---
title: journald
description: Monitor your systemd-journald logs with Datadog.
breadcrumbs: Docs > Integrations > journald
---

# journald
Supported OS Integration version3.2.0
## Overview{% #overview %}

Systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging information from a variety of sources.

**Minimum Agent version:** 7.29.0

## Setup{% #setup %}

### Installation{% #installation %}

The journald check is included in the [Datadog Agent](https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent) package. No additional installation is needed on your server.

### Configuration{% #configuration %}

Journal files, by default, are owned and readable by the systemd-journal system group. To start collecting your journal logs, you need to:

1. [Install the Agent](https://app.datadoghq.com/account/settings/agent/latest) on the instance running the journal.
1. Add the `dd-agent` user to the `systemd-journal` group by running:
   ```text
    usermod -a -G systemd-journal dd-agent
   ```

{% tab title="Host" %}
To configure this check for an Agent running on a host:

Edit the `journald.d/conf.yaml` file, in the `conf.d/` folder at the root of your [Agent's configuration directory](https://docs.datadoghq.com/agent/guide/agent-configuration-files/#agent-configuration-directory) to start collecting logs.

#### Log collection{% #log-collection %}

Collecting logs is disabled by default in the Datadog Agent, you need to enable it in the `datadog.yaml` with:

```yaml
logs_enabled: true
```

Then add this configuration block to your `journald.d/conf.yaml` file to start collecting your Logs:

```yaml
logs:
    - type: journald
      container_mode: true
```

To fill `source` and `service` attributes, the Agent collects `SYSLOG_IDENTIFIER` , `_SYSTEMD_UNIT` and `_COMM`and set them to the first non empty value. To take advantage of the integration pipelines, Datadog recommends setting the `SyslogIdentifier` parameter in the `systemd` service file directly, or in a `systemd` service override file. Their location depends on your distribution, but you can find the location of the `systemd` service file by using the command `systemctl show -p FragmentPath <unit_name>`.

**Note**: With Agent 7.17+, if `container_mode` is set to `true`, the default behavior changes for logs coming from Docker containers. The `source` attribute of your logs is automatically set to the corresponding short image name of the container instead of simply `docker`.

[Restart the Agent](https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent).
{% /tab %}

{% tab title="Containerized" %}
For containerized environments, see the [Autodiscovery Integration Templates](https://docs.datadoghq.com/agent/kubernetes/integrations/) for guidance on applying the parameters below.

#### Log collection{% #log-collection %}

Collecting logs is disabled by default in the Datadog Agent. To enable it, see [Kubernetes Log Collection](https://docs.datadoghq.com/agent/kubernetes/log/?tab=containerinstallation#setup).

| Parameter      | Value                                                  |
| -------------- | ------------------------------------------------------ |
| `<LOG_CONFIG>` | `{"source": "journald", "service": "<YOUR_APP_NAME>"}` |

{% /tab %}

#### Advanced features{% #advanced-features %}

##### Change journal location{% #change-journal-location %}

By default the Agent looks for the journal at the following locations:

- `/var/log/journal`
- `/run/log/journal`

If your journal is located elsewhere, add a `path` parameter with the corresponding journal path.

##### Filter journal units{% #filter-journal-units %}

You can filter specific *system-level* units by using these parameters:

- `include_units`: Includes all system-level units specified.
- `exclude_units`: Excludes all system-level units specified.

Example:

```yaml
logs:
    - type: journald
      path: /var/log/journal/
      include_units:
          - docker.service
          - sshd.service
```

In Datadog Agent version `7.37.0`+, you can filter *user-level* units by using these parameters:

- `include_user_units`: Includes all user-level units specified.
- `exclude_user_units`: Excludes all user-level units specified.

**Note**: Use the `*` wildcard in `exclude_units` or `exclude_user_units` to specify a particular Journald log. The `*` wildcard does not work with `include_units`. By default, if there are no units for neither system nor user, and no matches are defined, all journal logs are collected.

Example:

```yaml
logs:
    # Collect all system-level unit logs.
    - type: journald
      exclude_user_units:
          - '*'
```

##### Filter journal messages{% #filter-journal-messages %}

In Datadog Agent version `7.39.0`+, you can filter arbitrary messages using key-value pairs with these parameters:

- `include_matches`: Includes messages matching `key=value`
- `exclude_matches`: Excludes messages matching `key=value`

Example:

```yaml
logs:
    - type: journald
      path: /var/log/journal/
      include_matches:
          - _TRANSPORT=kernel
```

##### Tailing the same journal multiple times{% #tailing-the-same-journal-multiple-times %}

If you want to report units with different source or service tags, these must appear in separate journald configs.

In order to do this you must uniquely identify the journal config with a `config_id` (available in agent `7.41.0`+).

```yaml
logs:
    - type: journald
      config_id: my-app1
      source: my-app1
      service: my-app1
      include_units:
          - my-app1.service

    - type: journald
      config_id: my-app2
      source: my-app2
      service: my-app2
      include_units:
          - my-app2.service
```

##### Collect container tags{% #collect-container-tags %}

Tags are critical for finding information in highly dynamic containerized environments, which is why the Agent can collect container tags in journald logs.

This works automatically when the Agent is running from the host. If you are using the containerized version of the Datadog Agent, mount your journal path and the following file:

- `/etc/machine-id`: this ensures that the Agent can query the journal that is stored on the host.

### Validation{% #validation %}

Run the Agent's [status subcommand](https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information) and look for `journald` under the Logs Agent section.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

journald does not include any metrics.

### Service Checks{% #service-checks %}

journald does not include any service checks.

### Events{% #events %}

journald does not include any events.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).