Linux Logging Concepts
Internal
Overview
Linux system logging is managed by two systems: rsyslogd and journald, which is a component of systemd. The logging systems coexist. journald is the primary tool for troubleshooting.
rsyslogd
rsyslogd comes configured by default to write logging information into files like /var/log/messages, and it can be configured to provide additional filtering, encryption and log information relaying to external systems.
journald
journald daemon is a component of systemd. It handles syslog, kernel, and early boot messages, as well as messages written to standard output and standard error by all services. journald writes logging information, along with metadata such as timestamps and user IDs, into a structured and index binary file. The default location of the journal storage is /run/log/journal/ directory. The amount of data stored on disk is relatively small: journald uses a ring buffer and old entries are discarded continuously.
The primary command-line interface for interaction with journald is journalctl.