Mastering Linux Security and Hardening - Second Edition

Understanding journald

You'll find the journald logging system on any Linux distro that uses the systemd ecosystem. Instead of sending its messages to text files, journald sends messages to binary files. Instead of using normal Linux text file utilities to extract information, you have to use the journalctl utility. At the time of writing, no Linux distro that I know of has made the complete transition to journald. Current Linux distros that use systemd run journald and rsyslog side by side. Currently, the default is for journald log files to be temporary files that get erased every time you reboot the machine. (You can configure journald to make its log files persistent, but there's probably not much point as long as we still need to keep ...