Embedded Files
Differences Between journalctl And rsyslog
Differences Between journalctl And rsyslog
journalctl contain same volume or more logging data than rsyslog.
journalctl is actually faster and smoother for local log checking than rsyslog.
However, rsyslog is better for network streaming because it efficiently packages and streams plain-text lines across networks to central log servers.
Tutorial
Tutorial
Check status rsyslog
Press q to exit
systemctl status rsyslog.service
Enable and start the service if not active(running)
systemctl enable --now rsyslog.service
systemctl start rsyslog.service
Check configuration file by using vim
vim /etc/rsyslog.conf
Open log file directory
cd /var/log
ls
View log file that generated by rsyslog
Active log --> message
Archived log --> messages-[YYYYMMDD], Example: messages-20260925
cat /var/log/[Log File]
Example: cat /var/log/message or cat /var/log/messages-20260925
Result
student@localhost:~$ systemctl status rsyslog.service
● rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-09-28 11:18:19 +08; 12min ago
Invocation: 6acf62dc0f3d425cb8a28edfaec84a50
Docs: man:rsyslogd(8)
https://www.rsyslog.com/doc/
Main PID: 5150 (rsyslogd)
Tasks: 3 (limit: 22995)
Memory: 1.2M (peak: 3.1M)
CPU: 123ms
CGroup: /system.slice/rsyslog.service
└─5150 /usr/sbin/rsyslogd -n
Sep 28 11:18:19 localhost.localdomain systemd[1]: Starting rsyslog.service - System Logging Service...
Sep 28 11:18:19 localhost.localdomain rsyslogd[5150]: [origin software="rsyslogd" swVersion="8.2510.0-5.el10" x-pid="5150" x-info="https://www.rsyslog.com"]>
Sep 28 11:18:19 localhost.localdomain systemd[1]: Started rsyslog.service - System Logging Service.
Sep 28 11:18:19 localhost.localdomain rsyslogd[5150]: imjournal: journal files changed, reloading... [v8.2510.0-5.el10 try https://www.rsyslog.com/e/0 ]
student@localhost:~$ sudo vim /etc/rsyslog.conf
[sudo] password for student:
student@localhost:~$ cd /var/log
student@localhost:/var/log$ ls
anaconda boot.log-20260925 cron-20260917 gdm lastlog messages-20260910 secure spooler-20260910
audit boot.log-20260928 cron-20260925 hawkey.log maillog messages-20260917 secure-20260901 spooler-20260917
boot.log btmp cups hawkey.log-20260901 maillog-20260901 messages-20260925 secure-20260910 spooler-20260925
boot.log-20260915 btmp-20260901 dnf.librepo.log hawkey.log-20260910 maillog-20260910 private secure-20260917 sssd
boot.log-20260917 chrony dnf.log hawkey.log-20260917 maillog-20260917 qemu-ga secure-20260925 tuned
boot.log-20260919 cron dnf.rpm.log hawkey.log-20260925 maillog-20260925 rhsm speech-dispatcher wtmp
boot.log-20260921 cron-20260901 error httpd messages sa spooler
boot.log-20260922 cron-20260910 firewalld insights-client messages-20260901 samba spooler-20260901
student@localhost:/var/log$ sudo cat /var/log/messages
Sep 25 10:37:23 localhost systemd[1]: Reloaded rsyslog.service - System Logging Service.
Sep 25 10:37:23 localhost rsyslogd[1203]: [origin software="rsyslogd" swVersion="8.2510.0-5.el10" x-pid="1203" x-info="https://www.rsyslog.com"] rsyslogd was HUPed
Sep 28 11:31:27 localhost systemd[5666]: Starting systemd-tmpfiles-setup.service - Create User Files and Directories...
Sep 28 11:31:27 localhost systemd[5666]: Listening on dbus.socket - D-Bus User Message Bus Socket.
Sep 28 11:31:27 localhost systemd[5666]: Finished systemd-tmpfiles-setup.service - Create User Files and Directories.
Sep 28 11:31:27 localhost systemd[5666]: Reached target sockets.target - Sockets.
Sep 28 11:31:27 localhost systemd[5666]: Reached target basic.target - Basic System.
Sep 28 11:31:27 localhost systemd[5666]: gnome-initial-setup-copy-worker.service - GNOME Initial Setup Copy Worker was skipped because of an unmet condition check (ConditionUser=!@system).
Sep 28 11:31:27 localhost systemd[5666]: Reached target default.target - Main User Target.
Sep 28 11:31:27 localhost systemd[5666]: Startup finished in 256ms.
Sep 28 11:31:27 localhost systemd[1]: Started user@0.service - User Manager for UID 0.
Sep 28 11:31:27 localhost systemd[1]: Started session-c15.scope - Session c15 of User root.
Sep 28 11:31:27 localhost systemd[1]: session-c15.scope: Deactivated successfully.
Sep 28 11:31:27 localhost systemd-logind[1074]: Session c15 logged out. Waiting for processes to exit.
Sep 28 11:31:27 localhost systemd-logind[1074]: Removed session c15.
Sep 28 11:31:34 localhost systemd-logind[1074]: Existing logind session ID 3 used by new audit session, ignoring.
Sep 28 11:31:34 localhost systemd-logind[1074]: New session c16 of user root.
Sep 28 11:31:34 localhost systemd[1]: Started session-c16.scope - Session c16 of User root.
Sep 28 11:31:34 localhost systemd[1]: session-c16.scope: Deactivated successfully.
Sep 28 11:31:34 localhost systemd-logind[1074]: Session c16 logged out. Waiting for processes to exit.
Sep 28 11:31:34 localhost systemd-logind[1074]: Removed session c16.
student@localhost:/var/log$
Page updated
Google Sites
Report abuse