In my university we studied about rsyslog, and how it stores logs and where it stores them (/var/log/), and how to configure it ...

Now, I learned (by surfing on the internet) that a new way of storing log files has seen the day with systemd-journald. To access the logs stored by this service you use the command journalctl which I really like the simplicity and the power of this last one. I know also that rsyslog is kept in the latest versions of major Linux distributions, because a lot of packages depends on it.

My question is : by using journalctl to access the log data, am I getting access to all the log data that exists on my system ? or is there a situation where some log data are only accessible using the old way (less /var/log/some_log_file).

To put my question in another way for those who didn't understand it : by using journalctl, could I completely forget about using less /var/log/some_log_file.


1 Answer 1

  • You can't be sure that you actually are receiving all logs without inspecting all the code on your system. Any program is free to log using any mechanism - saving to file, keeping logs in memory for saving when triggered by a signal, or anything else you can think of. In some cases the difference between a "log" and machine-readable content meant for further processing can be a matter of perspective, so there's no solution which fits every program.
  • For a simple service, journalctl -u service_name will show the standard output and standard error of that service. Other logging methods like logger can be configured to direct content to the systemd logs.
  • Any program which is still logging to files in /var/log probably isn't logging in such a way that the logs are available in journalctl (what would be the point of the redundancy?), but it could.
  • 1
    See freedesktop.org/software/systemd/man/…: Usual messages via syslog call will be visible in the local journalctl. Messages received from other nodes (syslog deamon listening on port 514) will -- by default -- not be shown.
    – PerlDuck
    Apr 23, 2018 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.