In my university we studied about rsyslog, and how it stores logs and where it stores them (/var/log/), and how to configure it ...

Now, I learned (by surfing on the internet) that a new way of storing log files has seen the day with systemd-journald. To access the logs stored by this service you use the command journalctl which I really like the simplicity and the power of this last one. I know also that rsyslog is kept in the latest versions of major Linux distributions, because a lot of packages depends on it.

My question is : by using journalctl to access the log data, am I getting access to all the log data that exists on my system ? or is there a situation where some log data are only accessible using the old way (less /var/log/some_log_file).

To put my question in another way for those who didn't understand it : by using journalctl, could I completely forget about using less /var/log/some_log_file.


1 Answer 1

  • You can't be sure that you actually are receiving all logs without inspecting all the code on your system. Any program is free to log using any mechanism - saving to file, keeping logs in memory for saving when triggered by a signal, or anything else you can think of. In some cases the difference between a "log" and machine-readable content meant for further processing can be a matter of perspective, so there's no solution which fits every program.
  • For a simple service, journalctl -u service_name will show the standard output and standard error of that service. Other logging methods like logger can be configured to direct content to the systemd logs.
  • Any program which is still logging to files in /var/log probably isn't logging in such a way that the logs are available in journalctl (what would be the point of the redundancy?), but it could.
  • 1
    See freedesktop.org/software/systemd/man/…: Usual messages via syslog call will be visible in the local journalctl. Messages received from other nodes (syslog deamon listening on port 514) will -- by default -- not be shown.
    – PerlDuck
    Apr 23, 2018 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .