On 11.07.2014 10:47, Mauricio Tavares wrote:
On Fri, Jul 11, 2014 at 3:00 AM, James Hogarth james.hogarth@gmail.com wrote:
On 10 Jul 2014 23:26, "Matthew Miller" mattdm@mattdm.org wrote:
(In fact, you can even turn off persistent journald if you like.) Or, you can use 'imjournal' for more sophisticated integration if you like -- see http://www.rsyslog.com/doc/imjournal.html.
Is it me who have not had coffee yet or that assumes you have tohave rsyslog installed in the machine running systemd/journald? For the sake of this discussion, let's say that is not an option for whatever reason, so you must make journald talk to the rsyslog server. What would need to be done in both ends?
That's a bit like saying "you must make mysql talk to the apache webserver". The journal has its own mechanism using systemd-journal-remote but that hasn't been included in CentOS7 because its fairly new.
In fact in EL7 the default behaviour is no persistent journald since the logging is set to auto and there is no /var/log/journal ...
The default behaviour is to have journald collect the logs and forward them all to rsyslog to then be stored on disk or filtered or forwarded just the same as in EL6 ...
On a related note this does mean that if you want persistent journald logging you must remember to create that directory...
Now, let's say we are trying to prove journald is superior torsyslog, so we must not use rsyslog in this machine (only in the syslog server since it is up and has to deal with others)
In this scenario you would set up systemd-journal-remote on the server in addition to rsyslog so syslog clients can keep using the rsyslog endpoint and journal client can use the journal-remote one. On the server you could then forward the data to the local rsyslog to have everything in one place/format.
The whole remote logging story is still pretty dodgy right now though so I would stick to rsyslog for now.
Regards, Dennis