Re: Bug#1023596: bookworm: document changes in default rsyslog configuration

[RL <richard.lewis.debian@googlemail.com>]

Michael Biebl <biebl@debian.org> writes:

> The rsyslog configuration changed significantly in bookworm.

Hi, I'd potentially be happy to contribute some text for release-notes
on rsyslog. Some questions based on what i'd want to know as an
interested user:

Are both rsyslog and systemd's journal still both the default in bookworm?

I see rsyslog is still priority: important - any plans to reduce that in
future releases?

(Have reordered the below based on what seems most important to me):

>   * Enable high precision timestamps with timezone information.
>     Use the default rsyslog file format, which provides several benefits
>     like:
>     - sortable
>     - time zone information
>     - sub-second time resolution
>     (Closes: #475303)

(this would seem to break every single logcheck rule too)

>   * Stop splitting up mail.*
>     This avoids having mail related messages duplicated in mail.log and
>     mail.{info,warn,err}. (Closes: #508376)

I think the impact here depends on the mta:
- debian's default mta is exim4
- postfix is a popular alternative
- /var/log/mail.{info,warn,err}* can be deleted after the upgrade (or is this done by the upgade?)

Details:
 For exim4, logging was in /var/log/exim4 (and mail.err was duplicating paniclog,
 others not used but are created as empty files)

 For postfix, logging was in /var/log/mail.log and duplicated in all/some
 of /var/log/syslog and mail.{info,warn,err}* (unchecked - based on the
 bug report)

Other mtas are likely to be similar to either exim or postfix - but is
there any mta that only uses mail.*?

(For all these we should be clear that the user dosnt need to delete
anything and should check what is being used)

>   * Stop splitting lpr facility into its own log file.
>     The default printing system CUPS is not using this facility so its
>     basically unused nowadays.

Am i right that
- cups is installed by the default gnome desktop task: anyone using that is
    not affected as the /var/log/lpr.log is not created
- systems without any printing systems are likely not affected
   (lpr.log will not exist)
- people who have installed some alternative printing system (is there any?)
   can now delete /var/log/lpr.log* and find log messages about printing
   in syslog (or do other systems expect lpr.log to exist?)


>   * Drop catch-all log files /var/log/{messages,debug}
>   * Stop splitting daemon facility into its own log file.

Similarly (but nothing to do with mtas) users can delete these logs -
the second being /var/log/daemon.log

>   * Split cron facility into its own log file /var/log/cron.log.
>     The cron facility is widely used and limited enough in scope to have it
>     split out separately. (Closes: #625483)

This one affects everyone using cron (including anacron). .... but isnt
there some lintian warning that anaccron is no longer installed for
desktop users? (which should be in release-notes i assume)

I assume that for bookwork, systemd timers are not yet ready to replace
cron jobs by default

Regards