Is rsyslog redundant on when using journald?

Solution 1:

From Red hat documentation, using the journal

The Journal is a component of systemd that is responsible for viewing and management of log files. It can be used in parallel, or in place of a traditional syslog daemon, such as rsyslogd.

From Red had documentation, rsyslog journal interaction

By default, rsyslogd uses the imjournal module as a default input mode for journal files.

From Red hat documentation, journal storage

With persistent logging enabled, journal files are stored in /var/log/journal which means they persist after reboot. Journal can then replace rsyslog for some users (but see the chapter introduction).

Based on this I would say that rsyslog is redundant if journald persistent storage is enabled and there are no applications that depend on the specific files and format produced by rsyslog, the content is the same.

Solution 2:

We solved this by not creating /var/log/journal (so that journalctl stuff is ephemeral) and setting up rsyslog to store everything from journald in a new logfile. We often have to debug our deployments post-mortem, and grepping through logfiles is (for us old-timers) much easier than learning a new obscure command language.

:syslogtag, startswith, "systemd" /var/log/systemd.log

We also learned that the "/etc/rsyslog.d/listen.conf" that systemd installs is an essential part of the glue; one of our components inadvertently wiped out the

$IncludeConfig /etc/rsyslog.d/*.conf

and we got nothing from journald.