Home / server / Questions / 1063922
Accepted
markson edwardson
Asked: 2021-05-18 21:22:02 +0800 CST

Is it safe to disable rsyslog if I have journald?

  • 772

I am using Debian 10. It seems to me, that both journald and (r)syslogd watch for messages independently from sources such as kmesg() or syslog().

Is there any advantage to running both? Why does Debian ship with both? For comfort? I guess syslog files can be cat'd, where as journald forces you to use journalctl?

I do not want to ship my logs remotely and I have enabled journald's persistence.

logging debian rsyslog journald

1 Answers

  1. Best Answer

    It is safe. I have uninstalled rsyslog on all my Debian running personal computers. Yet in such a scenario you have done the right move I believe to change /etc/systemd/journald.conf, line Storage=auto to Storage=persistent to keep older journals, not only the current after boot, which is the default setting in Debian 10.

    On the other hand, on servers you could leave it for better handling of logs; perhaps to redirect them to a log server as you mentioned. Since you don't need this feature, you could unistall it or disable it from servers also.

    • 3