F20 System Wide Change: No Default Syslog

[Lennart Poettering]

On Tue, 16.07.13 13:38, Nicolas Mailhot (nicolas.mailhot at laposte.net) wrote:

> > So yeah, you could say that journald will 'ignore' the file. But
> > journalctl won't, it will show them to you. And that's *good* that
> > way. That's how it *should* be.
> 
> However even if that's the case that means some events just got hidden in
> a file only journalctl will consult, and not relayed to syslog (as they
> should)

No. That's not correct.

journald will immediately forward all messages it gets to a running
syslog daemon if there is one -- it will actually do so before even
writing the message to disk!

Of course, as mentioned the newest rsyslog does not rely on the
forwarding anymore but instead pulls the data out of the journal on its
own. It hence will get the exact same stream of data that journalctl
gets, i.e. also the compelte stream.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.