In my university we studied about rsyslog
, and how it stores logs and where it stores them (/var/log/
), and how to configure it ...
Now, I learned (by surfing on the internet) that a new way of storing log files has seen the day with systemd-journald
. To access the logs stored by this service you use the command journalctl
which I really like the simplicity and the power of this last one. I know also that rsyslog
is kept in the latest versions of major Linux distributions, because a lot of packages depends on it.
My question is : by using journalctl
to access the log data, am I getting access to all the log data that exists on my system ? or is there a situation where some log data are only accessible using the old way (less /var/log/some_log_file
).
To put my question in another way for those who didn't understand it : by using journalctl
, could I completely forget about using less /var/log/some_log_file
.
journalctl
only acesssystemd-journald
logs: askubuntu.com/questions/864722/where-is-journalctl-data-stored so you still need to read logs created through syslog and other logs created by apps (like access log for webservers etc).