Linux Logging Concepts
Internal
Overview
Linux system logging is managed by two systems: rsyslogd and journald, which is a component of systemd. The logging systems coexist. journald is the primary tool for troubleshooting.
rsyslogd
rsyslogd comes configured by default to write logging information into files like /var/log/messages, and it can be configured to provide additional filtering, encryption and log information relaying to external systems.
The main rsyslogd configuration file is /etc/rsyslog.conf, which, among other things, lists all log files maintained by rsyslogd (/var/log/messages, /var/log/secure, /var/log/cron, /var/log/boot.log, etc.). For more details about rsyslogd configuration, see:
rsyslogd-managed log files can be automatically rotated. The logrotate package contains a cron task that rotates log files based on the configuration found in /etc/logrotate.conf and /etc/logrotate.d/. For more details on how to configure log rotation see:
journald
journald daemon is a component of systemd.
It handles syslog, kernel, and early boot messages, as well as messages written to standard output and standard error by all services. journald writes logging information, along with metadata such as timestamps and user IDs, into a structured and index binary file. The default location of the journal storage is /run/log/journal/ directory.
The amount of data stored on disk is relatively small: journald uses a ring buffer and old entries are discarded continuously. The size of the log window is configured in /etc/systemd/journald.conf with SystemMaxUse:
... SystemMaxUse=1024M ...
If configured as such, once journald crosses the size boundary, old data entries are discarded.
The configuration changes require a journald restart:
sudo systemctl restart systemd-journald
The primary command-line interface for interaction with journald is journalctl.
For more details about journald configuration, see: