What is Journald?

Journald captures logs from systemd services, kernel messages, syslog, and stdout/stderr of managed processes. Unlike traditional text-based syslog, journald stores logs in a structured binary format enabling efficient querying with journalctl. Key features include automatic log rotation by size and time, boot-separated logs, filtering by unit/priority/time range, and JSON output. Common commands: journalctl -u nginx (service logs), journalctl -b (current boot), journalctl --since "1 hour ago", journalctl -p err (errors only). Journald can forward logs to syslog for compatibility with existing log management tools.