| 1 | # Logs Centralization Points with systemd-journald |
| 2 | |
| 3 | ```mermaid |
| 4 | stateDiagram-v2 |
| 5 | classDef alert fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000 |
| 6 | classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000 |
| 7 | classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000 |
| 8 | classDef database fill:#2196F3,stroke:#000000,stroke-width:3px,color:#000000 |
| 9 | |
| 10 | journalRemote: systemd-journal-remote |
| 11 | journalUpload: systemd-journal-upload |
| 12 | journalFiles: systemd-journal files |
| 13 | journald: systemd-journald |
| 14 | logSources: Local Logs Sources |
| 15 | log2journal: log2journal |
| 16 | log2journal: Convert text, json, logfmt files |
| 17 | log2journal: to structured journal entries. |
| 18 | logsDashboard: Netdata Dashboards |
| 19 | logsQuery: Query Journal Files |
| 20 | textFiles: Text Log Files |
| 21 | |
| 22 | logSources --> journald: journald API |
| 23 | logSources --> textFiles: write to log files |
| 24 | textFiles --> log2journal: tail log files |
| 25 | log2journal --> journald: journald API |
| 26 | journald --> journalFiles |
| 27 | |
| 28 | journalFiles --> Netdata |
| 29 | journalFiles --> journalUpload |
| 30 | |
| 31 | journalRemote --> journalFiles |
| 32 | journalUpload --> [*]: to a remote journald |
| 33 | [*] --> journalRemote: from a remote journald |
| 34 | |
| 35 | state Netdata { |
| 36 | [*] --> logsQuery |
| 37 | logsQuery --> logsDashboard |
| 38 | } |
| 39 | |
| 40 | class logSources,textFiles,logsDashboard alert |
| 41 | class journald,journalRemote,journalUpload neutral |
| 42 | class log2journal,journalFiles,logsQuery complete |
| 43 | class Netdata database |
| 44 | ``` |
| 45 | |
| 46 | Logs centralization points can be built using the `systemd-journald` methodologies, by configuring `systemd-journal-remote` (on the centralization point) and `systemd-journal-upload` (on the production system). |
| 47 | |
| 48 | :::note |
| 49 | |
| 50 | The logs centralization points and the metrics centralization points do not need to be the same. For clarity and simplicity, however, when not otherwise required for operational or regulatory reasons, we recommend to have unified centralization points for both metrics and logs. |
| 51 | |
| 52 | ::: |
| 53 | |
| 54 | A Netdata running at the logs centralization point will automatically detect and present the logs of all servers aggregated to it in a unified way (i.e., logs from all servers multiplexed in the same view). This Netdata may or may not be a Netdata Parent for metrics. |