[CentOS] journalctl and log server

[Dennis Jacobfeuerborn]

On 11.07.2014 10:47, Mauricio Tavares wrote:
> On Fri, Jul 11, 2014 at 3:00 AM, James Hogarth <james.hogarth at gmail.com> wrote:
>> On 10 Jul 2014 23:26, "Matthew Miller" <mattdm at mattdm.org> wrote:
>>> (In
>>> fact, you can even turn off persistent journald if you like.) Or, you can
>>> use 'imjournal' for more sophisticated integration if you like -- see
>>> <http://www.rsyslog.com/doc/imjournal.html>.
>>>
>       Is it me who have not had coffee yet or that assumes you have to
> have rsyslog installed in the machine running systemd/journald? For
> the sake of this discussion, let's say that is not an option for
> whatever reason, so you must make journald talk to the rsyslog server.
> What would need to be done in both ends?

That's a bit like saying "you must make mysql talk to the apache
webserver". The journal has its own mechanism using
systemd-journal-remote but that hasn't been included in CentOS7 because
its fairly new.

>>
>> In fact in EL7 the default behaviour is no persistent journald since the
>> logging is set to auto and there is no /var/log/journal ...
>>
>> The default behaviour is to have journald collect the logs and forward them
>> all to rsyslog to then be stored on disk or filtered or forwarded just the
>> same as in EL6 ...
>>
>> On a related note this does mean that if you want persistent journald
>> logging you must remember to create that directory...
> 
>       Now, let's say we are trying to prove journald is superior to
> rsyslog, so we must not use rsyslog in this machine (only in the
> syslog server since it is up and has to deal with others)

In this scenario you would set up systemd-journal-remote on the server
in addition to rsyslog so syslog clients can keep using the rsyslog
endpoint and journal client can use the journal-remote one. On the
server you could then forward the data to the local rsyslog to have
everything in one place/format.

The whole remote logging story is still pretty dodgy right now though so
I would stick to rsyslog for now.

Regards,
  Dennis