opensuse 13.2
linux 3.16.7-7-desktop x86_64
Where is the /var/log/messages log disappear?
I found journalctl. It seems to show the same thing as messages but the last entry is 8 hours ago.
If you install “rsyslog”, then you will get “/var/log/messages” back.
I do not mind working with whatever the latest/greatest is, journalctl in this case. It just does not seem very usefull if it is not timely; eight hours behind? Really?
Is there any way to see the real time log entries in journalctl?
Installing rsyslog requires de-installing systemd-logger? Is systemd-logger the feeder for journalctl?
As far as I know, the systemd journal has more than logs. I believe “systemd-logger” grabs the log message and feeds them to the journal.
I installed “rsyslog” and everything is fine.
Does it require a system restart? I installed it and /var/log/messages exists, but is zero length. And has stayed that way for the last several minutes, highly unlikely.
I would think. An install does not change running processes they must be restarted for change to take an effect
Before logging works properly – yes, that requires a restart. Or, at least, restarting all of the applications and services that do logging. It’s easiest to just restart.
Yes, a restart has logging to /var/log/messages again.
No. systemd-logger does not do anything.
It’s a mostly empty package, and only contains a file /var/log/README (explaining why /var/log/messages is missing and where/how to find the logs 
), the directory /var/log/journal/ where the on-disk journal is kept, and a syslog init script for compatibility with legacy init scripts that depend on the syslog service.
None of those are necessary or even make sense if you use rsyslog. And if /var/log/journal/ is not empty it won’t be removed when you uninstall systemd-logger, so even the on-disk journal will still continue to work. If you want to disable that, you need to remove /var/log/journal/ manually.