Journald

Journald is the logging component of the systemd project. It collects and stores log messages from the kernel, system services, and user applications, and makes them available for querying and forwarding. Logs are kept in a binary journal format that supports efficient indexing and the inclusion of structured metadata.

Storage and data model: Journald can write logs to a persistent location or keep them in memory. If a directory such as /var/log/journal exists, logs are stored persistently; otherwise, a volatile runtime journal is kept in /run/log/journal. Each log entry contains standard fields such as MESSAGE along with metadata like _SYSTEMD_UNIT, _PID, _UID, _BOOT_ID, and _SOURCE_REALTIME_TIMESTAMP, enabling rich filtering and correlation.

Input sources and integration: Journald collects messages from multiple sources, including kernel messages (kmsg), stdout and stderr of systemd services, and user applications. It is integrated with the broader systemd ecosystem and can capture structured log data from units as well as traditional text logs.

Querying and output: Logs stored by journald can be queried and transformed using journalctl, a companion tool. Journalctl supports filtering by time, unit, priority, and fields, and can render output in human-readable, JSON, or other machine-readable formats, as well as export formats suitable for archival or transfer.

Forwarding and remote logging: Journald can forward logs to other journal instances or to syslog, and works with related components such as systemd-journal-remote and systemd-journal-upload for collecting, transporting, and aggregating logs in centralized deployments.

Configuration: The behavior of journald is governed by its configuration file, which controls storage limits, rotation, rate limits, and forwarding options. Journald plays a central role in systemlog management within systemd-based systems.