2012-03-16 02:25:14 +04:00
<?xml version='1.0'?> <!-- * - nxml - * -->
<?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
< !DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<!--
This file is part of systemd.
Copyright 2010 Lennart Poettering
systemd is free software; you can redistribute it and/or modify it
2012-04-12 02:20:58 +04:00
under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation; either version 2.1 of the License, or
2012-03-16 02:25:14 +04:00
(at your option) any later version.
systemd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
2012-04-12 02:20:58 +04:00
Lesser General Public License for more details.
2012-03-16 02:25:14 +04:00
2012-04-12 02:20:58 +04:00
You should have received a copy of the GNU Lesser General Public License
2012-03-16 02:25:14 +04:00
along with systemd; If not, see <http: / / w w w . g n u . o r g / l i c e n s e s /> .
-->
2012-03-31 01:18:33 +04:00
<refentry id= "journald.conf" >
2012-03-16 02:25:14 +04:00
<refentryinfo >
2012-03-31 01:18:33 +04:00
<title > journald.conf</title>
2012-03-16 02:25:14 +04:00
<productname > systemd</productname>
<authorgroup >
<author >
<contrib > Developer</contrib>
<firstname > Lennart</firstname>
<surname > Poettering</surname>
<email > lennart@poettering.net</email>
</author>
</authorgroup>
</refentryinfo>
<refmeta >
2012-03-31 01:18:33 +04:00
<refentrytitle > journald.conf</refentrytitle>
2012-03-16 02:25:14 +04:00
<manvolnum > 5</manvolnum>
</refmeta>
<refnamediv >
2012-03-31 01:18:33 +04:00
<refname > journald.conf</refname>
2012-03-16 02:25:14 +04:00
<refpurpose > Journal service configuration file</refpurpose>
</refnamediv>
<refsynopsisdiv >
2012-06-01 03:05:38 +04:00
<para > <filename > /etc/systemd/journald.conf</filename> </para>
2012-03-16 02:25:14 +04:00
</refsynopsisdiv>
<refsect1 >
<title > Description</title>
2013-07-02 07:44:04 +04:00
<para > This file configures various parameters of the
systemd journal service,
2012-06-01 03:05:38 +04:00
<citerefentry > <refentrytitle > systemd-journald.service</refentrytitle> <manvolnum > 8</manvolnum> </citerefentry> .</para>
2012-03-16 02:25:14 +04:00
</refsect1>
<refsect1 >
<title > Options</title>
<para > All options are configured in the
<literal > [Journal]</literal> section:</para>
<variablelist >
2012-08-21 00:13:22 +04:00
<varlistentry >
<term > <varname > Storage=</varname> </term>
<listitem > <para > Controls where to
store journal data. One of
<literal > volatile</literal> ,
<literal > persistent</literal> ,
<literal > auto</literal> and
<literal > none</literal> . If
2013-07-02 07:44:04 +04:00
<literal > volatile</literal> , journal
2012-08-21 00:13:22 +04:00
log data will be stored only in
memory, i.e. below the
<filename > /run/log/journal</filename>
hierarchy (which is created if
needed). If
2013-07-02 07:44:04 +04:00
<literal > persistent</literal> , data will
2012-08-21 00:13:22 +04:00
be stored preferably on disk,
i.e. below the
<filename > /var/log/journal</filename>
hierarchy (which is created if
needed), with a fallback to
<filename > /run/log/journal</filename>
(which is created if needed), during
early boot and if the disk is not
writable. <literal > auto</literal> is
similar to
<literal > persistent</literal> but the
directory
<filename > /var/log/journal</filename>
is not created if needed, so that its
existence controls where log data
goes. <literal > none</literal> turns
off all storage, all log data received
will be dropped. Forwarding to other
targets, such as the console, the
kernel log buffer or a syslog daemon
will still work however. Defaults to
<literal > auto</literal> .</para> </listitem>
</varlistentry>
2012-03-16 02:25:14 +04:00
<varlistentry >
<term > <varname > Compress=</varname> </term>
<listitem > <para > Takes a boolean
2013-07-02 07:44:04 +04:00
value. If enabled (the default), data
2012-03-16 02:25:14 +04:00
objects that shall be stored in the
journal and are larger than a certain
threshold are compressed with the XZ
compression algorithm before they are
written to the file
system.</para> </listitem>
</varlistentry>
2012-08-21 00:13:22 +04:00
<varlistentry >
<term > <varname > Seal=</varname> </term>
<listitem > <para > Takes a boolean
2013-07-02 07:44:04 +04:00
value. If enabled (the default), and a
2012-08-21 00:13:22 +04:00
sealing key is available (as created
by
<citerefentry > <refentrytitle > journalctl</refentrytitle> <manvolnum > 1</manvolnum> </citerefentry> 's
<option > --setup-keys</option>
2013-12-18 04:40:02 +04:00
command), Forward Secure Sealing (FSS)
2013-06-18 18:25:11 +04:00
for all persistent journal files is
enabled. FSS is based on <ulink
2013-07-16 12:19:00 +04:00
url="https://eprint.iacr.org/2013/397">Seekable
2013-06-18 18:25:11 +04:00
Sequential Key Generators</ulink> by
2013-12-18 04:40:02 +04:00
G. A. Marson and B. Poettering
(doi:10.1007/978-3-642-40203-6_7)
and may be used to protect journal files
from unnoticed alteration.</para> </listitem>
2012-08-21 00:13:22 +04:00
</varlistentry>
2012-09-08 01:40:00 +04:00
<varlistentry >
<term > <varname > SplitMode=</varname> </term>
<listitem > <para > Controls whether to
split up journal files per user. One
of <literal > login</literal> ,
<literal > uid</literal> and
<literal > none</literal> . If
2013-07-02 07:44:04 +04:00
<literal > login</literal> , each logged-in
user will get his own journal
2012-09-08 01:40:00 +04:00
files, but systemd user IDs will log
into the system journal. If
2013-07-02 07:44:04 +04:00
<literal > uid</literal> , any user ID
2012-09-08 01:40:00 +04:00
will get his own journal files
2013-12-26 05:47:43 +04:00
regardless of whether it belongs to a
2012-09-08 01:40:00 +04:00
system service or refers to a real
logged in user. If
2013-07-02 07:44:04 +04:00
<literal > none</literal> , journal files
are not split up by user and all
messages are instead stored in the single
2012-09-08 01:40:00 +04:00
system journal. Note that splitting
2013-07-02 07:44:04 +04:00
up journal files by user is only
available for journals stored
2012-09-08 01:40:00 +04:00
persistently. If journals are stored
2013-07-02 07:44:04 +04:00
on volatile storage (see above), only a
2012-09-08 01:40:00 +04:00
single journal file for all user IDs
is kept. Defaults to
<literal > login</literal> .</para> </listitem>
</varlistentry>
2012-03-16 02:25:14 +04:00
<varlistentry >
<term > <varname > RateLimitInterval=</varname> </term>
<term > <varname > RateLimitBurst=</varname> </term>
<listitem > <para > Configures the rate
limiting that is applied to all
2013-07-02 07:44:04 +04:00
messages generated on the system. If,
2012-03-16 02:25:14 +04:00
in the time interval defined by
2013-07-02 07:44:04 +04:00
<varname > RateLimitInterval=</varname> ,
2012-03-16 02:25:14 +04:00
more messages than specified in
<varname > RateLimitBurst=</varname> are
2013-07-02 07:44:04 +04:00
logged by a service, all further
2012-03-16 02:25:14 +04:00
messages within the interval are
2013-07-02 07:44:04 +04:00
dropped until the interval is over. A
2012-03-16 02:25:14 +04:00
message about the number of dropped
messages is generated. This rate
limiting is applied per-service, so
that two services which log do not
2013-03-14 02:09:49 +04:00
interfere with each other's
2012-11-29 23:06:57 +04:00
limits. Defaults to 200 messages in
2012-03-16 02:25:14 +04:00
10s. The time specification for
<varname > RateLimitInterval=</varname>
may be specified in the following
units: <literal > s</literal> ,
<literal > min</literal> ,
<literal > h</literal> ,
<literal > ms</literal> ,
<literal > us</literal> . To turn off any
kind of rate limiting, set either
value to 0.</para> </listitem>
</varlistentry>
<varlistentry >
<term > <varname > SystemMaxUse=</varname> </term>
<term > <varname > SystemKeepFree=</varname> </term>
<term > <varname > SystemMaxFileSize=</varname> </term>
<term > <varname > RuntimeMaxUse=</varname> </term>
<term > <varname > RuntimeKeepFree=</varname> </term>
<term > <varname > RuntimeMaxFileSize=</varname> </term>
<listitem > <para > Enforce size limits on
the journal files stored. The options
prefixed with
<literal > System</literal> apply to the
journal files when stored on a
2012-06-01 19:56:11 +04:00
persistent file system, more
2012-03-16 02:25:14 +04:00
specifically
<filename > /var/log/journal</filename> . The
options prefixed with
<literal > Runtime</literal> apply to
the journal files when stored on a
volatile in-memory file system, more
specifically
<filename > /run/log/journal</filename> . The
former is used only when
<filename > /var</filename> is mounted,
2013-07-02 07:44:04 +04:00
writable, and the directory
2012-03-16 02:25:14 +04:00
<filename > /var/log/journal</filename>
2013-07-02 07:44:04 +04:00
exists. Otherwise, only the latter
2012-03-16 02:25:14 +04:00
applies. Note that this means that
during early boot and if the
2012-06-01 19:56:11 +04:00
administrator disabled persistent
2013-07-02 07:44:04 +04:00
logging, only the latter options apply,
2012-06-01 19:56:11 +04:00
while the former apply if persistent
2012-03-16 02:25:14 +04:00
logging is enabled and the system is
fully booted
2013-06-25 05:02:16 +04:00
up. <command > journalctl</command> and
<command > systemd-journald</command>
ignore all files with names not ending
with <literal > .journal</literal> or
<literal > .journal~</literal> , so only
such files, located in the appropriate
directories, are taken into account
when calculating current disk usage.
</para>
<para > <varname > SystemMaxUse=</varname>
2012-03-16 02:25:14 +04:00
and <varname > RuntimeMaxUse=</varname>
control how much disk space the
journald: do not free space when disk space runs low
Before, journald would remove journal files until both MaxUse= and
KeepFree= settings would be satisfied. The first one depends (if set
automatically) on the size of the file system and is constant. But
the second one depends on current use of the file system, and a spike
in disk usage would cause journald to delete journal files, trying to
reach usage which would leave 15% of the disk free. This behaviour is
surprising for the user who doesn't expect his logs to be purged when
disk usage goes above 85%, which on a large disk could be some
gigabytes from being full. In addition attempting to keep 15% free
provides an attack vector where filling the disk sufficiently disposes
of almost all logs.
Instead, obey KeepFree= only as a limit on adding additional files.
When replacing old files with new, ignore KeepFree=. This means that
if journal disk usage reached some high point that at some later point
start to violate the KeepFree= constraint, journald will not add files
to go above this point, but it will stay (slightly) below it. When
journald is restarted, it forgets the previous maximum usage value,
and sets the limit based on the current usage, so if disk remains to
be filled, journald might use one journal-file-size less on each
restart, if restarts happen just after rotation. This seems like a
reasonable compromise between implementation complexity and robustness.
2013-11-13 09:42:22 +04:00
journal may use up at maximum.
<varname > SystemKeepFree=</varname> and
2012-03-16 02:25:14 +04:00
<varname > RuntimeKeepFree=</varname>
2013-07-07 07:33:26 +04:00
control how much disk space
journald: do not free space when disk space runs low
Before, journald would remove journal files until both MaxUse= and
KeepFree= settings would be satisfied. The first one depends (if set
automatically) on the size of the file system and is constant. But
the second one depends on current use of the file system, and a spike
in disk usage would cause journald to delete journal files, trying to
reach usage which would leave 15% of the disk free. This behaviour is
surprising for the user who doesn't expect his logs to be purged when
disk usage goes above 85%, which on a large disk could be some
gigabytes from being full. In addition attempting to keep 15% free
provides an attack vector where filling the disk sufficiently disposes
of almost all logs.
Instead, obey KeepFree= only as a limit on adding additional files.
When replacing old files with new, ignore KeepFree=. This means that
if journal disk usage reached some high point that at some later point
start to violate the KeepFree= constraint, journald will not add files
to go above this point, but it will stay (slightly) below it. When
journald is restarted, it forgets the previous maximum usage value,
and sets the limit based on the current usage, so if disk remains to
be filled, journald might use one journal-file-size less on each
restart, if restarts happen just after rotation. This seems like a
reasonable compromise between implementation complexity and robustness.
2013-11-13 09:42:22 +04:00
systemd-journald shall leave free for
other uses.
<command > systemd-journald</command>
will respect both limits and use the
smaller of the two values.</para>
<para > The first pair defaults to 10%
and the second to 15% of the size of
the respective file system. If the
file system is nearly full and either
<varname > SystemKeepFree=</varname> or
<varname > RuntimeKeepFree=</varname> is
violated when systemd-journald is
started, the value will be raised to
percentage that is actually free. This
2014-02-17 06:37:18 +04:00
means that if there was enough
free space before and journal files were
journald: do not free space when disk space runs low
Before, journald would remove journal files until both MaxUse= and
KeepFree= settings would be satisfied. The first one depends (if set
automatically) on the size of the file system and is constant. But
the second one depends on current use of the file system, and a spike
in disk usage would cause journald to delete journal files, trying to
reach usage which would leave 15% of the disk free. This behaviour is
surprising for the user who doesn't expect his logs to be purged when
disk usage goes above 85%, which on a large disk could be some
gigabytes from being full. In addition attempting to keep 15% free
provides an attack vector where filling the disk sufficiently disposes
of almost all logs.
Instead, obey KeepFree= only as a limit on adding additional files.
When replacing old files with new, ignore KeepFree=. This means that
if journal disk usage reached some high point that at some later point
start to violate the KeepFree= constraint, journald will not add files
to go above this point, but it will stay (slightly) below it. When
journald is restarted, it forgets the previous maximum usage value,
and sets the limit based on the current usage, so if disk remains to
be filled, journald might use one journal-file-size less on each
restart, if restarts happen just after rotation. This seems like a
reasonable compromise between implementation complexity and robustness.
2013-11-13 09:42:22 +04:00
created, and subsequently something
else causes the file system to fill
up, journald will stop using more
2014-02-17 06:37:18 +04:00
space, but it will not be removing
journald: do not free space when disk space runs low
Before, journald would remove journal files until both MaxUse= and
KeepFree= settings would be satisfied. The first one depends (if set
automatically) on the size of the file system and is constant. But
the second one depends on current use of the file system, and a spike
in disk usage would cause journald to delete journal files, trying to
reach usage which would leave 15% of the disk free. This behaviour is
surprising for the user who doesn't expect his logs to be purged when
disk usage goes above 85%, which on a large disk could be some
gigabytes from being full. In addition attempting to keep 15% free
provides an attack vector where filling the disk sufficiently disposes
of almost all logs.
Instead, obey KeepFree= only as a limit on adding additional files.
When replacing old files with new, ignore KeepFree=. This means that
if journal disk usage reached some high point that at some later point
start to violate the KeepFree= constraint, journald will not add files
to go above this point, but it will stay (slightly) below it. When
journald is restarted, it forgets the previous maximum usage value,
and sets the limit based on the current usage, so if disk remains to
be filled, journald might use one journal-file-size less on each
restart, if restarts happen just after rotation. This seems like a
reasonable compromise between implementation complexity and robustness.
2013-11-13 09:42:22 +04:00
existing files to go reduce footprint
either.</para>
<para > <varname > SystemMaxFileSize=</varname>
2012-03-16 02:25:14 +04:00
and
<varname > RuntimeMaxFileSize=</varname>
control how large individual journal
files may grow at maximum. This
influences the granularity in which
disk space is made available through
rotation, i.e. deletion of historic
2012-07-15 12:41:40 +04:00
data. Defaults to one eighth of the
2012-03-16 02:25:14 +04:00
values configured with
<varname > SystemMaxUse=</varname> and
<varname > RuntimeMaxUse=</varname> , so
that usually seven rotated journal
2012-10-19 02:56:42 +04:00
files are kept as history. Specify
values in bytes or use K, M, G, T, P,
2013-06-05 01:44:23 +04:00
E as units for the specified sizes
(equal to 1024, 1024²,... bytes).
2013-06-25 05:02:16 +04:00
Note that size limits are enforced
2013-07-07 07:33:26 +04:00
synchronously when journal files are
extended, and no explicit rotation
step triggered by time is
needed.</para> </listitem>
2012-10-17 00:58:07 +04:00
</varlistentry>
<varlistentry >
<term > <varname > MaxFileSec=</varname> </term>
<listitem > <para > The maximum time to
store entries in a single journal
2013-07-02 07:44:04 +04:00
file before rotating to the next
one. Normally, time-based rotation
2012-10-17 00:58:07 +04:00
should not be required as size-based
rotation with options such as
<varname > SystemMaxFileSize=</varname>
should be sufficient to ensure that
2013-07-02 07:44:04 +04:00
journal files do not grow without
2012-10-17 00:58:07 +04:00
bounds. However, to ensure that not
too much data is lost at once when old
2013-07-02 07:44:04 +04:00
journal files are deleted, it might
2012-10-17 00:58:07 +04:00
make sense to change this value from
the default of one month. Set to 0 to
turn off this feature. This setting
takes time values which may be
2013-07-02 07:44:04 +04:00
suffixed with the units
<literal > year</literal> ,
<literal > month</literal> ,
<literal > week</literal> , <literal > day</literal> ,
<literal > h</literal> or <literal > m</literal>
to override the default time unit of
2012-10-17 00:58:07 +04:00
seconds.</para> </listitem>
</varlistentry>
<varlistentry >
<term > <varname > MaxRetentionSec=</varname> </term>
<listitem > <para > The maximum time to
2012-11-06 23:27:38 +04:00
store journal entries. This
2012-10-17 00:58:07 +04:00
controls whether journal files
containing entries older then the
specified time span are
2013-07-02 07:44:04 +04:00
deleted. Normally, time-based deletion
2012-10-17 00:58:07 +04:00
of old journal files should not be
required as size-based deletion with
options such as
<varname > SystemMaxUse=</varname>
should be sufficient to ensure that
2013-07-02 07:44:04 +04:00
journal files do not grow without
2012-10-17 00:58:07 +04:00
bounds. However, to enforce data
2013-07-02 07:44:04 +04:00
retention policies, it might make sense
2012-11-06 23:27:38 +04:00
to change this value from the
2012-10-17 00:58:07 +04:00
default of 0 (which turns off this
2012-11-06 23:27:38 +04:00
feature). This setting also takes
2012-10-17 00:58:07 +04:00
time values which may be suffixed with
2013-07-02 07:44:04 +04:00
the units <literal > year</literal> ,
<literal > month</literal> ,
<literal > week</literal> , <literal > day</literal> ,
<literal > h</literal> or <literal > m</literal>
2012-10-17 00:58:07 +04:00
to override the default time unit of
2013-07-02 07:44:04 +04:00
seconds.</para> </listitem>
2013-03-25 20:49:03 +04:00
</varlistentry>
<varlistentry >
<term > <varname > SyncIntervalSec=</varname> </term>
2013-07-24 10:08:57 +04:00
<listitem > <para > The timeout before
synchronizing journal files to
disk. After syncing, journal files are
placed in the OFFLINE state. Note that
syncing is unconditionally done
immediately after a log message of
priority CRIT, ALERT or EMERG has been
2013-08-05 03:13:28 +04:00
logged. This setting hence applies
2013-07-24 10:08:57 +04:00
only to messages of the levels ERR,
WARNING, NOTICE, INFO, DEBUG. The
default timeout is 5 minutes.
2013-03-25 20:49:03 +04:00
</para> </listitem>
2012-03-16 02:25:14 +04:00
</varlistentry>
<varlistentry >
<term > <varname > ForwardToSyslog=</varname> </term>
<term > <varname > ForwardToKMsg=</varname> </term>
<term > <varname > ForwardToConsole=</varname> </term>
<listitem > <para > Control whether log
messages received by the journal
daemon shall be forwarded to a
traditional syslog daemon, to the
kernel log buffer (kmsg), or to the
system console. These options take
boolean arguments. If forwarding to
syslog is enabled but no syslog daemon
2013-07-02 07:44:04 +04:00
is running, the respective option has
no effect. By default, only forwarding
2012-03-16 02:25:14 +04:00
to syslog is enabled. These settings
2012-08-09 17:57:24 +04:00
may be overridden at boot time with
the kernel command line options
2012-06-22 03:35:52 +04:00
<literal > systemd.journald.forward_to_syslog=</literal> ,
<literal > systemd.journald.forward_to_kmsg=</literal>
2012-03-16 02:25:14 +04:00
and
2012-08-09 17:57:24 +04:00
<literal > systemd.journald.forward_to_console=</literal> .
2014-02-16 03:10:36 +04:00
When forwarding to the console, the
2014-02-18 00:34:20 +04:00
TTY to log to can be changed
2014-02-16 03:10:36 +04:00
with <varname > TTYPath=</varname> ,
described below.</para> </listitem>
2012-03-16 02:25:14 +04:00
</varlistentry>
2012-06-01 19:26:16 +04:00
<varlistentry >
<term > <varname > MaxLevelStore=</varname> </term>
<term > <varname > MaxLevelSyslog=</varname> </term>
<term > <varname > MaxLevelKMsg=</varname> </term>
<term > <varname > MaxLevelConsole=</varname> </term>
<listitem > <para > Controls the maximum
log level of messages that are stored
on disk, forwarded to syslog, kmsg or
the console (if that is enabled, see
above). As argument, takes one of
<literal > emerg</literal> ,
<literal > alert</literal> ,
<literal > crit</literal> ,
<literal > err</literal> ,
<literal > warning</literal> ,
<literal > notice</literal> ,
<literal > info</literal> ,
<literal > debug</literal> or integer
values in the range of 0..7 (corresponding
to the same levels). Messages equal or below
the log level specified are
stored/forwarded, messages above are
dropped. Defaults to
<literal > debug</literal> for
<varname > MaxLevelStore=</varname> and
<varname > MaxLevelSyslog=</varname> , to
ensure that the all messages are
written to disk and forwarded to
syslog. Defaults to
<literal > notice</literal> for
<varname > MaxLevelKMsg=</varname> and
<literal > info</literal> for
<varname > MaxLevelConsole=</varname> .</para> </listitem>
</varlistentry>
2012-06-01 03:06:10 +04:00
<varlistentry >
<term > <varname > TTYPath=</varname> </term>
<listitem > <para > Change the console TTY
to use if
<varname > ForwardToConsole=yes</varname>
is used. Defaults to
<filename > /dev/console</filename> .</para> </listitem>
</varlistentry>
2012-03-16 02:25:14 +04:00
</variablelist>
</refsect1>
<refsect1 >
<title > See Also</title>
<para >
<citerefentry > <refentrytitle > systemd</refentrytitle> <manvolnum > 1</manvolnum> </citerefentry> ,
2012-06-01 03:05:38 +04:00
<citerefentry > <refentrytitle > systemd-journald.service</refentrytitle> <manvolnum > 8</manvolnum> </citerefentry> ,
2012-03-26 22:58:47 +04:00
<citerefentry > <refentrytitle > journalctl</refentrytitle> <manvolnum > 1</manvolnum> </citerefentry> ,
2012-04-04 00:31:48 +04:00
<citerefentry > <refentrytitle > systemd.journal-fields</refentrytitle> <manvolnum > 7</manvolnum> </citerefentry> ,
2013-02-11 23:42:24 +04:00
<citerefentry > <refentrytitle > systemd-system.conf</refentrytitle> <manvolnum > 5</manvolnum> </citerefentry>
2012-03-16 02:25:14 +04:00
</para>
</refsect1>
</refentry>
