A Beginner’s Guide to Journald for Linux Server Administrators

Journald is a new system logging method designed for Linux servers, marking the end of text log files. Log information is now written to binary files and read using journalctl. To access this information, Linux administrators will need some practice.

Next-generation Linux distributions like Red Hat Enterprise Linux 7 and SUSE Linux Enterprise Server 12 use systemd to manage services. Journal is a component of systemd, handled by journald. It captures system log information, kernel log information, data from the initial RAM disk, early boot information, and STDOUT/STDERR data streams from all services. Journald is rapidly changing how servers handle log information and how administrators access it.

Goodbye to Log Files

In the world of systemd and journald, there is no place for log files. Journald logs are written to binary files. On Red Hat systems, they are located in /run/log/journal. You should not and cannot open them with a pager. Instead, use journalctl to view content. This command displays all information logged to the server (see Table 1).

Table 1: Default format of journalctl output.

1. Apr 04 09:48:59 localhost.localdomain chronyd[768]: Can't synchronise: no majority 
2. Apr 04 09:50:01 localhost.localdomain systemd[1]: Starting Session 3 of user root. 
3. Apr 04 09:50:01 localhost.localdomain systemd[1]: Started Session 3 of user root. 
4. Apr 04 09:50:01 localhost.localdomain CROND[3699]: (root) CMD (/usr/lib64/sa/sa1 1 1) 
5. Apr 04 09:50:03 localhost.localdomain chronyd[768]: Selected source 46.249.47.127 
6. Apr 04 09:50:03 localhost.localdomain chronyd[768]: System clock wrong by -2.417074 seconds, adjustment started 
7. Apr 04 09:50:36 localhost.localdomain pulseaudio[3163]: [alsa-sink] alsa-sink.c: ALSA woke us up to write new data to the device, but there 
8. Apr 04 09:50:36 localhost.localdomain pulseaudio[3163]: [alsa-sink] alsa-sink.c: Most likely this is a bug in the ALSA driver 'snd_ens1371'. 
9. Apr 04 09:50:36 localhost.localdomain pulseaudio[3163]: [alsa-sink] alsa-sink.c: We were woken up with POLLOUT set — however a subsequent s 
10. Apr 04 09:51:07 localhost.localdomain chronyd[768]: Selected source 81.171.44.131 
11. Apr 04 09:52:12 localhost.localdomain chronyd[768]: System clock wrong by 0.669116 seconds, adjustment started 
12. Apr 04 09:53:17 localhost.lo 

，journalctl。Journalctl -b。Journalctl –since=yesterdayLogin。Search：，journalctl –since=2014-03-15 –until="2014-03-17 23:59:59"。journalctl -u httpd since=00:00 –until=8:00Loginhttpd。journald，。

，journalctl。，Settingsverbose，journalctl -o verbose -n。

2：verbose，Linux。

1. Fri 2014-04-04 10:12:32.072521 CEST [s=a52ddd97575747a18c6378d388b2b9ff;i=955;b=bc03fb52eddb41 
2. b0bb4829ae19c1c286;m=8f1dd 5f2;t=4f633145a58d9; 
3. PRIORITY=6 
4. _UID=0 
5. _GID=0 
6. _BOOT_ID=bc03fb52eddb41b0bb4829ae19c1c286 
7. _MACHINE_ID=1fbfd90ac4fc49919fe1b63d6bcf9097 
8. _HOSTNAME=localhost.localdomain 
9. SYSLOG_FACILITY=3 
10. _TRANSPORT=syslog 
11. _SYSTEMD_CGROUP=/system.slice/network.service 
12. _SYSTEMD_UNIT=network.service 
13. SYSLOG_IDENTIFIER=dhclient 
14. _COMM=dhclient 
15. E=/usr/sbin/dhclient 
16. _CMDLINE=/sbin/dhclient -H localhost -1-q-lf/var/lib/dhclient/dhclient-0b5faf33-6df0-4f11-bbb9-659b5cd940e9-ens33.lease -pf /var/run/ 
17. _CAP_EFFECTIVE=0000000000203402 
18. _SELINUX_CONTEXT=system_u:system_r:dhcpc_t:s0 
19. SYSLOG_PID=1760 
20. _PID=1760 
21. MESSAGE=bound to 192.168.4.232 — renewal in 892 seconds. 
22. _SOURCE_REALTIME_TIMESTAMP=1396599152072521 

Logrotate

。Logrotate。journald，。。，。journaldSettings，/etc/systemd/journal.confSystemMaxUse。

。，。journald，rsyslogsyslog-ng do。Journald。。journald，[r]syslog[{d-ng}]，。