.. _logs:

Service Logs
=====================================

Service logs provide a complete record of each FindFace Multi component activity. Consulting logs is one of the first things you should do to identify a cause for any system problem.

.. rubric:: In this section:

.. contents::
   :local:

Configure Logging
-----------------------------------------

The FindFace Multi services log a large amount of data, which can eventually lead to disc overload. To prevent this from happening, we advise you to disable ``rsyslog`` due to its suboptimal log rotation scheme and use the appropriately configured ``systemd-journal`` service instead.

Do the following:

#. Check whether the ``/var/log/journal`` directory already exists. If not, create it by executing the following command:

   .. code::

      sudo mkdir /var/log/journal
      sudo chmod 2755 /var/log/journal

#. Open the ``/etc/systemd/journald.conf`` configuration file. Enable saving ``journald`` logs to your hard drive by uncommenting the ``Storage`` parameter and changing its value to ``persistent``. Disable filtering in ``systemd-journal`` as well:

   .. code::

      sudo vi /etc/systemd/journald.conf 

      [Journal]
      ...
      Storage=persistent
      ...
      RateLimitInterval=0
      RateLimitBurst=0
      ...

   If necessary, uncomment and edit the ``SystemMaxUse`` parameter. This parameter determines the maximum volume of log files on your hard drive. Specify its value in bytes or use K, M, G, T, P, E as units for the specified size (equal to :math:`1024`, :math:`1024^2`, ... bytes).

   .. code::

      ...
      SystemMaxUse=3G

#. Restart the ``journald`` service.

   .. code::

      sudo systemctl restart systemd-journald.service 

#. Stop and disable the ``syslog`` service.

   .. code::

      sudo systemctl stop syslog.socket rsyslog.service
      sudo systemctl disable syslog.socket rsyslog.service 

#. If necessary, delete the existing log files created through ``syslog``, and the kernel logs.

   .. code::

      sudo rm /var/log/syslog*
      sudo rm /var/log/kern.log* 


Consult Service Logs
-----------------------------

Use the ``journalctl -u <component>`` command to consult a component log, for example as follows:

.. code::

   journalctl -u findface-extraction-api


.. seealso::
   :ref:`audit-logs`