Does journalctl give access to all logs?

Question

In my university we studied about rsyslog, and how it stores logs and where it stores them (/var/log/), and how to configure it ...

Now, I learned (by surfing on the internet) that a new way of storing log files has seen the day with systemd-journald. To access the logs stored by this service you use the command journalctl which I really like the simplicity and the power of this last one. I know also that rsyslog is kept in the latest versions of major Linux distributions, because a lot of packages depends on it.

My question is : by using journalctl to access the log data, am I getting access to all the log data that exists on my system ? or is there a situation where some log data are only accessible using the old way (less /var/log/some_log_file).

To put my question in another way for those who didn't understand it : by using journalctl, could I completely forget about using less /var/log/some_log_file.

Answer 1

• You can't be sure that you actually are receiving all logs without inspecting all the code on your system. Any program is free to log using any mechanism - saving to file, keeping logs in memory for saving when triggered by a signal, or anything else you can think of. In some cases the difference between a "log" and machine-readable content meant for further processing can be a matter of perspective, so there's no solution which fits every program.
• For a simple service, journalctl -u service_name will show the standard output and standard error of that service. Other logging methods like logger can be configured to direct content to the systemd logs.
• Any program which is still logging to files in /var/log probably isn't logging in such a way that the logs are available in journalctl (what would be the point of the redundancy?), but it could.