Journalctl and syslog: How does it actually work? [closed]

Solution 1:

The link(s) between journald and rsyslog is controlled on the rsyslog side through the use of its input and output modules; there is an imjournal and omjournal for reading from and writing to the journal respectively.

So if you write something to rsyslog, it will only appear in journald if you've configured the omjournal module.

rsyslog "owns" /var/log/messages, the usual syslog API will allow applications to write to it. Journal messages can also end up there, if the imjournal module is configured.

This short RHEL guide explains things in pretty much the same way.