Console & journald — STDOUT Logging and systemd Integration

In addition to file-based logging, MideyeServer writes log entries to the console (STDOUT). On Linux systems using systemd, console output is automatically captured by the systemd journal (journald), providing centralized access to logs from all services.

Key features:

Real-time log streaming with journalctl
Structured metadata (service unit, PID, priority)
Automatic log rotation and retention
Integration with systemd’s logging ecosystem
Can be forwarded to remote syslog servers

Console appender configuration

<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
    <layout class="ch.qos.logback.classic.PatternLayout">
        <Pattern>
            ${FILE_LOG_PATTERN}
        </Pattern>
    </layout>
</appender>

<!-- Attached at DEBUG level -->
<root level="DEBUG">
    <appender-ref ref="STDOUT"/>
</root>

Log format

Console output uses the same format as file logs:

%date{yyyy-MM-dd HH:mm:ss.SSSXXX, UTC} %-5level [%thread] %logger{0}: %msg%n

Viewing console logs

Using journalctl (systemd)

On Linux systems with systemd, view MideyeServer console output:

# View all MideyeServer logs
sudo journalctl -u mideyeserver6

# Follow logs in real-time (like tail -f)
sudo journalctl -u mideyeserver6 -f

# Show only logs from today
sudo journalctl -u mideyeserver6 --since today

# Show logs from the last hour
sudo journalctl -u mideyeserver6 --since "1 hour ago"

# Show logs since boot
sudo journalctl -u mideyeserver6 -b

# Show only ERROR and higher
sudo journalctl -u mideyeserver6 -p err

# Last 100 lines
sudo journalctl -u mideyeserver6 -n 100

# Export to file
sudo journalctl -u mideyeserver6 > mideyeserver-journal.log

Priority levels

journalctl priority filters:

Priority	journalctl flag	Logback level
`emerg`	`-p 0`	N/A
`alert`	`-p 1`	N/A
`crit`	`-p 2`	N/A
`err`	`-p 3`	ERROR
`warning`	`-p 4`	WARN
`notice`	`-p 5`	N/A
`info`	`-p 6`	INFO
`debug`	`-p 7`	DEBUG

Example: Show only WARN and ERROR:

sudo journalctl -u mideyeserver6 -p warning

Searching logs

# Search for specific text
sudo journalctl -u mideyeserver6 | grep "Authentication failed"

# Case-insensitive search
sudo journalctl -u mideyeserver6 | grep -i "error"

# Search with context (3 lines before/after)
sudo journalctl -u mideyeserver6 | grep -C 3 "NullPointerException"

# Filter by date range
sudo journalctl -u mideyeserver6 --since "2026-02-24" --until "2026-02-25"

Viewing other service logs

# All systemd services
sudo journalctl

# All logs since last boot
sudo journalctl -b

# Kernel messages
sudo journalctl -k

# All ERROR messages from any service
sudo journalctl -p err

Journal configuration

Journal storage

By default, the systemd journal stores logs in /run/log/journal/ (volatile, cleared on reboot). To persist across reboots:

Check current storage mode
Terminal window
```
sudo journalctl --header | grep "State"
```

Enable persistent storage

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

Verify persistent storage
Terminal window
```
sudo journalctl --verify
```

Retention and size limits

Configure journal retention in /etc/systemd/journald.conf:

[Journal]
# Store journal on disk
Storage=persistent

# Limit total journal size to 1GB
SystemMaxUse=1G

# Each journal file max 100MB
SystemMaxFileSize=100M

# Keep journal data for 30 days
MaxRetentionSec=30d

# Keep at least 100MB free on disk
SystemKeepFree=100M

After editing, restart journald:

sudo systemctl restart systemd-journald

Verify settings

# Show current journal disk usage
sudo journalctl --disk-usage

# Vacuum old logs (force cleanup)
sudo journalctl --vacuum-time=7d    # Keep 7 days
sudo journalctl --vacuum-size=500M  # Keep 500MB max

Forwarding journal to remote syslog

Forward all systemd journal entries (including MideyeServer) to a remote syslog server.

Method 1: journald ForwardToSyslog

[Journal]
ForwardToSyslog=yes
MaxLevelSyslog=info

sudo systemctl restart systemd-journald

This sends journal entries to the local syslog daemon (rsyslog/syslog-ng), which then forwards to remote servers using its own configuration (see Syslog).

Method 2: systemd-journal-remote

For direct journal-to-journal forwarding without syslog, use systemd-journal-remote.

On the receiving server:

Debian / Ubuntu
RHEL / Rocky

sudo apt-get install systemd-journal-remote
sudo systemctl enable systemd-journal-remote.socket
sudo systemctl start systemd-journal-remote.socket

sudo dnf install systemd-journal-remote
sudo systemctl enable systemd-journal-remote.socket
sudo systemctl start systemd-journal-remote.socket

On the MideyeServer host:

Debian / Ubuntu
RHEL / Rocky

sudo apt-get install systemd-journal-upload

sudo dnf install systemd-journal-remote

Configure the upload target:

sudo systemctl edit systemd-journal-upload.service

Add:

[Service]
Environment="SYSTEMD_JOURNAL_UPLOAD_URL=http://remote-server:19532"

sudo systemctl enable systemd-journal-upload
sudo systemctl start systemd-journal-upload

Method 3: rsyslog imjournal module

Configure rsyslog to read from the journal and forward:

# Load imjournal module
module(load="imjournal"
       StateFile="/var/spool/rsyslog/imjournal.state"
       RateLimit.Interval="10"
       RateLimit.Burst="30000")

# Forward all journal entries
*.* @@remote-syslog.example.com:514

sudo systemctl restart rsyslog

This is the most flexible approach for existing rsyslog infrastructure.

Disabling console appender

If console logging is not needed (e.g., you only use file logs or forward files to aggregators), disable the STDOUT appender to reduce overhead.

Option 1: Remove appender reference

<!-- Comment out STDOUT root logger -->
<!--
<root level="DEBUG">
    <appender-ref ref="STDOUT"/>
</root>
-->

Option 2: Increase threshold

Reduce verbosity by increasing the level:

<!-- Only log ERROR to console -->
<root level="ERROR">
    <appender-ref ref="STDOUT"/>
</root>

Option 3: Remove appender entirely

Delete the <appender name="STDOUT"> block and all references to it.

Windows console logging

On Windows, console output is typically not visible unless running MideyeServer in non-service mode.

Stop the MideyeServer service

Run MideyeServer from command line

cd "C:\Program Files (x86)\Mideye Server 6\bin"
mideyeserver.exe --console

View console logs in the terminal window

For service-based installations, use the file logs (mideyeserver.log) or Windows Event Log instead (see Windows Event Log).

Structured logging with journald

The systemd journal supports structured logging with key-value pairs. While MideyeServer’s default Logback configuration outputs plain text, the journal adds its own structured metadata.

View structured data:

sudo journalctl -u mideyeserver6 -o json-pretty

Example output:

{
  "MESSAGE": "Application 'MideyeServer' is running!",
  "PRIORITY": "6",
  "SYSLOG_FACILITY": "3",
  "SYSLOG_IDENTIFIER": "java",
  "_SYSTEMD_UNIT": "mideyeserver6.service",
  "_PID": "12345",
  "_HOSTNAME": "mideyeserver01"
}

Filter by structured fields:

# Show only logs from specific PID
sudo journalctl _PID=12345

# Show only from specific unit
sudo journalctl _SYSTEMD_UNIT=mideyeserver6.service

Troubleshooting

No console output in journalctl

Check service configuration:

sudo systemctl status mideyeserver6

Verify StandardOutput and StandardError are set to journal (or not set, which defaults to journal):

[Service]
StandardOutput=journal
StandardError=journal

Reload and restart:

sudo systemctl daemon-reload
sudo systemctl restart mideyeserver6

Console appender not writing

Look for errors in journal output:

sudo journalctl -u mideyeserver6 | grep -i "logback\|appender"

Ensure <root> or specific loggers reference STDOUT:

<root level="INFO">
    <appender-ref ref="STDOUT"/>
</root>

Journal disk full

# Check disk usage
sudo journalctl --disk-usage

# Vacuum old logs
sudo journalctl --vacuum-size=500M
sudo journalctl --vacuum-time=7d

Set retention limits in journald.conf (see Retention and size limits above).

Performance issues

If console logging causes performance problems:

Increase root level to reduce volume:

<root level="WARN">
    <appender-ref ref="STDOUT"/>
</root>

Configure journal rate limiting in journald.conf:

[Journal]
RateLimitIntervalSec=30s
RateLimitBurst=10000

Comparison: file logs vs. journal

Feature	File logs (`mideyeserver.log`)	systemd journal
Persistence	Depends on rotation policy	Depends on journal config
Access	Any user with file permissions	Root or users in `systemd-journal` group
Filtering	`grep`, `awk`, text tools	`journalctl` with structured filters
Rotation	Logback configuration	Automatic by journald
Forwarding	File tailing (Filebeat, etc.)	`ForwardToSyslog`, `journal-remote`
Format	Customizable (Logback pattern)	Plain text + structured metadata
Web UI	Yes (Log Files page)	No (command-line only)

Overview: Logback configuration file locations and structure
Log Levels: Configure what gets logged to console
Syslog: Forward logs to syslog servers (including journal → syslog)
Log Aggregators: Modern alternative to syslog for centralized logging