Can any one help me in understanding the difference between journald and rsyslog and advantages, disadvantages for each one, which one I should use?
Asked
Active
Viewed 1,342 times
0
-
On modern systems syslogs are redirected into systemd-journald. The latter can forward them to daemons like rsyslogd if configured to do so. Cf. https://stackoverflow.com/a/73714497/14393739 – Rachid K. Sep 14 '22 at 14:17
-
this should be on [unix.se] – phuclv May 27 '23 at 01:37
1 Answers
1
Journald is the part of systemd that deals with logging - systemd, at its core, is in charge of managing services: it starts them up and keeps them alive.
It was originally designed for local logs on desktops – where there are not that many logs. On the other hand, rsyslog was designed for high-performance central log collections from the ground up.
Rsyslog can collect logs from many more sources, including pipes, sockets, and files. File sources are especially important, as many applications – like web servers – log to files and do that at a rate that journald cannot handle.
Both use syslog protocol. So you could use rsyslog and journald on the same machine without any problems.
The rsyslog modules imjournal (input) and omjournal output make it possible for rsyslog to read and write to the journal.
So if you write something to rsyslog, it will only appear in journald if you've configured the omjournal module.
eDonkey
- 606
- 2
- 7
- 25