Overview

Systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging information from a variety of sources.

Setup

Installation

The journald check is included in the Datadog Agent package. No additional installation is needed on your server.

Configuration

Journal files, by default, are owned and readable by the systemd-journal system group. To start collecting your journal logs, you need to:

1. Install the Agent on the instance running the journal.
2. Add the dd-agent user to the systemd-journal group by running:

    usermod -a -G systemd-journal dd-agent
   

logs_enabled: true

logs:
    - type: journald
      container_mode: true

Advanced features

Change journal location

By default the Agent looks for the journal at the following locations:

• /var/log/journal
• /run/log/journal

If your journal is located elsewhere, add a path parameter with the corresponding journal path.

Filter journal units

You can filter specific system-level units by using these parameters:

• include_units: Includes all system-level units specified.
• exclude_units: Excludes all system-level units specified.

Example:

logs:
    - type: journald
      path: /var/log/journal/
      include_units:
          - docker.service
          - sshd.service

In Datadog Agent version 7.37.0+, you can filter user-level units by using these parameters:

• include_user_units: Includes all user-level units specified.
• exclude_user_units: Excludes all user-level units specified.

Note: Use the * wildcard in exclude_units or exclude_user_units to specify a particular Journald log. The * wildcard does not work with include_units. By default, if there are no units for neither system nor user, and no matches are defined, all journal logs are collected.

Example:

logs:
    # Collect all system-level unit logs.
    - type: journald
      exclude_user_units:
          - '*'

Filter journal messages

In Datadog Agent version 7.39.0+, you can filter arbitrary messages using key-value pairs with these parameters:

• include_matches: Includes messages matching key=value
• exclude_matches: Excludes messages matching key=value

Example:

logs:
    - type: journald
      path: /var/log/journal/
      include_matches:
          - _TRANSPORT=kernel

Tailing the same journal multiple times

If you want to report units with different source or service tags, these must appear in separate journald configs.

In order to do this you must uniquely identify the journal config with a config_id (available in agent 7.41.0+).

logs:
    - type: journald
      config_id: my-app1
      source: my-app1
      service: my-app1
      include_units:
          - my-app1.service

    - type: journald
      config_id: my-app2
      source: my-app2
      service: my-app2
      include_units:
          - my-app2.service

Collect container tags

Tags are critical for finding information in highly dynamic containerized environments, which is why the Agent can collect container tags in journald logs.

This works automatically when the Agent is running from the host. If you are using the containerized version of the Datadog Agent, mount your journal path and the following file:

• /etc/machine-id: this ensures that the Agent can query the journal that is stored on the host.

Validation

Run the Agent’s status subcommand and look for journald under the Logs Agent section.

Data Collected

Metrics

journald does not include any metrics.

Service Checks

journald does not include any service checks.

Events

journald does not include any events.

Troubleshooting

Need help? Contact Datadog support.