On Tue, 17 Dec 2019, MAUPERTUIS, PHILIPPE via rsyslog wrote:
Hi list,
I am reviewing the CIS hardening benchmark for Rhel8.
It's state that /etc/systemd/journald.conf must be configured with
ForwardToSyslog=yes for rsyslog to receive the messages.
Is it needed with imjournal ?
For Rhel 8 the default is No and at the same time rsyslog.conf has :
module(load="imjournal" # provides access to the systemd journal
StateFile="imjournal.state") # File to store the position in the journal
there are two ways for the messages to get between journald and rsyslog, one is
for journald to deliver the messages to rsylog (forwardtosyslog) and the other
is for rsyslog to fetch the messages from journald
so either can work, don't do both.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
