- All right, apart from the systemd journal,
as we have just discussed,
rsyslogd is still pretty important as well.
So let's have a quick look at it.
So in rsyslogd,
facilities and priorities are used
to define how logging should happen,
and where the log information is written to.
Facilities define the item
for which logging is happening.
And that's also one of the weak spots of rsyslogd.
The facilities were created a long time ago,
and nowadays there's not enough adequate facilities
to address all the services
that are typically running on Linux.
Priorities define the severity levels
in which case messages should be logged.
And modules can be used to handle log input
and log output as well.
Let's check it out.
So our main configuration is in /etc/rsyslog.conf.
Notice that there is also a directory for dropping files,
which by default is empty,
but you may find packages on your distribution
that have dropped additional rsyslog configuration
in /etc/rsyslog.d.
Now, what do we see? We see the global directives.
So in the global directives,
well, this is just global information,
not the most important part.
Here we have the module information,
and in this module information we can see, for instance,
module load is imjournal.
I-M stands for input module.
And this module ensures that rsyslog
is including all information
that was written to the journal.
Another input module that is interesting
is right here: imudp, port is 514.
If you want rsyslog to be configured
as a centralized log server,
then you need to enable this module
as well as the imtcp module,
which allows you to send log events
using the old UDP transport mechanism
or the newer and more secure TCP transport mechanism.
And then we have the rules.
The rules is where we get to the heart of rsyslog.
So here we can see the rule
*.info;mail.none;authpriv.none;cron.none.
What does that mean?
* is anything.
So for everything with a severity of info and higher,
but not for mail and authpriv and cron,
we write to /var/log/messages.
And what is happening with authpriv?
Well, authpriv is a facility
that relates to authentication
and everything that comes from authpriv
is written to /var/log/secure.
Everything that comes from mall
is written to /var/log/maillog,
and that's how it works.
Now, here we can see an interesting one: *.emerg.
If we get an emergency message,
emergency is really
where your system is not functioning correctly anymore.
Then we write to omusrmsg.
O-M is output module.
So it's using a specific module
to send a message to all users that are logged in.
Now, is there anything else?
Yeah, one more thing: Target=
If you want this system to be configured
to send log messages to a remote system,
you should tweak this line
and make sure that your target is set
to the remote host's IP address,
and port is set most likely to port 514.
This is the default log port for rsyslog.
And that's how you work with rsyslog.
Oh, and one thing.
If you made modifications,
don't forget systemctl restart rsyslog.service,
because otherwise it won't pick up the modifications
automatically for you.