Thanks Hakan, this helps. I'm not experienced with logging in the unix world. Maybe someone explain me the following. I did "backintime backup" in a terminal. This is one of the "syslog" entries I can see via "journalctl". Jul 19 08:57:13 quark python3[2796]: backintime (user/1): INFO: Unlock It seems that "python3[2796]" is the identifier of this syslog entry. But I'm not sure. Then I used "journalctl -o json-pretty" to identify the fields used. Please have a look at "MESSAGE" and "_SYSTEMD_UNIT". { "_HOSTNAME" : "quark", "_SYSTEMD_SLICE" : "user-1000.slice", "_SYSTEMD_UNIT" : "session-4.scope", "_AUDIT_SESSION" : "4", "_BOOT_ID" : "11130cdbf5ef4f978996e5141ea02c08", "__CURSOR" : "s=d810a315c1904023a90d28c39f2c29cb;i=636;b=11130cdbf5ef4f978996e5141ea02c08;m=217b11c9;t=600d18a977d65;x=d26305f2057e735d", "_MACHINE_ID" : "bb7f774ca75c426fad9008668d88a2ae", "__MONOTONIC_TIMESTAMP" : "561713609", "_SYSTEMD_OWNER_UID" : "1000", "_PID" : "2796", "_COMM" : "python3", "_CMDLINE" : "python3 -Es /usr/share/backintime/common/backintime.py backup", "SYSLOG_FACILITY" : "1", "_SYSTEMD_USER_SLICE" : "-.slice", "_SYSTEMD_SESSION" : "4", "_CAP_EFFECTIVE" : "0", "SYSLOG_TIMESTAMP" : "Jul 19 08:57:13 ", "__REALTIME_TIMESTAMP" : "1689749833612645", "_SYSTEMD_INVOCATION_ID" : "aef81fe893b44b11a78c64c7f60f6d7b", "_SOURCE_REALTIME_TIMESTAMP" : "1689749833612597", "MESSAGE" : "backintime (user/1): INFO: Unlock", "_AUDIT_LOGINUID" : "1000", "_EXE" : "/usr/bin/python3.9", "_SELINUX_CONTEXT" : "unconfined\n", "_TRANSPORT" : "syslog", "_UID" : "1000", "_SYSTEMD_CGROUP" : "/user.slice/user-1000.slice/session-4.scope", "_GID" : "1000", "PRIORITY" : "6" } Here I can not find the "python3[2796]" as identifier. The field "SYSLOG_IDENTIFIER" is missing. The first part of the MESSAGE ("backintime (user/1)" is the identifier used by backintime itself [1]. def openlog(): name = os.getenv('LOGNAME', 'unknown') syslog.openlog("%s (%s/1)" %(APP_NAME, name)) atexit.register(closelog) def changeProfile(profile_id): name = os.getenv('LOGNAME', 'unknown') syslog.openlog("%s (%s/%s)" %(APP_NAME, name, profile_id)) It confuse me that the ident value used by BIT in code becomes part of the MESSAGE. I would expect that it would become an extra field in the journalctl json output. In the end I ask myself how to read logs related to BackInTime when I'm not able to do something like "journalctl -u backintime*". I'm confused. Shouldn't it be easier and more reliable as "journalctl | grep backintime" to get all related BIT log entries? [1] -- <https://github.com/bit-team/backintime/blob/71c9657324c0e08dd3288dbff830dd90...>