I have been investigating about these three logging solutions auditd, syslog, and journald, but still there are thing that unclear to me.

According to the things I read, auditd audits events in the kernel and it has very deep and strong view on the system. On the other hand, syslog collects logs from several sources on the system (services), and manages them and organizing them.

My questions:

  1. What is the difference between journald and auditd?
  2. Should I maintain them all together on my server?
  3. which of these components work together and how?
  • 1
    Autitd produces logs, syslog and journald collect them. journald has the ability to forward to syslog. – jordanm Jul 25 at 13:09
  • @jordanm, your comment should be the answer. – U880D Sep 22 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.