Use trusted journal metadata when attributing a Linux log entry

An application-supplied field name and the journal’s own identity metadata have different trust boundaries.

Source facts

The Debian systemd.journal-fields manual identifies underscore-prefixed fields as trusted metadata added by the journal, which client code cannot alter. Examples include process and user identifiers. Non-underscore structured fields, including syslog-related fields, are not validated by the journal. For stdout or stderr from forked processes, the recorded credentials are those of the parent that initiated the journal connection.

Source: Debian systemd manual — systemd.journal-fields(7) — systemd — Debian trixie — Debian Manpages.

Applicability

Review journal field provenance and the forked-output attribution caveat in the Debian trixie manual.

DSE recommendation

DSE recommends using the journal’s attached process, user, boot, and unit context when correlating events. Keep application-provided labels useful but clearly attributed. Preserve the original structured entry where possible instead of copying only the message text into a ticket. Review collectors to ensure they do not flatten trusted and supplied fields into an indistinguishable schema. State the host-trust limitation in incident analysis so field provenance is not overstated as cryptographic proof of the event’s content.

Verification

With a harmless test logger, compare supplied message fields with journal-attached identity metadata in structured output. Confirm the collection pipeline retains their names and provenance. Check a sample incident query against the original entry before relying on an exported label for attribution. Include a harmless forked-output case and compare the attached credentials with the connection-owning parent. Have the responder explain that limitation before accepting a PID-based attribution in the collection pipeline.

Official reference

Debian systemd manual — systemd.journal-fields(7) — systemd — Debian trixie — Debian Manpages. Reviewed October 20, 2026.