[SOLVED] journal

linuly · 02-18-2021, 05:38 AM

hi,
i like to see if i understood.
rsyslogd write in /var/log/messages,/var/log/secure so on and systemd-journald write in /var/log/journal if Storage=persistent.

somehow systemd-journald uses rsyslogd to write in /var/log/messages?
Feb 18 06:35:34 Razan1 systemd: Starting The Apache HTTP Server...

in /var/log/journal i can have more data as in /var/log/messages.corect?

hazel · 02-18-2021, 05:49 AM

I think the way it works is that journald makes available a socket, and syslogd and klogd can take their messages from there. They run as independent daemons; journald doesn't run them.

The journal contains the same information as /var/log/messages, but it also contains a lot of meta-information that allows the journalctl program to identify entries and print them out selectively on command. So, for example, you can look at the messages relevant to a particular service that is giving trouble, without having to scroll through a lot of other bumf. The price you pay of course is that the journal is a binary file and you can't inspect it with the usual text tools, only with journalctl.

berndbausch · 02-18-2021, 06:22 AM

hazel's explanation is correct, but RHEL and friends have a different approach. They read from the journal file directly, using a special rsyslogd module. The statement "only journalctl can read the journal" is, therefore, not quite correct.

hazel · 02-18-2021, 06:28 AM

Wow! You learn something every day.

linuly · 02-19-2021, 03:59 AM

i see that all the messages logged by rsyslogd,crond, so on are written centralized by systemd-journald.

ex.

Code:

Feb 19 04:40:01 Razan1 CROND[17405]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Feb 19 04:48:17 Razan1 polkitd[755]: Registered Authentication Agent for unix-process:17481:8648658 (system bus name :1.422 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Feb 19 04:48:17 Razan1 polkitd[755]: Unregistered Authentication Agent for unix-process:17481:8648658 (system bus name :1.422, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Feb 19 04:48:21 Razan1 polkitd[755]: Registered Authentication Agent for unix-process:17491:8649040 (system bus name :1.423 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Feb 19 04:48:21 Razan1 polkitd[755]: Unregistered Authentication Agent for unix-process:17491:8649040 (system bus name :1.423, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Feb 19 04:48:27 Razan1 polkitd[755]: Registered Authentication Agent for unix-process:17509:8649639 (system bus name :1.424 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Feb 19 04:48:27 Razan1 chronyd[747]: chronyd exiting
Feb 19 04:48:27 Razan1 systemd[1]: Stopping NTP client/server...
Feb 19 04:48:27 Razan1 systemd[1]: Stopped NTP client/server.
Feb 19 04:48:27 Razan1 polkitd[755]: Unregistered Authentication Agent for unix-process:17509:8649639 (system bus name :1.424, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Feb 19 04:50:01 Razan1 systemd[1]: Started Session 174 of user root.
Feb 19 04:50:01 Razan1 CROND[17536]: (root) CMD (/usr/lib64/sa/sa1 1 1)

then everything from above without crond and polkitd is logged in messages and crond log in cron.

logger use rsyslogd to lo in messages.rsyslogd does not use logger to log in messages.correct?