I am running what is a vanilla Ubuntu 16.04 server, and I'm trying to wrap my head around how logging is set up by default. I can see that both
rsyslog are installed and running, but it's not at all clear to me how log messages are being processed.
Most messages seem to show up both in
/var/log/syslog and via
journalctl, but I can't see any explicit configuration for forwarding between the two in either
/etc/systemd/journald.conf (which is basically all commented out by default),
I tried to look for official documentation, or even a blog post explaining how hese two are set up in Ubuntu, but haven't managed to find anything.
To further add to my confusion, I have executed
logger -p local1.info Test on the host, and found that nothing was written to
/var/log/syslog, while the message did show up under
My questions are:
- How exactly do journald and rsyslog work together on Ubuntu 16.04 (by default)?
How come messages sent from
loggerseemingly end up in the journal, but not in syslog?
Update: Turns out
logger not working as expected was a mistake on my end, so it's not relevant to the main question.