rsyslog

You can start/enable rsyslog.service after installation.

Rsyslog uses the glibc routine gethostname() or gethostbyname() to determine the hostname of the local machine. The gethostname() or gethostbyname() routine check the contents of for the fully qualified domain name (FQDN) if you are not using BIND or NIS.

You can check what the local machine's currently configured FQDN is by running . The output of will be used by rsyslog when writing log messages. If you want to have full hostnames in logs, you need to add to the beginning of the file (before using any directive that write to files). This is because, rsyslog reads its configuration file and applies it on-the-go and then reads the later lines.

The file contains a number of lines that map FQDNs to IP addresses and that map aliases to FQDNs. See the example file below:

/etc/hosts

#<ip-address>    <hostname.domain.org> <hostname>
#<ip-address>    <actual FQDN> <aliases>
127.0.0.1        localhost.localdomain somehost.localdomain localhost somehost
::1              localhost.localdomain somehost.localdomain localhost somehost

localhost.localdomain is the first item following the IP address, so gethostbyname() function will return localhost.localdomain as the local machine's FQDN. Then file will use localhost as hostname.

To use somehost as the hostname. Move somehost.localdomain to the first item:

If you want rsyslog to pull messages from systemd, load the imjournal module:

See the documentation on the imjournal input module for more information.

The rsyslog^AUR does not create its working directory defined by the variable in the configuration file. You might need to create it manually or change its destination.

Log output can be fine tuned in . The daemon uses Facility levels (see below) to determine what gets put where. For example:

States that all messages falling under the authpriv facility are logged to /var/log/secure.

Another example, which would be similar to the behaviour of syslog-ng for the old :

See Systemd/Journal#Journald in conjunction with syslog for more information.

Since the syslog component of systemd, journald, does not flush its logs to disk during normal operation, these logs will be gone when the machine is shut down abnormally (power loss, kernel lock-ups, ...). In the case of kernel lock-ups, it can be important to have some kernel logs for debugging. Until journald gains a configuration option for flushing kernel logs, rsyslog can be used in conjunction with journald.

Summary of requirements:

• journald must still get all log messages.
• rsyslog must only log kernel messages, all other logs are handled by journald.
• Kernel logs must be logged separatedly to .
• Use systemd to start the service.

Installation and configuration steps:

1. Install rsyslog^AUR.
2. Edit and add to the list of logs. Without this modification, the kernel log would grow indefinitely.
3. Edit and comment everything except for . If a heart-beat (repeated confirmation that the log is alive) is preferred, should remain uncommented as well.
4. Add the next line to the same configuration file:

   The kern.* part catches all messages originating from the kernel. is used here to use a less verbose date format. By default, a date format like is used. Since the kernel log contains a precision already (printk time) and the actual log time is irrelevant, a format like might be preferred.

5. Since rsyslog should operate completely separated from systemd, remove the option that shares a socket with systemd:

6. Next, make rsyslog start on boot and start it for this session by starting and enabling rsyslog.service.