify the command spec like this: /usr/bin/journalctl -u httpd.service * This will ...
3
votes
0answers
1k views

Should I use separate log files or log everything to the journal?

On my personal server I currently have multiple services (web server, mail server, etc) and some of them have their own log files while others log everything to stdout and that gets picked up by the ...
2
votes
0answers
914 views

Why do “journalctl --disk-usage” and “journalctl | wc” not correspond well?

TL;DR how comes that journald stores about 770 MiB while displaying the logs only yields 90MiB of data? #UPDATE# I did a journalctl -a -o verbose which at least yielded some 530MiB, yet less than ...
2
votes
0answers
155 views

Why journalctl outputs in ASCII?

I have a regular Ubuntu 16.04 server VM. My locale is set up to utf-8 everywhere: $ locale LANG=en_US.UTF-8 LANGUAGE= LC_CTYPE="en_US.UTF-8" LC_NUMERIC="en_US.UTF-8" LC_TIME="en_US.UTF-8" LC_COLLATE="...
2
votes
0answers
203 views

flink systemctl faild to start

Hi i want to create systemctl service to tun flink local server . I can run it directly from the /bin/start-local.sh But when im using this service definition . [Unit] Description=Apache Flink ...
2
votes
0answers
1k views

systemd-journald with volatile /var/log (poky)

I'm trying to make my journal persistent. Poky (yocto/krogoth) links /var/log to /var/volatile/log by default. I've already removed this mount in fstab and replaced it with an .mount file: [Unit] ...
2
votes
1answer
1k views

Does journalctl give access to all logs?

In my university we studied about rsyslog, and how it stores logs and where it stores them (/var/log/), and how to configure it ... Now, I learned (by surfing on the internet) that a new way of ...
2
votes
1answer
30 views

Systemd logs only 3 lines of errors

I have an error when running command assert.js:81 throw new assert.AssertionError({ ^ AssertionError: APP_API env var not set at Object.<anonymous> (/opt/offero-html-server/src/routes/...
2
votes
1answer
502 views

How should I manage the logs from my own systemd services?

I have deployed a couple of daemons on ubuntu boxes and wrapped them as systemd services. Their standard output is redirected to the journal by default which is what I was hoping for. Now, it turns ...
2
votes
0answers
683 views

Why is systemd-journald doing some massive disk writes?

For some reason my computer shut down recently. I have also fairly recently done a pacman -Syu to upgrade all the things. However, now systemd-journald is doing a massive amount of disk writes - like ...
2
votes
0answers
339 views

smartd custom logfile on systemd + journald based system

An excerpt from smartd manpage reads: -l FACILITY, --logfacility=FACILITY Uses syslog facility FACILITY to log the messages from smartd. Here FACILITY is one of local0, local1, ..., local7, or ...
1
vote
0answers
11 views

systemd: repeated vacuum cleaning looks like dry run

I'm trying to remove all log records for particular unit but there always seems to be 8M of log. Why? root@lian:midenok# jctl -u networking --rotate --vacuum-time=1s Vacuuming done, freed 0B of ...
1
vote
0answers
22 views

Emergency mode using some kernels in CentOS

I did some mistake of fiddling with an old VirtualBox installation, trying to build kernel modules. I got rid of dkms. Still, I have the strange problem that the two latest kernel I have results in ...
1
vote
0answers
32 views

What causes log output to the active console?

I'm running Manjaro ARM 64bit on a Raspberry Pi (more specific question there), but this question is more general: Which settings might cause log output to be always displayed on the active console? I ...
1
vote
0answers
29 views

journald flooded by kernel messages

My journald log was at some point filled up with kernel messages like this. Mar 12 05:03:53 workstation.mydomain kernel: FAT-fs (sdd1): FAT read failed (blocknr 1785) Each followed by a message ...
1
vote
1answer
42 views

Can be the journal path on a filesystem other than /?

I would like to store the default journal directory /var/log/journal/ on a mounted device, but I am not sure if I can do it due to the fact that journal is an important service which may already run ...
1
vote
1answer
45 views

change the name of the journal files in /var/log/journal/remote coming from /var/log/journal/upload

I have several hosts using systemd-journal-upload to send their logs to my systemd-journal-remote server. The name of the files in /var/log/journal/remote are remote-[IP_ADDR].journal but I'd like ...
1
vote
0answers
167 views

automated tool (or script) for cleaning systemd journal of corrupted files?

It is my understanding that the systemd journal cannot repair or fix errors revealed by: journalctl --verify Here's an example of an error I just saw. I routinely see errors like this on all the ...
1
vote
0answers
82 views

journald to rsyslog paging issues

I'm using rsyslog to dump journald entries to a log file so that they can be sent to Logstash. The issue I'm having is that some of the log lines are getting split across two lines. When viewing ...
1
vote
0answers
102 views

Systemd showing partial output in the logs

I want to have output output of iostat printed periodically and logged. Executing the command in the shell prints out the normal fields as expected: # iostat avg-cpu: %user %nice %system %iowait ...
1
vote
1answer
161 views

redundant systemd-journal-remote for systemd-journal-upload instances

I'm using systemd-journal-upload on serveral nodes to forward their journals to a single systemd-journal-remote sink, loghost01: /var/log/journal ├── <foo-bar> │ ├── system.journal │ └── ...
1
vote
2answers
636 views

How to configure journald to discard entries older than a certain time span

From the documentation I know that I can configure the time after which journal files are deleted via MaxRetentionSec. the time after which journal files are rotated via MaxFileSec. However my goal ...
1
vote
0answers
2k views

tmpfs /run full

I have a problem with /run partition, its size NEVER decrease so when it's full, I have to reboot. [root@centos]# df -H Filesystem Size Used Avail Use% Mounted on ... tmpfs 6.4G 6.3G ...
1
vote
0answers
522 views

What causes `Unsupported device type 772 for “lo”`?

Rebooted a RPi, and upon return, I could not access the device's static IP. The cause was Unsupported device type 772 for "lo". michael@pi3:~ $ sudo journalctl -u networking [sudo] password for ...
1
vote
0answers
994 views

How to read from the systemd-journald.socket?

To my understanding systemd-journald creates a couple sockets, where it posts its logging events. # systemctl cat systemd-journald.socket | egrep -v '^ *#' [Unit] Description=Journal Socket ...
1
vote
1answer
418 views

How to journal command after sudo?

How to configure Linux to journal all command entered by a user after they use sudo su - or sudo su - username ?
1
vote
0answers
60 views

Can systemd-journald use network to transmit?

I use systemd-journald and forwards the log messages to rsyslog on my centos host , and then use rsyslog transmit on network . So, Can systemd-journald transmit log message use network?
1
vote
0answers
2k views

journalctl: unrecognized option '--vacuum-size= '

All environment info on my os. debian8@debian:~$ uname -a Linux debian 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u2 (2017-03-07) x86_64 GNU/Linux debian8@debian:~$ systemd --version systemd 215 +PAM ...
1
vote
0answers
63 views

Accessing a systemd journal of an offline systemd instance

TL;DR: how to access the systemd journal of an offline systemd instance. So I am migrating some machines over to Ubuntu 16.04 now from the previous LTS version. This means everything is now based on ...
1
vote
1answer
124 views

Store messages from previous boots while keeping immediate log output

As this answer suggests, the way to enable storing logs across boots is: # mkdir /var/log/journal # systemd-tmpfiles --create --prefix /var/log/journal # systemctl restart systemd-journald But when ...
1
vote
0answers
754 views

Filter logs with journald

A monitoring service that executes every minute requires sudo. With this my logs are full of pam_unix entries, telling me that this service logged in with sudo. Now that I have journald on this ...
1
vote
1answer
943 views

clamd randomly stops

I am using clamav in conjuction with c-icap to filter content with squid. I am also using the safebrowsing functionality of clamav to block access to bad domains. For some reason or another, clamav (...
1
vote
1answer
1k views

How can I see all journald entries in Centos 7?

From what I have learned, Centos 7 (by default) keeps log journal entries in memory only so these are lost when machine is rebooted. I'm comfortable with the fact that I can only see messages from ...
0
votes
0answers
30 views

Auditd, syslog and journald

I have been investigating about these 3 logging solutions, but still there are thing that unclear to me. According to the things i read, auditd audits events in the kernel and it has very deep and ...
0
votes
0answers
17 views

journalctl: show messages from the last (current) instance of a systemd unit

I would like to process log of the last instance (which is usually still running) of a systemd unit. This unit gets restarted from outside under certain conditions, logs from previous runs are not ...
0
votes
0answers
20 views

Can I redirect logs from journald inside container to docker logs?

I have a container using systemd inside it. The command into the container is /usr/sbin/init. This is a requirement so I cannot change that. I also have a custom service running inside that container ...
0
votes
1answer
36 views

Restart systemd service if no log produced in timeout

Is it possible to monitor systemd service (unit), if it produces logs, and if no log is produced in (lets say 5 minutes), restart the service?
0
votes
0answers
25 views

Is there a tool that feeds journalctl log updates to the program of your choice?

I have a log processing tool that takes lines in stdin and does some sort of processing that I need. Currently my application does log rotation so that it archives log file according to certain ...