So what are the options for logging in RHEL 10?
Well, the default option is systemd journald, which is receiving log messages from different
locations, which are the kernel, the early boot procedure, syslog events, and standard
output and error from the daemons.
The systemd journal is non-persistent by default.
There's also rsyslog.
rsyslog is a service that reads syslog messages and writes them to different locations.
By default, these are files in var log, but they can also use output modules to write
to a database, for instance.
And services may also write to the var log directory.
Okay, so let's try to understand how logging is working.
There is this thing called systemd, which you've learned about.
And systemd has the systemd journald.
And the systemd journald is writing, managing the journal.
Now this journal is getting input, and it's getting input from different sources.
From systemd services, for instance, which are the processes.
But also from the Linux kernel, for instance, or during the early phases of the boot.
And all of that is being sent to the systemd journal, because the systemd journal is taking
care of everything anyway.
But systemd journal, by default, is not persistent, and it lacks some output and some filtering
options.
And that is why the journal is forwarding all of the logs to rsyslog.
And rsyslogd is the daemon that is taking care of logs.
Now rsyslogd is further configured through this rsyslog.conf.
And based on the information in the configuration file, it might log to slash var slash log
slash whatever.
These are files that, by default, are written in the var log module.
Or it might log to colon om colon, where om stands for an output module.
And the nice thing about that is that, for instance, you can send it to some log server
to make sure that you centralize the logs in such a way that they can be stored on one
server in your entire network.
And that's how systemd journal and rsyslog are working together.