Re: The impact of removing rsyslog from Trixie

On Tue, 18 Feb 2025 11:01:43 +0100 Yassine Chaouche wrote: > Logcheck could also potentially be impacted, > it reads from syslog an auth.log by default, > but if the user changes configuration it can read from any other > split log files. Logcheck works just fine with journalctl only. Instead o

Re: The impact of removing rsyslog from Trixie

Hi, On Tue, Feb 18, 2025 at 11:01:43AM +0100, Yassine Chaouche wrote: > Le 2/17/25 à 22:52, Dan Ritter a écrit : > > fail2ban > > Logcheck could also potentially be impacted, > it reads from syslog an auth.log by default, The manual pages are right there on your system and on https://manpages.de

Re: The impact of removing rsyslog from Trixie

Le 2/17/25 à 22:52, Dan Ritter a écrit : Greg Wooledge wrote: Do you have any kind of automation that reads log files? Like, that thing whose name I cannot remember right now, that reads ssh's auth.log file looking for repeated failed logins, and updates your firewall rules. fail2ban Logc

Re: The impact of removing rsyslog from Trixie

On Mon, 17 Feb 2025 16:52:13 -0500 Dan Ritter wrote: > Greg Wooledge wrote: > > > > Do you have any kind of automation that reads log files? Like, that > > thing whose name I cannot remember right now, that reads ssh's > > auth.log file looking for repeated failed logins, and updates your > >

Re: The impact of removing rsyslog from Trixie

Greg Wooledge wrote: > > Do you have any kind of automation that reads log files? Like, that > thing whose name I cannot remember right now, that reads ssh's auth.log > file looking for repeated failed logins, and updates your firewall rules. fail2ban

Re: The impact of removing rsyslog from Trixie

On Mon, Feb 17, 2025 at 21:41:33 +0100, jman wrote: > If I wanted to remove rsyslog (because I want just one logging system), how > do I know if it's used anywhere? Your plain text log files will stop being written to. They'll just sit there, frozen in time, forever. Anything that reads them loo

Re: The impact of removing rsyslog from Trixie

Andy Smith writes: Several syslog daemons are packaged in Debian and some of them, particularly rsyslog and syslog-ng, do things that journald does not do. So no, not really, no "encouragement". The simple fact is that most users don't have complex logging needs and journald which is already

Re: The impact of removing rsyslog from Trixie

Hi, On Mon, Feb 17, 2025 at 04:43:49PM +0100, Yassine Chaouche wrote: > It is not removed indeed, > only not installed by default. …and also that already happened in Debian 12… > The signal I got is an encouragement to abandon rsyslog which is > redundant to journalctl. Several syslog daemons a

Re: The impact of removing rsyslog from Trixie

Le 2/17/25 à 15:16, Dan Ritter a écrit : Yassine Chaouche wrote: Hello all, I have a couple of bash/awk scripts that read from text log files to display summary information about what's going with my services, mainly postifx, dovecot, apache and nginx. I just read that trixie is removing rsyslo

Re: The impact of removing rsyslog from Trixie

Hi, On Mon, Feb 17, 2025 at 02:36:35PM +0100, Yassine Chaouche wrote: > I just read that trixie is removing rsyslog, I suggest you re-evaluate your news sources, as that is not factually correct. rsyslog was made non-required in Debian 12 (bookworm). It remains packaged in Debian and will still

Re: The impact of removing rsyslog from Trixie

Yassine Chaouche wrote: > Hello all, > > I have a couple of bash/awk scripts that read from text log files > to display summary information about what's going with my services, > mainly postifx, dovecot, apache and nginx. > I just read that trixie is removing rsyslog, "removing"? Or not installi

Re: The impact of removing rsyslog from Trixie

On Mon, Feb 17, 2025 at 14:36:35 +0100, Yassine Chaouche wrote: > I just read that trixie is removing rsyslog, [citation needed] says: * trixie (testing) (admin): reliable system and kernel logging daemon 8.2412.0-1: amd64 arm64 armel armhf