systemd journal location (was: Re: [gentoo-user] syslog-ng: how to read the log files)

[Marc Joliet]

Am Tue, 17 Feb 2015 23:31:26 +0100
schrieb Marc Joliet <marcec@×××.de>:

> Am Tue, 17 Feb 2015 13:45:38 -0600
> schrieb Canek Peláez Valdés <caneko@×××××.com>:
>
> > On Tue, Feb 17, 2015 at 2:29 PM, <covici@××××××××××.com> wrote:
> > >
> > > Alexander Kapshuk <alexander.kapshuk@×××××.com> wrote:
> > >
> > > > On Tue, Feb 17, 2015 at 8:26 PM, lee <lee@××××××××.de> wrote:
> > > >
> > > > > Hi,
> > > > >
> > > > > how do you read the log files when using syslog-ng?
> > > > >
> > > > > The log file seem to be some sort of binary that doesn't display too
> > > > > well in less, and there doesn't seem to be any way to read them.
> > > > >
> > > > >
> > > > > --
> > > > > Again we must be afraid of speaking of daemons for fear that daemons
> > > > > might swallow us.  Finally, this fear has become reasonable.
> > > > >
> > > > >
> > > > If you're talking about /var/log/messages, which is:
> > > > messages: data
> > > >
> > > > I use cat(1).
> > >
> > > I wonder if the OP is using systemd and trying to read the journal
> > > files?
> >
> > Those live under /var/lib/journal (which you need to create; Gentoo doesn't
> > do it by default last time I saw)
> [...]
>
> It did on my laptop after I migrated it to systemd over the weekend (on a whim,
> no less -- apparently I'm adventurous?). Or, to be more precise, I didn't have
> to create the directory myself. And wouldn't it be created at run-time, anyway?
> That's what I would expect, at least.

Dammit, I *wanted* to mention that I didn't have my laptop there to look, and
now I regret not doing it, because I was *actually* thinking
of /var/log/journal/ (which I still didn't create by hand, BTW).

I mean, it still contains journal files, and systemd-journald(8) says its the
default *persistent* journal location.  However, it is structured differently
than what you showed, namely:

% tree /var/log/journal/
/var/log/journal/
├── b3a495d35e890b80816684a4521fc1cc
│   ├── system.journal
│   └── user-1000.journal
└── remote

So it creates a directory named after the machine ID, which contains a system
journal and one journal per user.  And if it receives logs from remote
machines, those go into the remote folder.

Just, uh, just so you know...

-- 
Marc Joliet
--
"People who think they know everything really annoy those of us who know we
don't" - Bjarne Stroustrup