We have both systemd-journald and rsyslog running on our linux box, and we have to make a decision bewteen these two for managing our application logs. From what we've known (please correct me if I'm wrong).

systemd-journald is a single-thread process which means it could potentially lead to some scaling issues from the long run.

So managing our application logs through TCP over rsyslog might sound the right way to follow, right? Or is there a better way besides these two?


You actually usually run both. Rsyslog then reads messages from the journal. I guess (but am not sure) that the journal cannot receive messages from other log sources (like routers etc), so you need rsyslog in any case if need their logs.

Journal integration is done via imjournal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.