rsyslog / journald - el7 vs el8

[mvrk]

Hi,

On RHEL7 (and clones) systemd package included /etc/rsyslog.d/listen.conf:
$SystemLogSocketName /run/systemd/journal/syslog

which makes rsyslog get the logs from journald

On RHEL8 (and clones) this file is not included anymore. Does anyone knows why?

I see that on EL8 rsyslog.conf now includes the module imjournal to get the logs directly from journald db.

Though on rsyslog documentation says its not recommended because is quite heavy.

What would be the correct way (less heavy) to get logs from journald into rsyslog on EL8?

 

[mvrk]

Just found the answer :

Configuring system logging without journald - Red Hat Customer Portal

This guide contains steps on how to configure a logging solution that might deliver better performance than the logging solution in the default configuration.

access.redhat.com