This step by step tutorial will take you through how to enable Rsyslog logging on Debian 12. Debian 12 bookworm uses systemd-journald logging by default. As such, it has deprecated the use of Rsyslog for logging so as to prevent the log messages being written twice on disk.
Table of Contents
Enabling Rsyslog Logging on Debian 12
Rsyslog vs Journald
Rsyslog and Systemd-journald are both logging systems commonly used in Linux distributions for collecting and storing log data. However, they have different features, functionalities, and configurations.
Rsyslog
- rsyslog is a traditional and widely-used logging system in Linux distributions.
- It uses a client-server architecture where log messages can be received from various sources and forwarded to remote syslog servers or stored locally.
- rsyslog supports a wide range of log inputs and outputs, including files, network protocols (like syslog, TCP, and UDP), and database backends.
- It provides flexible configuration options, allowing customization of log routing, filtering, and processing rules.
- rsyslog supports advanced features such as log rotation, compression, log rate limiting, and filtering based on severity levels or message content.
- Configuration is typically done through the /etc/rsyslog.conf file and additional configuration files in the /etc/rsyslog.d/ directory.
- rsyslog.service is responsible for starting, stopping, and managing the
rsyslogdaemon. - By default, on many Linux distributions,
rsyslogstores logs in/var/log/directory, with different log files for various system components and services.
Systemd-Journald
systemd-journaldis a new logging system that is part of the systemd initialization system, which is becoming the standard in many modern Linux distributions.- It uses a binary log format and stores log data in a structured manner, making it efficient for log retrieval and analysis.
systemd-journaldcaptures log messages directly from services and processes that use the systemd journal API.- It provides advanced features such as log compression, rate limiting, and the ability to store metadata along with log entries.
systemd-journaldintegrates well with other systemd components and can capture additional system information like boot logs and kernel messages.- Logs stored by
systemd-journaldare accessed using thejournalctlcommand-line tool. - Configuration options for
systemd-journaldare specified in the/etc/systemd/journald.conffile. - Starting, stopping, and managing the
systemd-journalddaemon is managed by thesystemd-journald.service. - By default, the log data is stored in
/var/log/journal/directory. The logs are organized by system and user, with separate directories for each.
Install Rsyslog on Debian 12
Since Rsyslog has been deprecated and made optional on Debian 12, it doesn’t come installed by default now on Debian 12.
It is still however possible to install the rsyslog package and it will work as usual.
Thus, execute the commands below to install
sudo apt updatesudo apt install rsyslogWhen installed, it is started and enabled to run on system boot by default;
systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
Active: active (running) since Sun 2023-07-09 07:20:41 CEST; 13s ago
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 8868 (rsyslogd)
Tasks: 4 (limit: 2284)
Memory: 1.6M
CPU: 9ms
CGroup: /system.slice/rsyslog.service
└─8868 /usr/sbin/rsyslogd -n -iNONE
Jul 09 07:20:41 bookworm systemd[1]: Starting rsyslog.service - System Logging Service...
Jul 09 07:20:41 bookworm rsyslogd[8868]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2302.0]
Jul 09 07:20:41 bookworm systemd[1]: Started rsyslog.service - System Logging Service.
Jul 09 07:20:41 bookworm rsyslogd[8868]: [origin software="rsyslogd" swVersion="8.2302.0" x-pid="8868" x-info="https://www.rsyslog.com"] start
Once started, you should now be able to see more log files written to /var/log.
Before rsyslog package was installed, this is how /var/log directory looked like;
ls -1 /var/log/
alternatives.log
apt
boot.log
btmp
cups
dpkg.log
faillog
fontconfig.log
gdm3
installer
journal
lastlog
private
README
speech-dispatcher
wtmp
After the rsyslog package was installed, you should see more log files;
ls -1 /var/log
alternatives.log
apt
auth.log
boot.log
btmp
cups
dpkg.log
faillog
fontconfig.log
gdm3
installer
journal
kern.log
lastlog
private
README
speech-dispatcher
syslog
user.log
wtmp
Rsyslog Log Rotation
logrotate should still be able to rotate the rsyslog logs normally;
cat /etc/logrotate.d/rsyslog
/var/log/syslog
/var/log/mail.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/cron.log
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
Disable Systemd-Journald Logging
Note that, when rsyslog is installed and enabled, systemd-journald is still logging as well. As such, you will end up with logs being written twice on disk.
See sample SSH logs;
tail -f /var/log/auth.log
...
2023-07-09T07:43:56.805153+02:00 bookworm sshd[4002]: Accepted password for kifarunix from ::1 port 60980 ssh2
2023-07-09T07:43:56.806404+02:00 bookworm sshd[4002]: pam_unix(sshd:session): session opened for user kifarunix(uid=1000) by (uid=0)
2023-07-09T07:43:56.828788+02:00 bookworm systemd-logind[500]: New session 5 of user kifarunix.
2023-07-09T07:43:56.856568+02:00 bookworm sshd[4002]: pam_env(sshd:session): deprecated reading of user environment enabled
journalctl -f
...
Jul 09 07:43:56 bookworm sshd[4002]: Accepted password for kifarunix from ::1 port 60980 ssh2
Jul 09 07:43:56 bookworm sshd[4002]: pam_unix(sshd:session): session opened for user kifarunix(uid=1000) by (uid=0)
Jul 09 07:43:56 bookworm systemd-logind[500]: New session 5 of user kifarunix.
Jul 09 07:43:56 bookworm systemd[1]: Started session-5.scope - Session 5 of User kifarunix.
If you want to save some disk space, you can disable systemd-journald logging. This can be done by removing the logging directory, /var/log/journal , thus preventing journald from using its own message persistence logic.
rm -rf /var/log/journalAnd that is it. You are now back to traditional logging on Debian 12!
That closes are guide on enabling Rsyslog logging on Debian 12.
