Ubuntu – Relationship of rsyslog and journald on Ubuntu 16.04

16.04loggingrsyslogserversystemd-journald

I am running what is a vanilla Ubuntu 16.04 server, and I'm trying to wrap my head around how logging is set up by default. I can see that both journald and rsyslog are installed and running, but it's not at all clear to me how log messages are being processed.

Most messages seem to show up both in /var/log/syslog and via journalctl, but I can't see any explicit configuration for forwarding between the two in either /etc/systemd/journald.conf (which is basically all commented out by default), /etc/rsyslog.conf or /etc/rsyslog.d/50-default.conf.
I tried to look for official documentation, or even a blog post explaining how hese two are set up in Ubuntu, but haven't managed to find anything.

To further add to my confusion, I have executed logger -p local1.info Test on the host, and found that nothing was written to /var/log/syslog, while the message did show up under journalctl.

My questions are:

  1. How exactly do journald and rsyslog work together on Ubuntu 16.04 (by default)?
  2. How come messages sent from logger seemingly end up in the journal, but not in syslog?

Update: Turns out logger not working as expected was a mistake on my end, so it's not relevant to the main question.

Best Answer

By default rsyslog is using "imuxsock" module, the module provides:

the ability to accept syslog messages via local Unix sockets. Most importantly, this is the mechanism by which the syslog(3) call delivers syslog messages to rsyslogd [1].

It is possible for rsyslog to import structured log messages from systemd-journal using a module named "imjournal" [2].

It can be load like:

module(load="imjournal")

in:

/etc/rsyslog.conf

In the other hand "systemd-journald" captures all data itself:

man systemd-journald

systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sources:

   ·   Kernel log messages, via kmsg
   ·   Simple system log messages, via the libc syslog(3) call
   ·   Structured system log messages via the native Journal API, 
       see sd_journal_print(4)
   ·   Standard output and standard error of system services
   ·   Audit records, via the audit subsystem

You can disable rsyslogd while you still have access to system logs using journalctl.

$ sudo systemctl mask rsyslogd
$ sudo systemctl stop syslog.socket
$ sudo systemctl stop rsyslog.service
$ systemctl is-active rsyslog.service 
inactive
$ logger -p mail.info Helllooo
$ journalctl

For example, centos is using "imuxsock" module to capture all "systemd-journald" data via rsyslog while opensuse does not have "syslog" at all.

To find out why your message didn't end up to /var/log/syslog, you should check this file:

less /etc/rsyslog.d/50-default.conf

look for *.info, see where they will be stored, it might be an other file like messages.

For me it show up in both journalctl and syslog.

Related Question