Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I was trying to implement some changes to syslogd on Ubuntu 10.04.02 LTS (Server edition). I found /etc/syslog.conf is not present on system, instead I have /etc/rsyslogd.d/*.conf. syslogd can be installed by installing inetutils-syslogd, but I am unable to decide the pros and cons of both systems. Also while installing inetutils-syslogd, I need to remove rsyslog and ubuntu-minimal. Would some one explain merits and de-merits of rsyslogd over syslogd.

share|improve this question

2 Answers 2

up vote 9 down vote accepted

Ubuntu Manpage for rsyslogd says this

... First of all there has been a systematic attempt to insure that rsyslogd follows its default, standard BSD behavior...

rsyslogd should be able to use a standard syslog.conf and act like the orginal syslogd. However, an original syslogd will not work correctly with a rsyslog-enhanced configuration file. At best, it will generate funny looking file names.

The second important concept to note is that this version of rsyslogd interacts transparently with the version of syslog found in the standard libraries. If a binary linked to the standard shared libraries fails to function correctly we would like an example of the anomalous behavior.

So rsyslogd is not very much different from syslogd. Then why do we need rsyslogd?

This page provides a comparison chart rsyslogd vs. syslogd-ng

This blog post explains why a second syslogd?. Excerpts from it:

  • .. So one reason the world needs another syslogd is that it needs another major player in the *nix space. I honestly believe there is none except syslog-ng..

  • .. have you noticed that syslog-ng has become dual-licensed? There is the great GPLed open source release and the even greater "Premium Edition", which cost money. Only the premium edition offers features like native database and SSL support or queued syslog sending..

  • .."Stop", I hear some say, "syslog-ng is GPLed, so we can take that source and implement the missing features". Of course you can. But do you think Balabit will actually include your patches? I guess we can agree on "nope". So you have just forked from syslog-ng ... and proved my argument that the world needs another syslogd..

  • .. So - why does the world need another syslogd?

                It needs one that aims to be a real major player, being installed on a lot of systems. That will help to get the best out of syslog technology (and in the long term the best of logging at all). Either in its project itself of by driving competitors to be better than it. A new major player will prevent monocultures and provide a rich freedom of choice. That's why the world needs it.

share|improve this answer
    
Thanks. I am learning now how to use rsyslogd :) –  Jamess Aug 3 '11 at 18:33
1  
No probs :) Infact, I learned what rsyslogd was when I was researching for the answer to your question :P So, thank you :D –  nitstorm Aug 5 '11 at 23:14
1  
Both web page comparisons are quite old. The first comparison page gives this disclaimer: "This comparison page is rooted nearly 5 years in the past and has become severely outdated since then." –  belacqua Jul 19 '12 at 18:03
    
Yet that web page is ideal for somebody familiar with the legacy syslog system who wants to know what's new with rsyslog. –  user3149905 Jul 1 at 20:52

No in depth comparison in this answer.

Have you taken a look at the rsyslogd man page?

It says that rsyslogd is an extension to syslogd. Moreover, it is the standard used by Ubuntu, so I recommend staying with it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.