From anti-systemd to pro-systemd in the shortest time

Posted Feb 1, 2014 1:00 UTC (Sat) by cortana (subscriber, #24596)
In reply to: From anti-systemd to pro-systemd in the shortest time by dlang
Parent article: This week in "As the Technical Committee Turns"

Ah, that's very interesting, thanks. There's certainly more overlap between what rsyslog and journald can capture than I thought. Sadly I think that journald being interposed between a process transmitting a log message and rsyslog would prevent rsyslog from being able to get the original value of these fields. :(

From anti-systemd to pro-systemd in the shortest time

Posted Feb 1, 2014 2:38 UTC (Sat) by dlang (guest, #313) [Link]

actually, processes running as root can forge all that data, so journald can forge that data so that Rsyslog gets the correct data. However, as I understand it, not everything gets passed through the log socket, so Rsyslog doesn't get setup that way, instead there is an imjournal module that interfaces with the journal the same way that journalctl does, reading and parsing the files that it creates.