Andy Smith <a...@strugglers.net> writes:
Several syslog daemons are packaged in Debian and some of them,
particularly rsyslog and syslog-ng, do things that journald does not do.
So no, not really, no "encouragement".
The simple fact is that most users don't have complex logging needs and
journald which is already installed fulfills those needs, so there is
literally no need to force the installation of any particular syslog
daemon any more. But they are there if you need them.
I only check logs with journald since long but I am unsure if rsyslog is used. Purging the package
("apt purge rsyslog") does not seem to affect any other package.
If I wanted to remove rsyslog (because I want just one logging system), how do I know if it's used
anywhere?
I have run a reverse dependency check:
$ apt-rdepends --state-follow=Installed --state-show=Installed rsyslog
...
rsyslog
Depends: libc6 (>= 2.38)
Depends: libestr0 (>= 0.1.9)
Depends: libfastjson4 (>= 0.99.8)
Depends: liblognorm5 (>= 2.0.3)
Depends: libsystemd0 (>= 246)
Depends: libuuid1 (>= 2.16)
Depends: libzstd1 (>= 1.5.5)
Depends: zlib1g (>= 1:1.1.4)
...
Would these packages be affected?
I use Debian/Trixie, rsyslog configured as per default installation. What would happen to the
following files I see mentioned in /etc/rsyslog.conf?
auth,authpriv.* /var/log/auth.log
cron.* -/var/log/cron.log
kern.* -/var/log/kern.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
Thanks
