On 2016-03-03 16:16, Per Jessen wrote:
It all depends on what you do with /var/log/(messages|mail|firewall). The systemd journal certainly does not replace syslog-ng, for instance. (except maybe on a single-user desktop machine at home).
Most of my logs are rotated daily, archived and analyzed (for anomalies, statistics and other feedback). I have a couple of cases where daemons are fed loglines directly from syslog-ng (see the program() option). Maybe that's all possible with journalctl, but syslog-ng does an excellent job.
Indeed it does. For instance, those verbose logs that are not needed after a week I rotate and discard fast. Others I keep for years. I can play with that. On the systemd journal either I delete it all or nothing. I can not remove the nntp entries, for instance, which are huge. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)