I have been investigating about these three logging solutions
journald, but still there are thing that unclear to me.
According to the things I read,
auditd audits events in the kernel and it has very deep and strong view on the system. On the other hand,
syslog collects logs from several sources on the system (services), and manages them and organizing them.
- What is the difference between
- Should I maintain them all together on my server?
- which of these components work together and how?