journald for RHEL7

Latest response

I know that the ideas submissions for RHEL7 is now closed ... however.


There are recent rumblings about journald replacing rsyslog in upcoming versions of Fedora.  I'm liking what I'm hearing about journald so far.  To the extent that I'd probably be persuaded to wait for RHEL7 so that it could be included.


Anyone else have a view?




AFAIK, journald is not here to replace rsyslog but to complement it, in some way. While both of them seems to do the same thing ( ie, take care of the logs ), journald do not write logs in separate file, and do not send them using the syslog protocol. it just forward them to rsyslog who do this part of the job. So you still need to install rsyslog if you want to keep the current system, and both are compatible, so there should be no disruption ( and I strongly suspect both will be installed by default for a long time ).


What was discussed at Fedora ( and who might not be reflected in RHEL ) was ( from what i remember of the mega thread ) mainly for minimal installation. The discussion was started because there is work in the Fedora community to strip down the installation image for being run as a container, at a large scale. Since systemd is part of Fedora and cannot be removed, and since journald is a internal component of systemd ( ie, it was written to handle logs of systemd units and offer features like "showing the last lines of logs when running systemctl status" ) and cannot be removed while offering enough features for some usecase, the discussion is just "would journald without rsyslog be sufficient for a stripped down installation". So far, the idea is just discussed, not even proposed, and I guess the outcome will be to let people uninstall rsyslog if they wish in Fedora ( and something like this would surely be in RHEL too, since that's not really disruptive ).


Personally, I like the features offered by journald :

- being able to see correctly the logs of 2 systemd unit without facing corner cases ( like having to do cat | grep |sort and seeing that date doesn't sort well in the end of the month, and that grep was too wide or too narrow )

- being able to see the date in the correct timezone ( since the date is stored as a C struct, not as a string to parse )

- being able to sign the log ( )

- being able to search by date ( again without doing weird stuff with grep )


I know that not everybody like binary ( for good and bad reasons ), but since we can still install rsyslog and keep the current behaviour, I think there is too much drama for nothing on the web about this topic :)

Sorry - long delay before reply.


Yes - journald is not a replacement for rsyslog.  Whilst some might like to run 2 different logging solutions, I'm really liking what I read about journald - for all the points you mention and more.  Still need to see how a centralised journald server would operate (pretty similar to centralised rsyslog I'm figuring, but I just haven't seen any details yet).  A good WebUI on top of a centralised server with decent granular access rights and encrypted traffic from client systems would fit the bill perfectly for me.