- In this video, I would like to explain rsyslog.
Rsyslog is a service that works with facility,
priority and destination.
The facility is what rsyslogd should be logging for.
The priority indicates the severity of the log event,
and the destination defines
where the message should be written to.
And these facility, priority, and destination
are used in the rsyslog configuration file.
Let's go check out this configuration file
and try to understand what it is doing.
So I'm still in a root cell
and in fact, it's convenient
because in order to configure a log,
we need root access.
Rsyslog.conf is the main configuration file.
And there's a lot going on.
It's not my intention to tell you everything
that's going on
but I do want to tell you a little bit about the rules.
So this is a nice one to start with
to understand how it is organized.
We see uucp,news.
Uucp and news are the facilities.
Facilities are strictly defined in rsyslog
and that at the same time is the problem in rsyslog
because these facilities were defined in the 1980s
and because of backward compatibility,
it was not possible to add something to it.
So there is a facility for uucp,
which is the Unix-to-Unix Copy Protocol,
which nobody's using anymore.
But there's no facility for HTTP, for instance.
But that doesn't really matter.
You have to deal with it
if you are working with rsyslog.
Now, we get a dot and behind the dot,
we get the priority.
And here we have the priority crit for critical.
Here you can see a priority emerg for emergency.
But it's also possible to just log everything
by specifying a star
or info for informational
or none to exclude something from being logged.
Like here cron.none.
The third part is the destination,
/var/log/messages in this case.
/var/log/messages is the default log file
on Red Hat family Linux.
If you're on Ubuntu,
/var/log/syslog is the default log file.
And that is where you should be looking
at on the syslog-based systems.
So if you go to the /var/log directory,
ls -lrt is always a convenient command.
It will show you the files
in order of last modification.
So the last modified file is shown last.
Messages, as you can see, it's a pretty big file,
and it has been modified just a minute ago.
And if you use less on messages,
then you can see the rsyslog configuration file.
And in case you are wondering
what exactly is the difference
with the journal?
Well, the fun fact is that rsyslog
is adding functionality,
functionality like the option
to build a centralized log server,
functionality like the option
to write your logs to a database server.
That's stuff that you can do in rsyslog,
not in the systemd journal.
The systemd journal, by default,
is configured to forward all messages to rsyslog.
So what is the difference?
There isn't really any.
Rsyslog is adding functionality
but at the Linux fundamentals level,
you don't care about that too much.
What you do care about
is that rsyslog is creating a couple
of configuration files
in the /var/log directory by default.
And you can browse these configuration files to figure out.
And the last thing, logger HELLO.
Logger is a convenient command
if you want to write something
to your system log.
And because rsyslog and journal are connected,
you will see it in the /var/log/messages in this case
but also in the systemd journal.
And that is how you work with rsyslog.