Journald.conf configuration

Journald is a system service for collecting and storing log data, introduced in systemd, a Linux initialization and service manager. It provides a centralized logging mechanism, replacing traditional syslog. Journald's primary configuration file is journald.conf, which controls various aspects of log collection, storage, and management.
The journald.conf file is typically located at /etc/systemd/journald.conf or in the /etc/systemd/journald.conf.d/ directory for drop-in configurations. This file contains several sections and options that define how journald operates.
Storage Options
Compression and Sealing
Forwarding and Output
Rotation and Cleanup
Example Configuration
[Journal]
Storage=persistent
SystemMaxUse=100M
SystemKeepFree=50M
Compress=yes
Seal=yes
ForwardToSyslog=yes
ForwardToKMsg=no
ForwardToConsole=no
[ForwardToSyslog]
yes
[system]
MaxFileSec=1month
MaxRetentionSec=2months
SystemMaxFileSize=20M
This example configuration sets persistent storage with a maximum system journal size of 100M, ensuring at least 50M of free space. It enables compression and sealing, forwards messages to syslog, and sets file size and retention limits.
To modify journald.conf, follow these steps:
sudo nano /etc/systemd/journald.conf
sudo systemctl daemon-reload
sudo systemctl restart systemd-journald
Verify that the changes are in effect by checking the journald status:
sudo systemctl status systemd-journald
By understanding and configuring journald.conf appropriately, you can effectively manage log data collection and storage on your Linux system, ensuring optimal performance and compliance with logging requirements.
Prabhat Sharma is the founder of OpenObserve, bringing extensive expertise in cloud computing, Kubernetes, and observability. His interests also encompass machine learning, liberal arts, economics, and systems architecture. Outside of work, Prabhat enjoys spending quality time playing with his children.