Thoughts on removing rsyslog from the default desktop install even if we keep it elsewhere?
I’m worried that having both journal and rsyslog will cause more wear and tear on some SSDs. (my tests don’t show a significant difference in bootup times, etc).
Could you get more detail about the consequences of this change?
For instance, apt doesn’t use the systemd journal. Does it use rsyslog?
Maybe what you’re most wanting is for ForwardToSyslog=no to be set by systemd. See /etc/systemd/journald.conf
Basically - no more kern.log, syslog in in /var/log. Instead you access the equivalent via the journal.
Looking rsyslog also provides files for auth.log, mail., news. and ufw from the default install. For completeness here are the equivalent commands:
kern.log - journalctl -k
syslog - journalctl -b 0 (where 0 is current boot, if you want 2 boots ago, use -2 or you can just use no argument for all)
auth.log - you can either just do the whole journal or select the auth service you are interested. for example, journalctl -b 0 -u systemd-logind
mail., news. - not relevant for desktop?
UFW can just search for the keyword
In my testing, apt/*, dpkg.log, apport.log, and gpu-manager.log all seem to write directly to /var/log so shouldn’t be impacted by this change.
Could you test with just that conf file change I suggested?
Or I guess you could recompile systemd in a PPA with the default change.
If that does close to what you want, then let’s open a systemd bug in Launchpad and ask about changing that. Logging is a controversial topic, but I think other Ubuntu developers had concern about duplication now that we have a persistent journal by default.
Odd, with the ForwardToSyslog=no change it still sens kernel logs to both /var/log/syslog and /var/log/kern.log
(but it appears to send less).
I don’t see any use for having rsyslog installed if we disable logging to it from systemd though.