In the past, I have used syslog-ng or rsyslog to send system logs to a dedicated logging server somewhere else on the network. With systemd however, things like the sudo commands that previously were stored in /var/log/secure or /var/log/auth.log (depending on your distro).
I am aware that /etc/systemd/journald.conf has a
ForwardToSyslog=yes option that would allow me to return to my old ways, but is this seems like an inelegant step backwards. Does systemd have a built-in means of sending logs to a central logging server like Logrhythm, ELK or similar, or setting
ForwardToSyslog=yes the proper way to do this?