3

On my personal server I currently have multiple services (web server, mail server, etc) and some of them have their own log files while others log everything to stdout and that gets picked up by the systemd journal.

That means I have separate log files for some services, while others are in the journal; I feel that's inconsistent and I'd like to log everything in the journal so I have only one place to check for logs.

Is that a good idea ? I'm worried some high traffic services (web server) may overload the journal; I'm not sure how resource-hungry logging to the journal is compared to a basic text file.

  • I can't write a comprehensive answer (especially regarding resource usage, which I don't know how to answer) but changing where you store the log is going to change how it's represented which can break analytics software. For example, you can pipe apache logs to syslog but the timestamp/program/tag/etc that syslog adds will make the resulting log indecipherable to programs like webalizer. I would imagine the same would be true of journald as well. – Bratchley Jan 12 '15 at 15:22
  • You may consider only piping errors to journald though. By definition that's (hopefully) a lot more low-flow and if you're needing apache access logs to solve some problem, you're probably already neck-deep in Apache-specific stuff already. – Bratchley Jan 12 '15 at 15:24
  • @Bratchley thanks for your reply; I don't really care about analytics and a high flow isn't a problem for me (but it may be in terms of resources, that's why I'm asking), the journalctl command has sorting functions to deal with that. – user67289 Jan 12 '15 at 15:37
  • @Bratchley you can configure journald to log the journal and also forward to syslog – jordanm Jan 12 '15 at 15:53
  • @jordanm right I'm aware it's possible, I'm just saying I don't have the information required to make an informed statement about how much overhead is involved by introducing journald which is the main part of the OP's question. – Bratchley Jan 12 '15 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy