pages tagged syslogyakkinghttp://yakking.branchable.com/tags/syslog/yakkingikiwiki2015-04-29T11:00:15Zsystemd for the uninformed - The Journalhttp://yakking.branchable.com/posts/systemd-3-journald/Richard Maw2015-04-29T11:00:15Z2015-04-29T11:00:09Z
<p><a href="http://www.freedesktop.org/software/systemd/man/systemd-journald.service.html">journald(8)</a> is for collecting log output from processes and textual
output from services started by <a href="http://www.freedesktop.org/software/systemd/man/systemd.html">systemd(1)</a>.</p>
<p>As is usual for things involving <a href="http://www.freedesktop.org/wiki/Software/systemd/">systemd</a>, there's some controversy
surrounding it, because of some technical decisions and it being a
mandatory component in systems that use <a href="http://www.freedesktop.org/software/systemd/man/systemd.html">systemd(1)</a>.</p>
<p>The main concern is that it will replace the venerable <a href="http://man7.org/linux/man-pages/man8/rsyslogd.8.html">syslog</a>,
because <a href="http://www.freedesktop.org/software/systemd/man/systemd-journald.service.html">journald(8)</a> takes over the <code>/dev/log</code> socket used by the
<a href="http://man7.org/linux/man-pages/man3/syslog.3.html">syslog(3)</a> logging protocol. However, this does not actually force
you to use the Journal, as <a href="http://man7.org/linux/man-pages/man8/rsyslogd.8.html">rsyslogd(8)</a> can read information out of
the journal.</p>
<p>The other concern with <a href="http://www.freedesktop.org/software/systemd/man/systemd-journald.service.html">journald(8)</a> is that it saves logs in a binary
format requiring it to be read out with <a href="http://www.freedesktop.org/software/systemd/man/journalctl.html">journalctl(1)</a>, as opposed
to <a href="http://man7.org/linux/man-pages/man8/rsyslogd.8.html">syslog</a>, which saves logs as a text file, so can be processed by
other tools.</p>
<p>The source of concern is that the Journal may change to an incompatible
format, and there wouldn't be any way to read the logs out, but this
can be mitigated by installing <a href="http://man7.org/linux/man-pages/man8/rsyslogd.8.html">rsyslogd(8)</a> in case it ever happens,
and the systemd developers have been careful about keeping it backwards
compatible.</p>
<p>The reason for the journal storing logs in a binary format, is for
performance when searching, as the journal contains more logging
information than <a href="http://man7.org/linux/man-pages/man8/rsyslogd.8.html">syslog</a> used to handle.</p>
<p>By default, the Journal stores the standard output and standard error of
services in addition to <a href="http://man7.org/linux/man-pages/man3/syslog.3.html">syslog(3)</a> output. This is usually sufficient,
but applications can send messages directly too with the <a href="http://www.freedesktop.org/software/systemd/man/sd-journal.html">sd-journal(3)</a>
library.</p>
<p>There is not a great deal of configuration required to use
<a href="http://www.freedesktop.org/software/systemd/man/systemd-journald.service.html">journald(8)</a>, but reading messages is possible with the
<a href="http://www.freedesktop.org/software/systemd/man/journalctl.html">journalctl(1)</a> tool.</p>
<p>I find the most useful option to <a href="http://www.freedesktop.org/software/systemd/man/journalctl.html">journalctl(1)</a> is <code>--unit</code>, which most
recently saved me a lot of time when debugging service start-up issues,
as it allowed me to deduce why things were failing to work properly.</p>