SYSTEMD-JOURNALD.SERVICE(8) systemd-journald.service systemd-journald.service systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket systemd-journald@.service systemd-journald@.socket systemd-journald-varlink@.socket systemd-journald - systemd-journald.service systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket systemd-journald@.service systemd-journald@.socket systemd-journald-varlink@.socket /usr/lib/systemd/systemd-journald systemd-journald . : o kmsg o syslog(3) libc o sd_journal_print(3) [1] o . . o . systemd.journal-fields(7) . . 2-1 . /var/log/journal /run/log/journal/ ( ). /var/log/journal/ . Storage= journald.conf(5) /var/log/journal/. journald journalctl --flush ( SIGUSR1 journald) ( ). "systemd-journal-flush.service". /var/log/journal/ ( journald.conf ) : mkdir -p /var/log/journal systemd-tmpfiles --create --prefix /var/log/journal journald.conf(5) . systemd . StandardOutput=/StandardError= systemd.exec(5) . ("\n" ASCII 10) NUL. systemd-journald.service . EPIPE. / . SIGPIPE signal(7). systemd SIGPIPE ( IgnoreSIGPIPE= systemd.exec(5) ). / . systemd-journald.service . systemd-journald.service systemctl restart systemctl stop systemctl start ( ) . systemd-journald.service . / . ( ) . . systemd-cat(1). systemd-journald 4096. EPIPE . . systemd-journald. IPC. "" systemd-journald.service ( ). systemd-journald@.service. . LogNamespace= systemd.exec(5) . --namespace= journalctl(1) . . syslog(3) stdout/stderr . . systemd-journald /etc/systemd/journald.conf ( ) /etc/systemd/journald@NAMESPACE.conf. /var/log/journal/MACHINE_ID ( ) /var/log/journal/MACHINE_ID.NAMESPACE. SIGUSR1 /run/ /var/ ( ). /var/ /run/ /var/ . journalctl --flush . journalctl(1) . 186. SIGUSR2 . journalctl --rotate . 186. SIGRTMIN+1 . journalctl --sync . 228. SIGHUP SIGHUP systemd-journald . ReadKmsg= . ( ) . . 258. systemd-journald ImportCredential=/LoadCredential=/SetCredential= ( systemd.exec(5) ). : journal.forward_to_socket . ForwardToSocket= journald.conf(5). 256. journal.storage . Storage= journald.conf(5). 256. journald.conf : systemd.journald.forward_to_syslog= systemd.journald.forward_to_kmsg= systemd.journald.forward_to_console= systemd.journald.forward_to_wall= / syslog . journald.conf(5) . 186. systemd.journald.max_level_store=, systemd.journald.max_level_syslog=, systemd.journald.max_level_kmsg=, systemd.journald.max_level_console=, systemd.journald.max_level_wall=, systemd.journald.max_level_socket= syslog(3) kmsg wall(1) . journald.conf(5). 232. . "systemd-journal" . . nobody /var/log/journal/. systemd[2] . . . . "wheel" "adm" : # setfacl -Rnm g:wheel:rx,d:g:wheel:rx,g:adm:rx,d:g:adm:rx /var/log/journal/ /var/log/journal/. /etc/systemd/journald.conf systemd-journald. journald.conf(5). 206. /run/log/journal/-/*.journal, /run/log/journal/-/*.journal~, /var/log/journal/-/*.journal, /var/log/journal/-/*.journal~ systemd-journald /run/log/journal/-/ /var/log/journal/-/ ".journal". ".journal~" systemd-journald . /run/ /var/log/journal Storage=volatile journald.conf(5). systemd-journald "-@.journal" ( "-@.journal~"). "" . ( ). journalctl(1) sd-journal(3) . systemd-journald . SystemMaxUse= journald.conf(5). 206. /dev/kmsg, /dev/log, /run/systemd/journal/dev-log, /run/systemd/journal/socket, /run/systemd/journal/stdout systemd-journald . systemd-journald netlink(7) "systemd-journald-audit.socket" . 228. . systemd(1), journalctl(1), journald.conf(5), systemd.journal-fields(7), sd-journal(3), systemd-coredump(8), setfacl(1), sd_journal_print(3), pydoc systemd.journal 1. https://systemd.io/JOURNAL_NATIVE_PROTOCOL 2. UIDs GIDs systemd https://systemd.io/UIDS-GIDS 3 . . : . systemd 260.1 SYSTEMD-JOURNALD.SERVICE(8)