cancel
Showing results for 
Search instead for 
Did you mean: 
Trevor
Starfighter Starfighter
Starfighter
  • 934 Views

systemd logging daemon

Jump to solution

What is the name of the logging daemon that is included with systemd?

Trevor "Red Hat Evangelist" Chandler
Labels (3)
1 Solution

Accepted Solutions
Chetan_Tiwary_
Community Manager
Community Manager
  • 910 Views

systemd-journald.

The systemd-journald service does not keep separate files, as rsyslog does. The idea is to avoid checking different files for issues. Systemd-journald saves the events and messages in a binary format that cannot be read with a text editor. You can query the journal with the journalctl command.

View solution in original post

6 Replies
TM
Flight Engineer Flight Engineer
Flight Engineer
  • 914 Views

rsyslog

Chetan_Tiwary_
Community Manager
Community Manager
  • 911 Views

systemd-journald.

The systemd-journald service does not keep separate files, as rsyslog does. The idea is to avoid checking different files for issues. Systemd-journald saves the events and messages in a binary format that cannot be read with a text editor. You can query the journal with the journalctl command.

Trevor
Starfighter Starfighter
Starfighter
  • 889 Views

Chetan for the win!!!

Trevor "Red Hat Evangelist" Chandler
Trevor
Starfighter Starfighter
Starfighter
  • 876 Views

Hello TM,

Thank you for your response.

Red Hat Enterprise Linux offers two logging solutions - systemd-journald and rsyslog - which can coexist in default configurations. 

Per my question, "What logging daemon is included with systemd", rsyslog would
not be a correct response.  rsyslog is definitely included with RHEL, but it's not a 
component of (included with) systemd.

systemd features its own logging system called journal. There is no need to run a syslog -based service, as all system events are written to the journal. The journal itself is a system service managed by systemd . Its full name is systemd-journald.

rsyslog is a syslog implementation. It can be configured to receive log entries from systemd's journal.

rsyslog is not a direct component of systemd, but it can be used alongside systemd
on Linux systems.

systemd's primary logging mechanism is its own journald service, however, rsyslog
can be configured to access and forward logs from the systemd journal.

 

A few extra tidbits about systemd-journald:

The journal is controlled by the systemd-journald daemon.

- The systemd-journald collects information from different sources and loads the
     messages into the journal.

- The systemd journal is a binary file

- The systemd journal is maintained by the systemd-journald daemon

- The systemd daemon uses a centralized logging system called a journal, which is
     managed by the journald daemon.

- The journald daemon collects all log entries generated by the Linux kernel or any
     other systemd unit service regardless of their origin.

 

 

Trevor "Red Hat Evangelist" Chandler
Tracy_Baker
Starfighter Starfighter
Starfighter
  • 873 Views

@TM 

rsyslog is not a daemon. It is the application (service) that handles the information from systemd-journald (the daemon). Red Hat's description:

---

9.1.1. The Rsyslog logging service 

 

The Rsyslog application, in combination with the systemd-journald service, provides local and remote logging support in Red Hat Enterprise Linux. The rsyslogd daemon continuously reads syslog messages received by the systemd-journald service from the Journal. rsyslogd then filters and processes these syslog events and records them to rsyslog log files or forwards them to other services according to its configuration.

The rsyslogd daemon also provides extended filtering, encryption protected relaying of messages, input and output modules, and support for transportation using the TCP and UDP protocols.

---

It is one of the few times in RH124 (perhaps the only one) where one needs to be careful about the distinction between the rsyslog service and the rsyslogd daemon. Most notably, when one creates a new syslog "rule", one needs to restart the service (rsyslog.service) to have the changes take effect, not the daemon.

 

systemd-journald is the daemon Trevor was asking about. This daemon keeps its own indexed binary journals rather than flat text files (as the rsyslog service does). As a result, tools sich as vim, less, cat, etc. cannot read the journals; journalctl must be used.

Program Lead at Arizona's first Red Hat Academy, est. 2005
Estrella Mountain Community College
Trevor
Starfighter Starfighter
Starfighter
  • 869 Views

Thanks TB!  Your response is the equivalent of an exclamantion
mark in punctuating a sentance!!!

Trevor "Red Hat Evangelist" Chandler
Join the discussion
You must log in to join this conversation.