Linux Administration Cookbook

How it works...

What we're effectively doing is opening up a listener for logs in both the syslog and journald solutions. A network port is opened on our boxes, and the daemon is aware of a source of data that it might be forced to read from. In the case of syslog, we had to enable specific modules in the rsyslog daemon to make this happen; systemd and journald required specific packages.

Obviously, journald's implementation appears a bit clunkier, but that's mostly because it's newer.

Fundamentally, we're just dealing with streaming log data, and neither syslog nor journald care where that data comes from, as long as it's in a format that they can understand.