Sean Maguire wrote:
That meant that rsyslog would listen on that socket and journald would send
log entries there. See "ForwardToSyslog" in journald.conf (5). Now the
default is to use the rsyslog "imjournal" module to get logs from the
journal.
We (I) always change the setting on our servers to the earlier
configuration due to warnings about performance in
https://rsyslog.readthedocs.io/en/latest/configuration/modules/imjournal.html
readthedocs does not maintain the current rsyslog docs, the docs were uploaded
there by someone outside of the rsyslog team and they will not allow the rsyslog
team to update them
there isn't a performance problem with the systemd journal database, but in
versions of journald several years ago, there was possible corruption that
rsyslog did not catch and lead to infinite loops of messages. That should no
longer be a problem.
journald deliberately refuses to pass data to rsyslog using the ForwardToSyslog
method that is available via the imjournal module, so I would suggest comparing
the two.
David Lang
-Sean
On Mon, Jul 1, 2024 at 5:47 AM Ricardo Esteves via rsyslog <
rsyslog@lists.adiscon.com> wrote:
Hi,
On RHEL7 (and clones) systemd package included /etc/rsyslog.d/listen.conf:
$SystemLogSocketName /run/systemd/journal/syslog
which made rsyslog get the logs from journald right?
On RHEL8 (and clones) this file is not included anymore. Does anyone
knows why?
I see that on RHEL8 rsyslog.conf now includes the module imjournal to
get the logs directly from journald db.
Though on rsyslog documentation says its not recommended because is
quite heavy.
Is the documentation still accurate about this? If yes what would be the
correct way (less heavy) to get logs from journald into rsyslog?
Best regards,
Ricardo Esteves.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
