The systemd project documents the journal file format in Journal File Format
on systemd.io, with the source header journal-def.h as the final word. All
numbers are little-endian. Fields were added over time; a reader takes
header_size to know which are present.
Fields
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 8 | signature | LPKSHHRH. |
8 | 4 | compatible_flags | Features an older reader may ignore; see flags. |
12 | 4 | incompatible_flags | Features a reader must understand to read the file. |
16 | 1 | state | 0 offline (closed cleanly), 1 online (open for writing, or not closed cleanly), 2 archived (rotated, no longer written). |
17 | 7 | reserved | Zeros. |
24 | 16 | file_id | A random 128-bit ID of this file; also the key of keyed hashing. |
40 | 16 | machine_id | The machine’s ID (/etc/machine-id). |
56 | 16 | tail_entry_boot_id | The boot ID of the newest entry. |
72 | 16 | seqnum_id | Identifies the sequence-number series the entries belong to, shared by the files of one series. |
88 | 8 | header_size | Size of this header; the first object follows. |
96 | 8 | arena_size | Bytes after the header available for objects. |
104 | 8 | data_hash_table_offset | Where the data hash table’s items start, not its object header (the specification: “These offsets do not point to the object headers but directly to the payloads”). |
112 | 8 | data_hash_table_size | The items’ size in bytes: buckets × 16 (systemd’s journal-file.c stores s * sizeof(HashItem)). |
120 | 8 | field_hash_table_offset | Where the field hash table’s items start. |
128 | 8 | field_hash_table_size | The items’ size in bytes, as for the data hash table. |
136 | 8 | tail_object_offset | The last object in the file. |
144 | 8 | n_objects | Number of objects. |
152 | 8 | n_entries | Number of entry objects. |
160 | 8 | tail_entry_seqnum | Sequence number of the newest entry. |
168 | 8 | head_entry_seqnum | Sequence number of the oldest entry. |
176 | 8 | entry_array_offset | The first entry array object, which lists every entry in order. |
184 | 8 | head_entry_realtime | Wall-clock time of the oldest entry, microseconds since 1970. |
192 | 8 | tail_entry_realtime | Wall-clock time of the newest entry. |
200 | 8 | tail_entry_monotonic | Monotonic time of the newest entry, microseconds since boot. |
208 | 8 | n_data | Number of data objects (systemd 187 and later). |
216 | 8 | n_fields | Number of field objects (187). |
224 | 8 | n_tags | Number of tag objects (189). |
232 | 8 | n_entry_arrays | Number of entry array objects (189). |
240 | 8 | data_hash_chain_depth | Longest chain in the data hash table (246). |
248 | 8 | field_hash_chain_depth | Longest chain in the field hash table (246). |
256 | 4 | tail_entry_array_offset | The last entry array object (252). |
260 | 4 | tail_entry_array_n_entries | Entries used in it (252). |
264 | 8 | tail_entry_offset | The newest entry object (254). The header is then 272 bytes. |
Flags
| Field | Bit | Name | Meaning |
|---|---|---|---|
| incompatible | 0x01 | COMPRESSED_XZ | Some data objects are XZ-compressed. |
| incompatible | 0x02 | COMPRESSED_LZ4 | Some data objects are LZ4-compressed. |
| incompatible | 0x04 | KEYED_HASH | Hashes are SipHash-2-4 keyed with file_id, not Jenkins lookup3. |
| incompatible | 0x08 | COMPRESSED_ZSTD | Some data objects are Zstandard-compressed. |
| incompatible | 0x10 | COMPACT | Compact mode: 32-bit offsets in entry items and entry arrays, so the file is limited to 4 GiB. |
| compatible | 0x01 | SEALED | The file carries Forward Secure Sealing tags. |
| compatible | 0x02 | TAIL_ENTRY_BOOT_ID | tail_entry_boot_id is updated with every entry. |
Example
00000000 4C 50 4B 53 48 48 52 48 02 00 00 00 1C 00 00 00 LPKSHHRH........
00000010 01 00 00 00 00 00 00 00 …Reading it: the signature; compatible flags 2 (tail entry boot ID); incompatible flags
0x1C: keyed hash, Zstandard and compact; state 1, online.