Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Is it possible to directly forward logs from journald to a Remote-Log-Server? I only see the option ForwardToSyslog in the /etc/systemd/journald.conf config file.
Or do I have to forward it to syslogd and then configure rsyslog?
Journald does not allow for TCP forwarding as far as I know. You would indeed have to duplicate its messages to syslog.
This feature had been requested, the official recommendation is to use netlogd for that, which will take care of border cases like network going up/down.
Required, but never shown