The journal configuration file is located at /etc/systemd/journald.conf. Following is an example of the beginning of the journald configuration file.
[Journal] #Storage=auto #Compress=yes #Seal=yes #SplitMode=uid #SyncIntervalSec=5m #RateLimitInterval=30s . . .
When the Storage option is commented out, the journal messages will be written to a file in the /run/log/journal directory. This file is not permanent - the file is erased when the system is shutdown or restarted. Uncommenting Storage will configure the journal to write messages to a file in the /var/log/journal directory. The four storage options are:
- auto - you need to create the /var/log/journal directory, and give the directory the appropriate owner and permissions.
- persistent - the /var/log/journal directory will automatically be created if it does not exist.
- volatile - similar to commenting out Storage. Messages will be written to a file in the /run/log/journal directory.
- none - discard all messages
Uncommenting compress will compress the journal using xz compression. There are 6 options to control the size of the journal. The 3 options that start with "System" are used to control the size of the journal at /var/log/journal. The 3 options that start with "Runtime" are used to control the size of the journal at /run/log/journal.
MaxFileSec=1month means that the journal will retain messages for 1 month before purging the messages.
ForwardToSyslog=yes tells the journal to share messages with syslogd, rsyslogd, and syslog-ng.
Forward toKMsg=yes tell the journal to share messages with klogd.