Linux Logging Concepts: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
 
(19 intermediate revisions by the same user not shown)
Line 5: Line 5:
=Overview=
=Overview=


Linux system logging is managed by two systems: rsyslogd and journald, which is a component of [[systemd]].
Linux system logging is managed by two systems: [[#rsyslogd|rsyslogd]] and [[#journald|journald]], which is a component of [[Systemd_Concepts#journald|systemd]]. The logging systems coexist. [[#journald|journald]] is the primary tool for troubleshooting.


=rsyslogd=
=rsyslogd=
rsyslogd comes configured by default to write logging information into files like /var/log/messages, and it can be configured to provide additional filtering, encryption and log information relaying to external systems.
The main rsyslogd configuration file is /etc/rsyslog.conf, which, among other things, lists all log files maintained by rsyslogd (/var/log/messages, /var/log/secure, /var/log/cron, /var/log/boot.log, etc.). For more details about rsyslogd configuration, see: {{Internal|Linux Logging Configuration#rsyslogd|rsyslogd Configuration}}
rsyslogd-managed log files can be automatically rotated. The logrotate package contains a cron task that rotates log files based on the configuration found in /etc/logrotate.conf and /etc/logrotate.d/. For more details on how to configure log rotation see: {{Internal|Linux Logging Configuration#rsyslogd_Log_Rotation_Configuration|rsyslogd Log Rotation Configuration}}


=journald=
=journald=
journald daemon is a component of [[Systemd_Concepts#journald|systemd]].
It handles syslog, kernel, and early boot messages, as well as messages written to standard output and standard error by all services. journald writes logging information, along with metadata such as timestamps and user IDs, into a structured and index binary file. The default location of the journal storage is /run/log/journal/ directory.
The amount of data stored on disk is relatively small: journald uses a ring buffer and old entries are discarded continuously. The size of the log window is configured in /etc/systemd/journald.conf with SystemMaxUse:
...
SystemMaxUse=1024M
...
If configured as such, once journald crosses the size boundary, old data entries are discarded.
The configuration changes require a journald restart:
sudo systemctl restart systemd-journald
The primary command-line interface for interaction with journald is [[Journalctl|journalctl]].
For more details about journald configuration, see: {{Internal|Linux_Logging_Configuration#journald_Configuration|journald Configuration}}
=logrotate=
{{Internal|Linux logrotate|logrotate}}

Latest revision as of 17:42, 12 February 2018

Internal

Overview

Linux system logging is managed by two systems: rsyslogd and journald, which is a component of systemd. The logging systems coexist. journald is the primary tool for troubleshooting.

rsyslogd

rsyslogd comes configured by default to write logging information into files like /var/log/messages, and it can be configured to provide additional filtering, encryption and log information relaying to external systems.

The main rsyslogd configuration file is /etc/rsyslog.conf, which, among other things, lists all log files maintained by rsyslogd (/var/log/messages, /var/log/secure, /var/log/cron, /var/log/boot.log, etc.). For more details about rsyslogd configuration, see:

rsyslogd Configuration

rsyslogd-managed log files can be automatically rotated. The logrotate package contains a cron task that rotates log files based on the configuration found in /etc/logrotate.conf and /etc/logrotate.d/. For more details on how to configure log rotation see:

rsyslogd Log Rotation Configuration

journald

journald daemon is a component of systemd.

It handles syslog, kernel, and early boot messages, as well as messages written to standard output and standard error by all services. journald writes logging information, along with metadata such as timestamps and user IDs, into a structured and index binary file. The default location of the journal storage is /run/log/journal/ directory.

The amount of data stored on disk is relatively small: journald uses a ring buffer and old entries are discarded continuously. The size of the log window is configured in /etc/systemd/journald.conf with SystemMaxUse:

...
SystemMaxUse=1024M
...

If configured as such, once journald crosses the size boundary, old data entries are discarded.

The configuration changes require a journald restart:

sudo systemctl restart systemd-journald

The primary command-line interface for interaction with journald is journalctl.

For more details about journald configuration, see:

journald Configuration

logrotate

logrotate