journald

journald is part of systemd and replaces traditional syslog. It captures log messages from the kernel, system services, and applications, storing them in a binary journal database rather than plain-text files.

Key features include structured logging (metadata attached to each message), automatic log rotation, and efficient storage. You view logs using the journalctl command, which can filter by service, priority, time range, and more.

Example: journalctl -u nginx -n 50 shows the last 50 lines from the nginx service's journal. Unlike /var/log/ files, journald logs are lost on reboot by default (unless persistent storage is configured), and all logs are typically viewable only by root or the systemd-journal group.