System Logs & Security Events

Application logs go to stdout/stderr and land in the systemd journal; high-signal events are additionally emitted as one-line JSON for machine ingestion. Optionally, the most security-relevant events can also be mirrored to an append-only file outside the database. This page covers both layers plus the retention/PII considerations.

Reading the journal

journalctl -u chinaski@<N> -f                         # tail the live stream
journalctl -u chinaski@<N> -o json --since '1 hour ago' | grep -F '"event"'

Plain-text [chinaski] … lines and structured JSON lines share the stream — the grep filter isolates the structured set.

The structured events (JSON)

Documented events and their levels/fields:

Event	Level	Fields
`login_success`	info	user, role, ip
`login_failure`	warn	user, ip, reason
`login_lockout`	warn	ip, wait_seconds
`setup_completed`	info	user
`build_started`	info	triggered_by
`build_finished`	info/error	status, files_written, error_count
`webhook_fired`	info	url_host, status_code

In addition, a broader set of security events is mirrored to the external log when configured (see below).

PII and retention

The ip fields contain the requesting client’s IP address — necessary for security forensics (correlating login attempts, lockouts) but personal data under GDPR/CCPA. The README ships a retention-policy sample for journald:

# /etc/systemd/journald.conf.d/chinaski.conf
[Journal]
SystemMaxUse=2G          # cap disk use
MaxRetentionSec=30day    # auto-prune after N days

Reload the journal with systemctl restart systemd-journald. If logs ship to an external SIEM, apply matching retention there.

External security log

Setting security log destination (Settings → Security) to a file path enables a second channel: the listed high-signal security events (login success/failure, lockout and suspended account, SSO login, stale-session clears, honeypot probes, registration rate-limiting) are appended as JSON lines to that file (created mode 0600). The point is forensics durability: the journal survives a compromise of the SQLite database.