Senior LevelLinux Commands & SysAdmin
How do you configure journald to forward binary logs to rsyslog or remote syslog servers?
❓ Interview Prompt: Explain systemd-journald log forwarding, /etc/systemd/journald.conf (ForwardToSyslog=yes), rsyslog integration, and remote log shipping.
While 'systemd-journald' stores logs in local binary format, enterprise environments require shipping logs to centralized SIEM platforms (Splunk, Elastic) using rsyslog:
Configuration:
1
In /etc/systemd/journald.conf: Enable 'ForwardToSyslog=yes'.
2
Configured rsyslog service receives log streams from journald and forwards them over TCP/TLS to remote log collectors.
Code Implementation Example
ini
# /etc/systemd/journald.conf
[Journal]
Storage=persistent
Compress=yes
ForwardToSyslog=yes
MaxRetentionSec=1month💡Configuring systemd-journald log forwarding to rsyslog.
🎯 Interview Key Takeaway
Configure ForwardToSyslog=yes in journald.conf to route systemd logs to rsyslog for centralized remote log shipping.
#journald#rsyslog#Log Shipping#Senior
Back to all Linux Commands & SysAdmin Questions→