The systemd journal doesn't force you to not have plain text logs

June 30, 2024

People are periodically grumpy that systemd's journal(d) doesn't store logs using 'plain text'. Sometimes this is used to imply that you can't have plain text logs with systemd's journal (or, more rarely, to state it). This is false. The systemd journal doesn't force you to not have plain text logs. In fact the systemd journal is often a practical improvement in the state of plain text logs, because your plain text logs will capture more information (if you keep them).

Of course the systemd journal won't write plain text logs directly. But modern syslog daemons on Linux will definitely read from the systemd journal and handle the result as more or less native syslog messages, including forwarding them to a central syslog server and writing them to whatever local files you want in the traditional syslog plain text format. Because the systemd journal generally captures things like the output printed by programs run in units, this stream of syslog'd messages will include more log data than a pure journal-free syslog environment would, which is normally a good thing.

It's perfectly possible to use the systemd journal basically in a pass-through mode; for example, see the discussion of journald.conf's Storage= setting, and also the runtime storage settings. Historically, Linux distributions varied in whether they made the systemd journal persistent on disk, and in the early days some certainly did not (sometimes to our irritation). And of course if you don't like the journal settings that your Linux distribution defaults to, you can change them in your system installation procedures.

(If you set 'Storage=none', I'm not sure if your syslog daemon can still read and log journal data; you should probably test that. But my personal view is that you should retain some amount of journal logs in RAM to enable various convenient things.)

Today, whether or not you get plain text logs as well as the systemd journal by default is a choice that Linux distributions make, not something that systemd itself decides. If the Linux distribution installs and enables a syslog daemon, you'll get plain text logs, possibly as well as a persistent systemd journal. You can look at the plain text logs most of the time, and turn to the journal for the kind of extra metadata that plain text logs aren't good at. And even if your Linux distribution doesn't install a syslog daemon, I believe most of them still package one, so you can install it yourself as a standard piece of additional software.

Written on 30 June 2024.
« Plaintext is not a great format for (system) logs
Modifying and setting alarm times: a phone UI irritation »

Page tools: View Source.
Search:
Login: Password:

Last modified: Sun Jun 30 23:27:31 2024
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.