- All right, let's talk about logging.
So most Linux distributions currently host two systems
that take care of logging, and that's a bit confusing.
There is systemd-journald,
which is the systemd integrated logging solution.
And there is rsyslogd,
which is the legacy Linux logging system.
And apart from that
some services may take care of their own logging.
Now in case you are wondering, why do we have two systems?
Simple, rsyslogd is offering features
that systemd-journald is not offering,
but systemd-journald is a part of systemd.
And as such, it captures all messages
that are generated by systemd units anyway.
And that is convenient,
because that allows you
to use commands like systemctl show on the unit
to check messages that were generated by a specific unit.
And alternatively,
there is a journalctl utility, which allows you
to check the journal which contains all messages.
Now the systemd journal by default is not persistent.
That is because it's very rich.
It contains a lot of information.
And when you reboot it's all gone.
You don't like it, you can do something about it.
I'll tell you later what you can do.
But first we need to talk about rsyslogd.
So rsyslogd is compatible with the legacy syslogd service
that has been around for a long, long time.
In rsyslogd,
we use facility: severity destination to ensure
that messages are written to the appropriate location.
And typically, messages are written to files in /var/log,
but output modules can also be used in rsyslogd.
I'll tell you
in more detail later how to configure rsyslogd.
For now, I'd like to have a look
at the logs that are generated by either of these systems.
Oh, and just one thing, you might be on a distribution
that is not offering both systemd-journald
as well as rsyslog.
That's a choice of the distribution.
So you might be missing rsyslogd.
You are probably not going to miss systemd-journald,
because it's a part of systemd
and it works very well in systemd.
All systemd Linux distributions
are using systemd-journald.
So for a change we are going to run this demo on Ubuntu,
sudo systemctl status chron.service for instance,
Cron is just a random service
that I want to investigate here,
and I want to show you all the information right here
in the lower part of the output.
This comes straight from the systemd journal.
Now if you want more about the systemd journal,
journalctl is the utility that you wanna use.
If you just type journalctl,
you get the journal and everything that's inside.
The pager is really less so you can use the key sequences
that you are using in less as well.
Now as you can see, almost 10,000 lines,
since this journal was started on February 20th.
And that's a lot.
Fortunately, there are filtering options as well
like journalctl -u chron.service,
where -u stands for the unit that you wants to investigate.
Now by default, you only see the last couple of lines
that were logged in a unit,
but here we can see that everything is here.
Oh, and look at that, there's also a boot.
So apparently we rebooted this thing,
and that means that this Ubuntu system
is using a persistent journal by default.
That's good to know, but that won't always be the case.
Now how about rsyslog?
Do we even have rsyslog?
ps aux | grep syslog.
And what do we see?
We see that we have rsyslogd, that is available.
So rsyslogd running Ubuntu,
as well as on Red Hat family by default,
normally writes the messages to the /var/log directory.
I would suggest use ls -l on /var/log,
so that you can see which files are written.
And the important files, the dpkg,
which is your packets log.
We have the journal directory
that's a persistent journal
that Ubuntu workstation is creating by default.
And we have syslog.
syslog is the main log file
that is created by our rsyslog, on Ubuntu that is.
On Red Hat, you will notice
that the main log file is /var/log/messages.
Now if you want to investigate,
well, sudo less on /var/log/syslog, for instance.
Oops, /var/log/syslog, for instance,
is showing everything that has happened
and that has been committed to the syslog.
Much of this information is redundant by the way,
but in rsyslog, some additional features are available.
We'll talk about those later.