Hello,
I just installed 13.2 in a VirtualBox in order to test it for a potential upgrade of our small cluster.
While trying to diagnose a problem with ssh public key authentication, I noticed that there is no such file as /var/log/messages …
Any idea why it is gone, and maybe how the logging can be re-enabled?
Best regards,
Oliver
Install “rsyslog” and “/var/log/messages” will come back.
The default is for “systemd” to grab all log message and put in its journal.
I guess that’s a good choice for people who don’t want to look at logs, unless there is a problem to investigate. For those of us who periodically do a “tail” on log files, it’s a bad choice.
Yes. rsyslog (or any other syslog daemon) is not installed by default any more, because it was deemed unnecessary to have the persistent logs twice on the disk, in systemd’s journal and /var/log/messages.
I guess that’s a good choice for people who don’t want to look at logs, unless there is a problem to investigate. For those of us who periodically do a “tail” on log files, it’s a bad choice.
You can look at the logs with “journalctl”, which has sophicisticated filtering options.
You can also do something like “journalctl | tail” of course.
As mentioned, systemd will pass on the logs to rsyslog if installed (that was already the case in 13.1, but there rsyslog was still installed by default).
You can also remove the directory /var/log/journal to disable systemd’s on-disk journal, so you only have the logs in /var/log/messages and related text files. (that was the default setup in 13.1)
That was quick! Thanks a lot to both of you for the explanation. I have installed rsyslog, because it will take some time to get used to the other log … habits are an awful thing…
Cheers,
Oliver
Some like to maintain /var/log/messages, simply because in the event of a crash or system failure , text-based logs can be a valuable resource, and that there has been some crititicism of the systemd journal regarding its binary nature. This consderation notwithstanding, journalctl is a good tool for generating output from systemd.journal with lots of useful options for reporting, and worthwhile reading up on
man journalctl
On 2014-11-06 20:46, deano ferrari wrote:
> Some like to maintain /var/log/messages, simply because in the event of
> a crash or system failure , text-based logs can be a valuable resource,
> and that there has been some crititicism of the systemd journal
> regarding its binary nature. This consderation notwithstanding,
> journalctl is a good tool for generating output from systemd.journal
> with lots of useful options for reporting, and worthwhile reading up on
Unless they have redone it, reading the log is horribly slow, like days,
on a large log on rotating disks. They wrote the code for SSD. There
were reports on this, and no solution, last time I heard.
As for binary logs, with rsyslog you can keep the logs on several types
of binary databases, like mysql.
–
Cheers / Saludos,
Carlos E. R.
(from 13.1 x86_64 “Bottle” at Telcontar)
My point is that /var/log/messages can be maintained, and that there may be good reason to keep using it. 
… a point I agree with.