.JOURNAL

Introduction

On Linux systems that use systemd, the journal daemon, systemd-journald, collects messages from the kernel, from services and from syslog, and stores them in binary .journal files. They are kept under /var/log/journal/ and the machine’s ID, as system.journal and one file per user, with older files renamed and kept as archives. Without that folder the journal is kept only in memory, under /run/log/journal/.

Each entry is a set of fields, not just a line of text: the message, its priority, the process, user, unit and boot it came from, and the time. The journalctl command reads the files and can filter on any field.

Structure

All values are little-endian. The file starts with a header beginning with the signature LPKSHHRH. It holds flags for compatible and incompatible features, the file’s state, IDs for the file, the machine and the boot, the sizes and positions of the hash tables, and counts of objects and entries.

Everything after the header is an object, aligned to 8 bytes. Every object starts with a type, flags and its size. Data objects hold one FIELD=value pair, such as MESSAGE=… or _PID=…, stored once however many entries use it, and possibly compressed with XZ, LZ4 or Zstandard. Field objects name each field. Entry objects hold one log entry: its sequence number, times and boot ID, and references to its data objects. Hash tables find data and field objects by value, entry arrays list entries in order, and tag objects carry the seals of Forward Secure Sealing.

Links