Let's talk about RSYSLOG a little bit.
So RSYSLOG is no longer the primary logging service,
but it's still used on Red Hat.
So it needs the RSYSLOGd service to be running.
And the main configuration is etcrsyslog.conf.
You can use drop-in files, which are placed in etcrsyslog.d
to make the configuration complete.
And each logger line defines what
to do with specific information.
You'll find three different items.
First, there is the facility, which is a specific facility
that the log is created for.
Then we have the severity, which is defining the severity
from which it should be logged.
And the destination defines the file or other destination
that the log should be written to.
Log files normally are in var log, but they can be anywhere.
Now, what is this thing with facilities?
Well, RSYSLOG is and must be backward
compatible with the ancient Syslog service.
And in Syslog, a fixed number of facilities
was defined, like kern for kernel,
authprf for authentication, cron for cron-related,
and much more.
And to work with services that don't have their own facility,
local 0 up to 7 could have been used.
Now, that's not very convenient.
And for that reason, we are now on systemd journald.
But I do want to show you a bit of what is behind the RSYSLOG
configuration.
So let me show you etc rsyslog.conf.
And here we have the configuration file
in which the most important thing are the rules.
So you have rules like this, which
is specifying star.info, which is for all facilities
with a level of info and higher.
But no mil, no authprf, no cron.
And that is sent to var log messages.
And it continues like that.
Everything about authentication goes to var log secure.
Everything about cron goes to var log cron and so on.
So you don't have to know how to modify it.
But you do need to know how to find where
specific messages are logged to.
And in the end, you can go to var log.
And in var log, you see all these different log files.
It's always a good idea to have a look at it,
because maybe you will find something that can be useful.