Re: Heads up: persistent journal has been enabled in systemd
On Tue, Feb 4, 2020 at 5:15 PM Scott Kitterman <debian@kitterman.com> wrote:
>
> On Tuesday, February 4, 2020 5:22:15 PM EST Vincent Bernat wrote:
> > ❦ 4 février 2020 11:30 -08, Russ Allbery <rra@debian.org>:
> > >> As a heavy user or Rsyslog features I feel that switching default
> > >> logging system yields no benefits to say the least.
> > >
> > > As a heavy user, perhaps you're not the target audience for a default?
> > > You're going to install rsyslog no matter what, since you know it well and
> > > use it heavily. The only effect of this change on you will be a one-line
> > > change to whatever you use for configuration management for new
> > > systems.
> >
> > rsyslog even knows how to directly pull logs from the journal, which
> > gives you access to stuff not logged to syslog (stdout/stderr of service
> > files, applications logging directly to journal), as well to structured
> > logs (comm pid, user, unit and more when the service supports journald
> > directly).
>
> For those of us who aren't customizers of Debian's logging function, it'd be
> nice to have a clearer understanding of what this changes means.
>
> Today, when, for example, I want to investigate something email related, I
> look in /var/log/mail.log.
Random email related journal commands:
journalctl -u postfix
journalctl -f -u postfix
journalctl -b -u postfix
the -u is for the unit name. the -b is for since boot. man journalctl
for details.
Other specialized log files for their special
> purposes. For data not covered by a specialized log, I look in /var/log/
> syslog.
>
> Will the specialized log files still be there?
I suppose it depends. Do the processes write to /dev/log or manually
write to files?
Will the net effect be that I
> just need to look in /var/log/journal (or something similar) instead of in /
> var/log/syslog?
The contents of /var/log/journal will be binary files that journalctl
will read. IIRC.
Is the persistent journal a text file or will I need
> specialized tools to interact with it?
specialized: journalctl.
-m
>
> Scott K
Reply to: