systemd logging daemon

[Trevor]

What is the name of the logging daemon that is included with systemd?

[TM]

rsyslog

[Chetan_Tiwary_ · Accepted solution]

systemd-journald.

The systemd-journald service does not keep separate files, as rsyslog does. The idea is to avoid checking different files for issues. Systemd-journald saves the events and messages in a binary format that cannot be read with a text editor. You can query the journal with the journalctl command.

[Trevor]

Chetan for the win!!!

[Trevor]

Hello TM,

Thank you for your response.

Red Hat Enterprise Linux offers two logging solutions - systemd-journald and rsyslog - which can coexist in default configurations. 

Per my question, "What logging daemon is included with systemd", rsyslog would
not be a correct response.  rsyslog is definitely included with RHEL, but it's not a 
component of (included with) systemd.

systemd features its own logging system called journal. There is no need to run a syslog -based service, as all system events are written to the journal. The journal itself is a system service managed by systemd . Its full name is systemd-journald.

rsyslog is a syslog implementation. It can be configured to receive log entries from systemd's journal.

rsyslog is not a direct component of systemd, but it can be used alongside systemd
on Linux systems.

systemd's primary logging mechanism is its own journald service, however, rsyslog
can be configured to access and forward logs from the systemd journal.

A few extra tidbits about systemd-journald:

- The journal is controlled by the systemd-journald daemon.

- The systemd-journald collects information from different sources and loads the
     messages into the journal.

- The systemd journal is a binary file

- The systemd journal is maintained by the systemd-journald daemon

- The systemd daemon uses a centralized logging system called a journal, which is
     managed by the journald daemon.

- The journald daemon collects all log entries generated by the Linux kernel or any
     other systemd unit service regardless of their origin.

[Tracy_Baker]

@TM 

rsyslog is not a daemon. It is the application (service) that handles the information from systemd-journald (the daemon). Red Hat's description:

---

9.1.1. The Rsyslog logging service 

The Rsyslog application, in combination with the systemd-journald service, provides local and remote logging support in Red Hat Enterprise Linux. The rsyslogd daemon continuously reads syslog messages received by the systemd-journald service from the Journal. rsyslogd then filters and processes these syslog events and records them to rsyslog log files or forwards them to other services according to its configuration.

The rsyslogd daemon also provides extended filtering, encryption protected relaying of messages, input and output modules, and support for transportation using the TCP and UDP protocols.

---

It is one of the few times in RH124 (perhaps the only one) where one needs to be careful about the distinction between the rsyslog service and the rsyslogd daemon. Most notably, when one creates a new syslog "rule", one needs to restart the service (rsyslog.service) to have the changes take effect, not the daemon.

systemd-journald is the daemon Trevor was asking about. This daemon keeps its own indexed binary journals rather than flat text files (as the rsyslog service does). As a result, tools sich as vim, less, cat, etc. cannot read the journals; journalctl must be used.

[Trevor]

Thanks TB!  Your response is the equivalent of an exclamantion
mark in punctuating a sentance!!!