replacing rsyslogd in minimal with journald [was Re: systemd requires HTTP server and serves QR codes]

Lennart Poettering mzerqung at
Wed Oct 10 12:03:49 UTC 2012

On Wed, 10.10.12 09:50, Björn Persson (bjorn at rombobjö wrote:

> Lennart Poettering wrote:
> > On Tue, 09.10.12 09:09, Chris Adams (cmadams at wrote:
> > > How do you read this log when the system is not running (e.g.
> > > mounting filesystems of a drive on another system, running from a
> > > rescue image, etc.)?
> > 
> > journalctl -D <pathtothejournalfiles>
> So the rescue system (which might not always be Fedora) must have 
> journalctl installed. Is the file format stable, or can it break if the 
> rescue system has a different version of journalctl? Is the format 
> perchance even documented so that other tools for reading logs could be 
> written?

Yes, they need journalctl installed. Yes, the format is stable, we
haven't broken it since we first came up with it, and we are happy with
it so it is unlikely that we will break it any time soon. The format is
designed to be extensible while staying compatible and there are two bit
flag fields in the header that encode feature flags that allow us to
evolve the format as needed while still clarifying the level of
compatibility. That means the newest journalctl should always be capable
to read all old files, and to a lesser degree even old journalctls
decode newer files.

Since we are quite confident that the design of the file format is
pretty OK I actually intend to document it in the systemd wiki
soon. Maybe this will happen already by the time F18 is released, but
most likely around F19 the latest.


Lennart Poettering - Red Hat, Inc.

More information about the devel mailing list