Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [journald]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

systemd journal - delete logs belonging to a specified unit?

Like there is a way to show all logs belonging to a unit: journalctl -xu <unit>, Is there a way to clear the logs belonging to a specified unit with journalctl ? Actually, my problem is, one of ...
user avatar
  • 32
0 votes
0 answers
14 views

journalctl – Is there any Issue with generating a new Forward Secure Sealing (FSS) Key every 30 Seconds?

Goal Improve Security of the System by sealing the Journal Logs in a shorter Interval. What could be Problems? System Performance? To Much different files were generated, so that I have to set the ...
user avatar
0 votes
0 answers
18 views

Redirect legacy logfile to systemd journal

I have a program that logs to two configurable logfiles. The file names are given in a configuration file, and not via command line parameter (which is the case in this similiar question). How can I ...
user avatar
  • 171
0 votes
1 answer
46 views

Set INFO/ERROR priority for messages logged to journal via stdout and stderr?

We have many production apps (first and third-party) that leave logging up to the process that runs the app and just log to stdout for INFO and stderr for ERROR logs (ie only 2 log priorities: INFO|...
user avatar
  • 541
0 votes
1 answer
39 views

How do I stop journald from dropping blank lines?

I have an application which logs to stdout in a format like this: incoming request from x.x.x.x client version is 1.2 authenticated as alice@example.com processed 1234 bytes closing connection ...
user avatar
  • 141
1 vote
0 answers
56 views

stop kernel audit messages logged in syslog without disabling auditing

OS: CentOS 7 I am trying to figure out how audit (kaudit) events are logged in /var/log/messages. I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
user avatar
  • 1,595
0 votes
0 answers
27 views

Find out if journald has a key configured and uses forward secure sealing (FSS)?

Calling journalctl --setup-keys creates a new key pair for Forward Secure Sealing (FSS). How can I check if this was done on a system without generating those keys if it has not happened yet? ...
user avatar
  • 191
0 votes
1 answer
163 views

systemd, journal receiving raw log

one common paradigm on all other syslog implementations (rsyslog, syslog-ng, readlog, etc) is to exchange log entries via UDP514 in plain text format. How do I enable systemd-journal-remote to receive ...
user avatar
  • 213
0 votes
0 answers
154 views

How to ensure output from "tee" is shown when used in a script run under systemd

I have a script that I'm running under systemd which has some debug logs that I'd like to send to both stdout (which should end up in the system journal, viewable with journalctl) as well as to a log ...
user avatar
  • 345
1 vote
0 answers
159 views

How I can send all logs from journald to GCP Logging?

Don't know what to add more to question, just want to send all logs. My applications write logs to journald, there is no files on disk. UPD. Just to clarify, there are files where journald store logs, ...
user avatar
  • 163
0 votes
0 answers
832 views

Service not logging to journalctl

I have a user service which is placed under /home/<user>/.config/systemd/user/<service>.service When I perform systemctl --user status <service> I have the desired output, for ...
user avatar
  • 1
0 votes
0 answers
86 views

rsyslog seems to be triggering sdhci dumps when writing in external storage

Acording what I read, rsyslog is usually used to process logs and send them to another locations, either local (external storage, specific partition, etc.) or remote (logging server, for example). ...
user avatar
3 votes
1 answer
556 views

Is it safe to disable rsyslog if I have journald?

I am using Debian 10. It seems to me, that both journald and (r)syslogd watch for messages independently from sources such as kmesg() or syslog(). Is there any advantage to running both? Why does ...
user avatar
3 votes
1 answer
1k views

Is there a way to make samba (smb,nmb) to not log start/stop events as error?

smbd and nmbd services log a lot of things as errors which clutters my journald logs when I filter it with journalctl -p 3. Is there a way to tell samba to not log start/stop/daemon_ready messages as ...
user avatar
1 vote
0 answers
75 views

Delete old SSH session recordings

Recently I've been testing SSH Session recording in Fedora + Cockpit as a method of auditing. This has been working pretty well, but it records too much information, and more importantly, picked up a ...
user avatar
  • 369
0 votes
0 answers
497 views

Make journalctl keep all logs forever (SystemMaxUse = unlimited)

How do I configure journald so that it never, ever, ever deletes my logs. Yes, what I want to do is tell journald to keep writing until the disk (read: /var partition's filesystem) is full. No, I don'...
user avatar
1 vote
0 answers
223 views

Connecting to systemd service's standard output/error

I have a simple systemd service that runs for some time and then exits. It usually gets triggered by a systemd timer but sometimes I want to run it manually (well, from a script). The problem is - I ...
user avatar
1 vote
0 answers
255 views

journalctl --list-boots is not listing all boots

I have a Raspberry Pi running a custom Yocto image and it's using systemd-journald for logging. I'm wondering why there is a difference between: root@raspberrypi4:~# journalctl -o verbose | grep -e '...
user avatar
  • 113
1 vote
2 answers
704 views

Best way to archive journald logs in a space-efficient way?

It has been established that journald logs are huge. On this specific system, the logs grow about 3GB per week. For audit purposes I would like to preserve system logs for a longer time than what can ...
user avatar
  • 727
1 vote
0 answers
2k views

How do I specify a fail2ban filter/jail where the log is sourced from systemd/journald?

I've got nginx running and logging to systemd / journald. How do I specify the source of the log to be from a systemd unit? In man jail.conf I see for the backends listed as : systemd ...
user avatar
0 votes
1 answer
1k views

Podman rootless journald logging

I'm trying to log to the host's systemd-journald from a rootless podman-container. When i run the container as root with the --privileged flag, i can read the logs from the container on the host with ...
user avatar
1 vote
0 answers
40 views

Journal out of order

Trying to figure out what caused one of our servers (Ubuntu 18.04) to become unresponsive, I was looking through the journal ( journalctl -r) and saw strangely out of order timestamps Apr 17 09:20:...
user avatar
1 vote
0 answers
862 views

Disable "Failed password" ssh logs

Bots are tirelessly trying to log into my server using ssh. That does not bother me, because my passwords are good, but I don't like the fact that ssh spam fills journald logs. I'd like to filter out ...
user avatar
  • 259
3 votes
0 answers
2k views

journald memory usage on CentOS 7

I have an AWS EC2 instance running a CentOS 7.7.1908 (systemd 219) with a server application. The server logs quite a lot of information to the system logs (using syslog). I have recently enabled ...
user avatar
  • 31
1 vote
1 answer
2k views

Linux journalctl not synced with systemctl status / Journalctl not updating

I am running my custom service, let's call it "foo.service". It's a gunicorn python process which logs a few things. I used to be able to get a real-time log overview using journalctl -u <service&...
user avatar
  • 113
0 votes
1 answer
614 views

RateLimitIntervalSec and RateLimitBurst in journald.conf are not working at all

I am trying to see how log drop count in the journald works. In the /etc/systemd/journald.conf file, I modified RateLimitIntervalSec to 1 second and the RateLimitBurst to 2 so that I can see some logs ...
user avatar
  • 101
9 votes
2 answers
8k views

Is rsyslog redundant on when using journald?

I have noticed log messages are duplicated in journald and /var/log/messages on my CentOS 7 system. At first I thought it was the journald option ForwardToSyslog (which defaults to 'yes' in the ...
user avatar
  • 317
2 votes
1 answer
2k views

rcu_sched self-detected stall on CPU + watchdog: BUG: soft lockup - CPU#3 stuck for 22s

Being unable to ssh into a machine I connected it to a monitor and found the following: The machine is running Ubuntu Server 18.04 LTS and is a first generation 8 core Ryzen 1700. I've restarted the ...
user avatar
  • 1,497
2 votes
0 answers
2k views

systemd-journal Rate Limit

I have a service set up on CentOS 7 which outputs a lot of log messages, which results in this in the system log / journal: systemd-journal[xxxx]: Suppressed 864 messages from /system.slice/example....
user avatar
  • 21
1 vote
0 answers
623 views

journald forwarding to syslog seems to be lagged

I'm seeing an issue on a Ubuntu 16.04 box where the copying/forwarding of journal messages to /var/log/syslog seems to be delayed: theuser@host:/etc/systemd$ sudo journalctl -n 1 && sudo tail ...
user avatar
2 votes
0 answers
95 views

sudo log entries don't show username on Debian Stretch

For some reason, the username of the user calling a command with sudo is not shown in the system log: $ journalctl -ef sudo[30160]: pam_unix(sudo:session): session opened for user root by (uid=0) ...
user avatar
  • 121
1 vote
1 answer
207 views

`journalctl -f -m` does not interleave remote and local

I currently have a 2-server setup (3 servers in total, one still to be configured for this) with one server using systemd-journal-remote (.socket & .service) to collect all log entries from the ...
user avatar
1 vote
2 answers
4k views

Clearing "/var/log/journal"

I want to clear my "/var/log/journal" directory. I'm using debian 8 root@nyc3-x8:/var/log# uname -a Linux nyc3-x8 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19) x86_64 GNU/Linux And my ...
user avatar
  • 13
5 votes
3 answers
13k views

System logs are empty (/var/log/messages; /var/log/secure; etc)

I found that rsyslog stopped writing on logs (messages; secure; cron;etc) System information: NAME="Red Hat Enterprise Linux Server" VERSION="7.4 (Maipo)" ID="rhel" ID_LIKE="fedora" VARIANT="Server" ...
user avatar
  • 360
1 vote
0 answers
273 views

system freeze after systemd-tmpfiles-clean executed

recently i got a problem, i run mysql on docker with k8s , the system load getting high in 2 days from 1->500+, the /var/log/messages infomation: Aug 17 19:50:07 SVR5798HW1288 dockerd[1890]: time="...
user avatar
6 votes
1 answer
12k views

How to filter journalctl output by process name?

When a process logs to systemd, its process name is recorded and displayed as identifier in the journalctl output. $ systemd-cat echo "test" $ journalctl -f -- Logs begin at Sat 2018-02-24 12:13:24 ...
user avatar
1 vote
3 answers
1k views

journalctl --follow isn't advancing

I have a program that continually reads the output of: journalctl -o json --follow And sends it to another process. And while it outputs journal entries initially from the tail, new ones don't ...
user avatar
  • 14k
1 vote
1 answer
3k views

Systemd python service buffers journalctl output even with -u

I have a simple user systemd service configured like so: [Unit] Description=Bot AssertPathExists=/home/mikel/discord-bot/ [Service] WorkingDirectory=/home/mikel/discord-bot/ ExecStart=/home/mikel/...
user avatar
  • 111
1 vote
0 answers
350 views

redundant systemd-journal-remote for systemd-journal-upload instances

I'm using systemd-journal-upload on serveral nodes to forward their journals to a single systemd-journal-remote sink, loghost01: /var/log/journal ├── <foo-bar> │   ├── system.journal │   └── ...
user avatar
  • 111
3 votes
1 answer
1k views

systemd-journald system logs are not persistent across boots despite Storage=persistent

I recently got a problem with systemd not preserving logs from previous boots. I checked several answers here and elsewhere but haven't found a solution. the problem is that the user log gets ...
user avatar
9 votes
3 answers
4k views

Why are journald logfiles so huge?

When I do a journalctl --disk-usage it says something about 300MB size of the journal files but when I look at the actual text with journalctl | wc -c it's something about 28MB. Well, journald has ...
user avatar
1 vote
0 answers
492 views

Journald allow a user to read one unit's logs

tl;dr How can I allow a normal user to read one systemd service's logs? Long question Environment: CentOS 7 A user needs access to his service's logs, which are by default consumed by journald. I can ...
user avatar
  • 881
1 vote
1 answer
345 views

Journald does not log error messages before failing exit of program

I'm invoking a python3 module using systemd (version: systemd 232) on debian stretch. The problem is, if the python module raises an exception, the exception message (stderr) and some prior prints (...
user avatar
5 votes
5 answers
14k views

reliable export of journalctl logs

I search a way for a reliable export of journalctl logs. I could use the --since=... option, but this is a bit fuzzy. In my case a script would call journalctl --output=json every ten minutes. I ...
user avatar
  • 2,914
1 vote
0 answers
884 views

Unable to turn logging down on isc-dhcp-server on ubuntu xenial

I edited /etc/dhcp/dhcpd.conf and set log-facility local4; I've also edited /etc/systemd/system.conf and set LogLevel=notice I've verified that the log level is set to notice with the command. ...
user avatar
1 vote
1 answer
552 views

Remove nginx log prefix

I configured nginx to log in this format log_format lalala '$remote_addr - $remote_user '; access_log syslog:server=unix:/dev/log lalala; However, every line starts with: testserver nginx: ...
user avatar
  • 123
1 vote
1 answer
753 views

journald: extract part of a system journal into the journald format (i.e. for use with journalctl)

I have a situation where it would be really useful to attach the relevant bits of the system logs to a bug ticket. The system in question uses journald and I rather like using journalctl to inspect ...
user avatar
  • 141
0 votes
1 answer
621 views

Using journald without systemd?

I would like to use journald within a container without systemd. Is this possible? If so, how to do this? What are the issues to take care?
user avatar
  • 113
3 votes
2 answers
2k views

Turn off buffering in systemd unit-file?

When I write my unit-file I want all output from Exec*-options (ExecStartPre=, ExecStartPost=, ExecStart=, and ExecStopPost=) to be sent to the journal. But apparently the output is buffered in some ...
user avatar
  • 327
2 votes
1 answer
1k views

How to write multiline log entry to journald?

My NodeJS-based service writes multiline logs using console.log to journald. However, logs get broken down on each new line (\n). How can I have a multiline message in a single log entry? Thank you!
user avatar
  • 141