01Location
- /var/log/journal/<machine-id>/*.journal
- /var/log/journal/<machine-id>/*.journal~
- /run/log/journal/<machine-id>/*.journal (volatile)
02Questions it answers
- What did a service, the kernel or a user process log, and when?
- Which boot session did an event belong to, and when did each boot start and end?
- Which UID, PID, executable and unit produced a message?
- Has a journal file been altered (when sealing is enabled)?
03Format and versions
| Format | Binary journal file: header signature 'LPKSHHRH', objects aligned to 64 bits, optional XZ/LZ4/ZSTD compression of data objects and optional Forward Secure Sealing tags. All times are microseconds. |
|---|---|
| Applies to | systemd main branch documentation as read on 2026-10-14. The default Storage= value is set at compile time by the distribution. |
04Key fields
| Field | What it tells you |
|---|---|
| MESSAGE, PRIORITY, SYSLOG_IDENTIFIER | Message text and client-supplied fields; journald does not validate fields without a leading underscore. |
| _PID, _UID, _GID, _COMM, _EXE, _CMDLINE | Trusted fields added by journald about the originating process; client code cannot alter them. |
| _SYSTEMD_UNIT, _SYSTEMD_USER_UNIT, _SYSTEMD_SESSION | systemd unit and session context of the process. |
| _BOOT_ID, _MACHINE_ID, _HOSTNAME | Boot, machine and host identity. |
| _TRANSPORT | How the entry was received (for example audit, driver, syslog, journal, stdout, kernel). |
| __SEQNUM, __SEQNUM_ID | Sequence number and its ID; monotonically increasing per writer, useful to detect gaps. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| __REALTIME_TIMESTAMP | µs since 1970-01-01 UTC (CLOCK_REALTIME) | Time the entry was received by journald. |
| __MONOTONIC_TIMESTAMP | µs of CLOCK_MONOTONIC, paired with _BOOT_ID | Meaningful only together with the boot ID; usually relative to the start of that boot. |
| _SOURCE_REALTIME_TIMESTAMP | µs since 1970-01-01 UTC | Earliest trusted timestamp of the message if different from reception time. |
| Header head_entry_realtime / tail_entry_realtime | µs since 1970-01-01 UTC | First and last entry times in the file; useful to bound coverage. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy the whole /var/log/journal tree (and /run/log/journal from a live system); journald documentation states journal files are safe to read or copy.
- Read the copy with journalctl --directory or --file and use --utc for output.
- Run --list-boots to map boot IDs to time ranges, then filter by unit, _UID or _COMM.
- Run --verify to check internal consistency (and authenticity when FSS was configured).
07Interpretation pitfalls
- With Storage=auto, data is persistent only if /var/log/journal exists; otherwise it is kept in /run and lost at reboot.
- Archived files are deleted to respect SystemMaxUse/SystemKeepFree, so older periods may be missing.
- Rate limiting can drop messages from noisy services, and a dropped-count message is logged instead.
- Files renamed with a .journal~ suffix were stopped uncleanly or found corrupted; read them but expect gaps.
09Sources
- systemd — Journal File Format systemd project (GitHub) · checked 2026-10-14
- systemd — journald.conf(5) systemd project (GitHub) · checked 2026-10-14
- systemd — systemd.journal-fields(7) systemd project (GitHub) · checked 2026-10-14
- systemd — journalctl(1) systemd project (GitHub) · checked 2026-10-14
- systemd — systemd-journald.service(8) systemd project (GitHub) · checked 2026-10-14
- ForensicArtifacts — artifacts/data/linux.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14