Am 05.02.20 um 07:49 schrieb Michael Biebl: > Am 05.02.20 um 07:01 schrieb Scott Kitterman: > >> Not particularly useful IMO. In /var/log/mail.log I can see log entries from >> all the programs configured to log to the mail facility. That way I can see >> the interaction between them. On a typical server that is for sending mail I >> often need to see log entries from postfix, clamsmtp, and dkimpy-milter >> together to understand how a message is (or isn't) making it through the >> system. >> >> Of course the fact that I can't use all the tools available to manipulate text >> files to follow or analyze logs is problematic. If I'm using journalctl, how >> do I replicate 'tail -f /var/log/mail.loog'? > > journalctl -f SYSLOG_IDENTIFIER=2 > > You can also apply additional filters, like severity and much more. This also is an aspect I very much like about the journal. Once rsyslog has written a log message to disk, most of the meta data is lost and you can no longer filter for it. E.g. say I only wanted to inspect messages with the cron facility, then this is easy to do with journalctl. Or you want to filter out daemon messages with certain severities or coming from certain processes. While you can write rsyslog filter rules for that, you can't apply those to existing log messages that have been written to disk.
Attachment:
signature.asc
Description: OpenPGP digital signature