systemdjournald

systemd-journald is the logging component of systemd, responsible for collecting, processing, and storing log data from the kernel, system services, and user applications. It writes logs in a binary journal format and can store them persistently on disk or only in memory, depending on the system configuration.

It runs as a daemon started by systemd and receives messages from multiple sources, including the kernel’s logging interface, the standard output and error streams of services, and direct messages from applications using the systemd API. Journald can forward log entries to other systems such as syslog or the console, as controlled by its configuration.

Journal storage and configuration: By default, persistent logs are stored under /var/log/journal on systems with persistent storage; volatile logs are stored under /run/log/journal. Configuration is managed in /etc/systemd/journald.conf and governs how logs are stored, how much space they may consume, and how log rotation is handled.

Query and usage: The primary user interface is journalctl, which can display, filter, and export log entries. Journalctl supports filtering by unit, priority, time, and custom fields; output formats include short, short-precise, JSON, and JSON-pretty. Logs can be viewed in real time with a follow mode similar to tail -f.

Access and security: Access to logs typically requires root privileges or membership in the systemd-journal group. The binary journal format enables efficient querying and offline processing, and journald integrates with both kernel logging and system startup sequences.

See also: systemd, journald.conf, journalctl.