Skip to content
share library_books

Journald Logs Integration

Sematext offers a Journald logs receiver endpoint. Everything you need to do is to tell Journald to send logs to it.

Sematext Journald Logs Quick Start

First install systemd-journal-remote on your machine.

sudo yum install systemd-journal-remote
sudo yum install systemd-journal-remote
sudo apt-get install systemd-journal-remote
sudo apt-get install systemd-journal-remote
sudo yum install systemd-journal-remote
sudo yum install systemd-journal-remote

Edit the /etc/systemd/journal-upload.conf file and change the URL property.

[Upload]
URL=http://logsene-journald-receiver.sematext.com:80/YOUR_LOGS_TOKEN

# For EU Region
# URL=http://logsene-journald-receiver.eu.sematext.com:80/YOUR_LOGS_TOKEN

If you don't feel like editing files manually, you can run a sed command instead that will edit the file.

sudo sed -i -E 's/(\#\s)?URL=.*/URL=http:\/\/logs-journald-receiver.sematext.com:80\/YOUR_LOGS_TOKEN/g' /etc/systemd/journal-upload.conf
sudo sed -i -E 's/(\#\s)?URL=.*/URL=http:\/\/logs-journald-receiver.eu.sematext.com:80\/YOUR_LOGS_TOKEN/g' /etc/systemd/journal-upload.conf

Once the configuration is done, you enable and run the systemd-journal-remote.

systemctl enable systemd-journal-upload
systemctl start systemd-journal-upload

It behaves like any other Systemd daemon. You can check the status with:

systemctl status systemd-journal-upload

Note: A bug in systemd-journal-upload service does not allow using HTTPS URL. You could use a local HTTPS reverse proxy to https://logsene-journald-receiver.sematext.com

Sematext Journald Logs Troubleshooting

In some cases your last stored cursor is larger than 10 MB, which will fail because the HTTP request size is too large. You can write a new cursor to /var/lib/systemd/journal-upload/state, or take the journal cursor from the output of journalctl -f | head -c 1 | grep __CURSOR.

If your old logs are less important, a quick way is to shrink your logs, before starting to ship them to Sematext is with setting the vacuum-size to less than 10 MB.

journalctl --vacuum-size=9M

After any changes don't forget to restart the daemon.

systemctl restart systemd-journal-upload