System Logs & Security Events

Application logs go to stdout/stderr and land in the systemd journal; high-signal events are additionally emitted as one-line JSON for machine ingestion. Optionally, the most security-relevant events can also be mirrored to an append-only file outside the database. This page covers both layers plus the retention/PII considerations.

Reading the journal

journalctl -u chinaski@<N> -f                         # tail the live stream
journalctl -u chinaski@<N> -o json --since '1 hour ago' | grep -F '"event"'

Plain-text [chinaski] … lines and structured JSON lines share the stream; the grep filter isolates the structured set.

The structured events (JSON)

Documented events and their levels/fields:

Event	Level	Fields
`login_success`	info	user, role, ip
`login_failure`	warn	user, ip, reason
`login_lockout`	warn	ip, wait_seconds
`setup_completed`	info	user
`build_started`	info	triggered_by
`build_finished`	info/error	status, files_written, error_count
`webhook_fired`	info	url_host, status_code

In addition, a broader set of security events is mirrored to the external log when configured (see below).

PII and retention

The ip fields contain the requesting client’s IP address, necessary for security forensics (correlating login attempts, lockouts) but personal data under GDPR/CCPA. The README ships a retention-policy sample for journald:

# /etc/systemd/journald.conf.d/chinaski.conf
[Journal]
SystemMaxUse=2G          # cap disk use
MaxRetentionSec=30day    # auto-prune after N days

Reload the journal with systemctl restart systemd-journald. If logs ship to an external SIEM, apply matching retention there.

External security log

Setting security log destination (Settings → Security) to a file path enables a second channel: the listed high-signal security events (login success/failure, lockout and suspended account, SSO login, stale-session clears, honeypot probes, registration rate-limiting) are appended as JSON lines to that file (created mode 0600). The point is forensics durability: the journal survives a compromise of the SQLite database.