[systemd-devel] Why systemd-journald is creating '/var/log/journal/machine_id" directory when Storage=auto

[Michael Chapman]

On Sun, 29 Aug 2021, Nishant Nayan wrote:
> Awesome, thanks!
> 
> Also, where can I find the code section where services And kernel logs to
> journald?
> After tracing from 'main' at journald.c I came across the part where
> various sockets are opened and validated (/run/systemd/journal/stdout,
> /dev/kmsg, /dev/log ) for journald to listen to logs of systemd services
> and kernel. That is the server side part.
> 
> Where can I find the client side journald code where services and kernel
> sends their logs to journal.

If programs are using sd-journal, they are using the code 
from src/libsystemd/sd-journal/.

Programs can also implement the journal protocol themselves, using the 
documentation at:

    https://systemd.io/JOURNAL_NATIVE_PROTOCOL/

The kernel doesn't do any of this, of course. journald *reads* from the 
kernel ring buffer.