JOURNALD.CONF(5) journald.conf JOURNALD.CONF(5) journald.conf journald.conf.d journald@.conf - /etc/systemd/journald.conf /run/systemd/journald.conf /usr/local/lib/systemd/journald.conf /usr/lib/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf /run/systemd/journald.conf.d/*.conf /usr/local/lib/systemd/journald.conf.d/*.conf /usr/lib/systemd/journald.conf.d/*.conf /etc/systemd/journald@NAMESPACE.conf /etc/systemd/journald@NAMESPACE.conf.d/*.conf /run/systemd/journald@NAMESPACE.conf.d/*.conf /usr/local/lib/systemd/journald@NAMESPACE.conf.d/*.conf /usr/lib/systemd/journald@NAMESPACE.conf.d/*.conf systemd systemd-journald.service(8). systemd.syntax(7) . systemd-journald /etc/systemd/journald.conf . /etc/systemd/journald@NAMESPACE.conf . . systemd-journald.service(8) . . : /etc/systemd/ /run/systemd/ /usr/local/lib/systemd/ [1] /usr/lib/systemd/. . (drop-ins) . ( /etc/ /usr/) . /usr/lib/systemd/*.conf.d/ /usr/local/lib/systemd/*.conf.d/ /etc/systemd/*.conf.d/. . *.conf.d/ . . (drop-ins) /usr/. /etc/ . . . . . 10-40 /usr/ 60-90 /etc/ /run/ . /dev/null /etc/ . [Journal]: Storage= . "volatile" "persistent" "auto" "none". "volatile" /run/log/journal ( ). "persistent" /var/log/journal ( ) /run/log/journal ( ) . "auto" "persistent" /var/log/journal "volatile" ( ). "none" ( syslog ). "persistent" ( ) "persistent" . journald journalctl --flush ( SIGUSR1 journald) ( ). "systemd-journal-flush.service". "volatile" . journalctl(1) --flush . ( LogNamespace= systemd.exec(5)) Storage= "volatile" "auto" /var/log/journal/ systemd-journald@.service LogsDirectory=. LogsDirectory= . journalctl --user . "journal.storage". . 186. Compress= . () 512 . . K M G . Seal= . () ( journalctl(1)'s --setup-keys) (FSS) . FSS [2] G. A. Marson B. Poettering (doi:10.1007/978-3-642-40203-6_7) . 189. SplitMode= "uid" "none". : UNIX/Linux . "uid" ( UID nobody) . UIDs GIDs systemd[3] UID. "none" . . . ( Storage= ) . "uid". 190. RateLimitIntervalSec=, RateLimitBurst= . RateLimitIntervalSec= RateLimitBurst= . . . 10000 30 . RateLimitIntervalSec= : "s" "min" "h" "ms" "us". 0. . 2. 1. RateLimitBurst= +----------------------+--------------------------+ | | | | | | | | | +----------------------+--------------------------+ |<= 1MB | 1 | +----------------------+--------------------------+ |<= 16MB | 2 | +----------------------+--------------------------+ |<= 256MB | 3 | +----------------------+--------------------------+ |<= 4GB | 4 | +----------------------+--------------------------+ |<= 64GB | 5 | +----------------------+--------------------------+ |<= 1TB | 6 | +----------------------+--------------------------+ LogRateLimitIntervalSec= / LogRateLimitBurst= systemd.exec(5) . SystemMaxUse=, SystemKeepFree=, SystemMaxFileSize=, SystemMaxFiles=, RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize=, RuntimeMaxFiles= . "System" /var/log/journal. "Runtime" /run/log/journal. /var/ /var/log/journal . . . journalctl systemd-journald ".journal" ".journal~" . SystemMaxUse= RuntimeMaxUse= . SystemKeepFree= RuntimeKeepFree= systemd-journald . systemd-journald . 10% 15% 4G. SystemKeepFree= RuntimeKeepFree= systemd-journald . journald . . SystemMaxUse= RuntimeMaxUse= . SystemMaxFileSize= RuntimeMaxFileSize= . . SystemMaxUse= RuntimeMaxUse= 128M . ( ) 4G. K M G T P E ( 1024 1024^2 ... ). . SystemMaxFiles= RuntimeMaxFiles= . . . 100. MaxFileSec= . SystemMaxFileSize= . . 0 . "year" "month" "week" "day" "h" "m" . 195. MaxRetentionSec= . . SystemMaxUse= . 0 ( ). "year" "month" "week" "day" "h" " m" . 195. SyncIntervalSec= . OFFLINE. CRIT ALERT EMERG. ERR WARNING NOTICE INFO DEBUG. 5 . 199. ForwardToSyslog=, ForwardToKMsg=, ForwardToConsole=, ForwardToWall=, ForwardToSocket= syslog (kmsg) . "ForwardToSocket=" . syslog syslog . . "systemd.journald.forward_to_syslog" "systemd.journald.forward_to_kmsg" "systemd.journald.forward_to_console" "systemd.journald.forward_to_wall". "=" true. . "journal.forward_to_socket". : AF_INET (e.g. "192.168.0.11:4444"), AF_INET6 (e.g. "[2001:db8::ff00:42:8329]:4444"), AF_UNIX (e.g. "/run/host/journal/socket"), AF_VSOCK (e.g. "vsock:2:1234") TTY TTYPath= . (kmsg) "log_buf_len=8M" . systemd ( "printk.devkmsg=on"). [4] . __REALTIME_TIMESTAMP systemd-journal-remote ( systemd-journal-remote.service(8)) . : journald . ForwardToConsole=yes . journald journald. . / journalctl --follow ForwardToConsole=yes . : ForwardToSocket= IPv4/IPv6 . . IP journald initrd . AF_VSOCK/AF_UNIX . MaxLevelStore=, MaxLevelSyslog=, MaxLevelKMsg=, MaxLevelConsole=, MaxLevelWall=, MaxLevelSocket= syslog kmsg ( ). : "emerg" "alert" 'crit` "err" "warning" "notice" "info" "debug" 0-7 ( ). / . "debug" MaxLevelStore= MaxLevelSyslog= MaxLevelSocket= syslog . "notice" MaxLevelKMsg "info" MaxLevelConsole "emerg" MaxLevelWall. "systemd.journald.max_level_store=" "systemd.journald.max_level_syslog=" "systemd.journald.max_level_kmsg=" "systemd.journald.max_level_console=" "systemd.journald.max_level_wall=", "systemd.journald.max_level_socket=". 185. ReadKMsg= . systemd-journal /dev/kmsg . . 235. Audit= "keep". systemd-journald . . "keep" . systemd-journald . yes "keep" . systemd-journald . systemd-journald "systemd-journald-audit.socket" . 246. TTYPath= TTY ForwardToConsole=yes. /dev/console. 185. LineMax= . systemdu0645]/ Aq ) ("\n" ASCII 10) NUL. . Journal Journal . AF_UNIX AF_INET . . K M G T ( 1024) . 48 . 79 79. 235. . (/run/systemd/journal/syslog) . ForwardToSyslog=. journalctl(1). . . . Storage=none. Storage= ForwardToSyslog= . systemd(1), systemd-journald.service(8), journalctl(1), systemd.journal-fields(7), systemd-system.conf(5) 1. . /usr/local/ . 2. https://eprint.iacr.org/2013/397 3. UIDs GIDs systemd https://systemd.io/UIDS-GIDS 4. https://systemd.io/JOURNAL_EXPORT_FORMATS/#journal-export-format 3 . . : . systemd 260.2 JOURNALD.CONF(5)