systemd-journald

systemd-journald is the logging daemon that replaces traditional syslog on modern Linux systems. It captures log output from all sources—the kernel, systemd services, and user applications—and stores them in a structured binary format rather than plain-text files.

Key features include automatic indexing by priority, service name, and timestamp; efficient disk usage through binary storage; and protection against log injection attacks. Logs are typically stored in /var/log/journal/ or /run/log/journal/.

You query the journal using journalctl, the companion command-line tool. For example, journalctl -u nginx shows all logs from the nginx service, while journalctl -p err displays only error-level messages.

journald can be configured to forward logs to traditional syslog if needed, making it compatible with existing logging infrastructure while providing modern advantages like fast searching and structured metadata.