Running rsyslog at the same time as journald

Question

I need to dump the data out of a TP-Link router / modem (192.168.1.1) to a PI running a Feb version of Lite (that's the only computer on 24*7) and was thinking about using rsyslog to help me filter out the 'noise' with a selection file in /etc/rsyslog.d/ like this:

# Provide TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
if $fromhost-ip == '192.168.1.1' then {
    if $msg contains 'VoIP' then {
        stop
        }
    if $msg contains 'System: LAN' then {
        action(type="omfile" File="/var/log/rtr-lan.log")
        stop
        }
# Everything else defalts
    action(type="omfile" File="/var/log/rtr-wan.log")
}

This will then ignore the VOIP data (currently 90%+ of the router log is this) and split LAN noticed from WAN notices.

The first concern I have is, would this clash with the normal journald logging on the PI?

The second is, should I configure the facility on the router to User (its default) or Localx where x is 0 to 7 inclusive to keep the normal log running?

Answer 1

would this clash with the normal journald logging on the PI?

They can work together; I use rsyslog for persistent logging and configure journald as volatile (in memory) only. Journald by default passes messages to rsyslog if it is running and configured correctly.

This is on Raspbian/RpiOS, but the steps are much the same on any systemd based distro (probably). You have to enable the service: sudo enable syslog -- or rsyslog, they are synonyms in Raspbian, but you should check that. Also you may need to install rsyslog first.

In /etc/rsyslog.conf:

module (
        load="imjournal"
        PersistStateInterval="100"
        # So the entire journal isn't read all over again
        # when the rsyslog is restarted.
        StateFile="/run/rsyslog.state"
)

This stuff is in rsyslog's copious documentation which I think can also be installed locallly (html) from a repo package.

The comment "so the entire journal isn't read all over again" refers to what can happen if rsyslog is restarted for some reason (eg., because of a configuration change or when the logs are rotated, which happens with normal operation). Without the state file it will read everything journald has stashed, which it would have logged already.

Beyond that I think you can leave the default journald configuration, in which forwarding to syslog is a default (which can be turned off). I instead use this (in /etc/systemd/journald.conf:

[Journal]
Storage=volatile
RuntimeMaxUse=64M
ForwardToConsole=no
ForwardToWall=no

Since it is a bit pointless to store two versions of the info (and journald's binary format is quite a bit fatter). See man journald.conf.