systemd journal — JSON export

systemd journal — JSON export. journalctl serializes journal entries to JSON; strings, arrays, byte arrays and null have distinct meanings.

Source and collection

Binary .journal files under /run/log/journal or /var/log/journal; journalctl -o json provides a textual export.

Check journald storage policy, namespace, rate limiting and access. Export selected authorized entries with journalctl -o json.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 5

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: d868b81686aa408c6c0551b64273368d99635a097cd53ebcd843db6e8580eada

{
  "MESSAGE" : "Hello World",
  "_UDEV_DEVNODE" : "/dev/waldo",
  "_UDEV_DEVLINK" : [ "/dev/alias1", "/dev/alias2" ],
  "BINARY" : [ 116, 104, 105, 115, 32, 105, 115, 32, 97, 32, 98, 105, 110, 97, 114, 121, 32, 118, 97, 108, 117, 101, 32, 7 ],
  "LARGE" : null
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`MESSAGE`	str
`_UDEV_DEVNODE`	str
`_UDEV_DEVLINK`	array
`_UDEV_DEVLINK[0]`	str
`BINARY`	array
`BINARY[0]`	int
`LARGE`	NoneType

MESSAGE: Application message.
_UDEV_DEVLINK: Repeated values become a JSON array.
BINARY: Non-text bytes become a numeric array.
LARGE: null can represent a field omitted because of its size.

Investigation uses

Test parsers against scalar strings, repeated fields, binary arrays and null values.
For real events, correlate _BOOT_ID, process identifiers and timestamps; these metadata fields are absent from this format-demonstration sample.

Validation boundaries

This is the publisher’s serialization demonstration, not a captured security event. JSON is not the binary journal file format.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Journal Export Formats

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.