journald.conf
config logsystemd journal logging configuration
/etc/systemd/journald.conf
Storage
Where to store journal data
Compress journal objects
Enable Forward Secure Sealing (FSS) for tamper detection
How to split journal files per user
Interval to sync journal to disk (default: 5m)
Persistent Storage Limits (/var/log/journal)
Max total disk space (empty = 10% of filesystem, e.g. 500M, 4G)
Min free disk space to maintain (empty = 15% of filesystem)
Max size of individual journal files (empty = 1/8 of SystemMaxUse)
Max number of journal files (empty = 100)
Volatile Storage Limits (/run/log/journal)
Max RAM for volatile journal (empty = 10% of RAM, e.g. 100M)
Min free RAM to maintain (empty = 15% of RAM)
Max size of individual volatile journal files
Max number of volatile journal files (empty = 100)
Retention
Max time to keep entries (e.g. 1month, 1year, empty = no limit)
Max time span in a single journal file (empty = 1month)
Rate Limiting
Time interval for rate limit window (default: 30s)
Max messages per interval per service (default: 10000)
Forwarding
Forward to kernel log buffer
Forward to system console
Forward emergency messages to all terminals
Max Log Level per Target
Max level to store in journal
Max level forwarded to syslog
Max level forwarded to kmsg
Max level forwarded to console
Max level forwarded to wall
Miscellaneous
Max line length for journal entries (default: 48K)
Read kernel messages from /dev/kmsg
Enable audit records in journal (empty = kernel default)
Generated Config — /etc/systemd/journald.conf
# /etc/systemd/journald.conf # Apply with: sudo systemctl restart systemd-journald [Journal] Storage=auto Compress=yes Seal=yes SplitMode=uid ForwardToSyslog=no ForwardToKMsg=no ForwardToConsole=no ForwardToWall=yes MaxLevelStore=debug MaxLevelSyslog=debug MaxLevelKMsg=notice MaxLevelConsole=info MaxLevelWall=emerg ReadKMsg=yes