The monitoring agent installed on Compute virtual machines can collect journald logs from systemd services and forward them to Logging. This allows you to centralize and analyze system-level logs from your VMs.
Enable journald log collection
To enable journald log collection, you need to set specific labels on your Compute virtual machine. You can do this when creating a VM or by updating an existing one.
Currently, journald log collection is only supported on standalone Compute VMs.
Configuration labels
Use the following labels to configure journald log collection:
| Label | Description | Example value |
|---|
nebius.o11y.systemd-logs-collection.enabled | Enables or disables journald log collection. | true or false |
nebius.o11y.systemd-logs-collection.units | Specifies which systemd units to collect logs from. Separate multiple units with semicolons. If not specified, logs from all units are collected. | sshd.service;docker.service |
How to set labels
When creating a new VM by running nebius compute instance create, include the labels in the .metadata.labels field of your JSON input:nebius compute instance create \
--format json \
- <<EOF
{
"metadata": {
"name": "my-vm",
"labels": {
"nebius.o11y.systemd-logs-collection.enabled": "true",
"nebius.o11y.systemd-logs-collection.units": "sshd.service;docker.service"
}
},
"spec": {
"resources": {
"platform": "cpu-e2",
"preset": "2vcpu-8gb"
},
"boot_disk": {
"attach_mode": "READ_WRITE",
"existing_disk": {
"id": "<boot_disk_ID>"
}
},
"network_interfaces": [
{
"name": "default-subnet",
"subnet_id": "<subnet_ID>",
"ip_address": {}
}
]
}
}
EOF
nebius compute instance update \
--id <VM_ID> \
--labels "nebius.o11y.systemd-logs-collection.enabled=true,nebius.o11y.systemd-logs-collection.units=sshd.service;docker.service"
When creating a new VM, include the labels in the resource configuration:resource "nebius_compute_v1_instance" "my_vm" {
name = "my-vm"
parent_id = "<project_ID>"
labels = {
"nebius.o11y.systemd-logs-collection.enabled" = "true"
"nebius.o11y.systemd-logs-collection.units" = "sshd.service;docker.service"
}
resources = {
platform = "cpu-e2"
preset = "2vcpu-8gb"
}
boot_disk = {
attach_mode = "READ_WRITE"
existing_disk = {
id = nebius_compute_v1_disk.boot_disk.id
}
}
network_interfaces = [
{
name = "default-subnet"
subnet_id = "<subnet_ID>"
ip_address = {}
}
]
}
After updating labels on an existing VM via the CLI or Terraform, you must stop and then start the VM for the changes to take effect. View collected logs
After configuring journald log collection, you can view the collected logs in Grafana®. For instructions on how to connect and query logs, see How to view logs in Grafana®.
Collected attributes
The monitoring agent extracts the following attributes from journald log entries:
| Attribute | Description |
|---|
SYSTEMD_UNIT | The systemd unit that generated the log entry. |
syslog.identifier | The syslog identifier of the process. |
BOOT_ID | A unique identifier for the current boot session. |
CAP_EFFECTIVE | The effective capabilities of the process. |
SYSTEMD_CGROUP | The control group path of the process. |
GID | The group ID of the process. |
PID | The process ID of the process that generated the log. |
UID | The user ID of the process. |
CMDLINE | The command line of the process. |
TRANSPORT | The transport mechanism used to deliver the log (e.g., journal, syslog). |
STREAM_ID | The stream identifier for stdout/stderr streams. |
SYSLOG_FACILITY | The syslog facility number. |
SYSLOG_IDENTIFIER | The syslog identifier string. |
Data enrichment
In addition to the journald attributes, the monitoring agent enriches log entries with the following metadata:
| Attribute | Description |
|---|
instance_id | The unique identifier of the Compute VM. |
container_id | The ID of the VM’s parent project. |
mk8s_cluster_id | The Managed Kubernetes cluster ID, if the VM is a cluster node. |
mk8s_node_group_id | The Managed Kubernetes node group ID, if the VM is a cluster node. |
gpu_cluster_id | The GPU cluster ID, if the VM is part of a GPU cluster. |
See also
