Clarification on journald source vs syslog

[nivekuil]

Journald can forward logs to a syslog datagram listener, and vector is capable of being one as well as pulling from journald directly. The latter has the downside of requiring an extra binary, so you can't use the alpine docker image for example. Is there guidance on which approach is generally better?

[jszwedko]

Hi @nivekuil !

I think the differences would be that the journald source has additional filter capabilities, parsing, and that it handles checkpointing to ensure it captures all events. If you are content without those things though, you could have journald forward over syslog.

[bruceg]

Another difference is in what data is forwarded from the systemd journal to syslog. As far as I can see the data forwarded to syslog does not contain the full structured data that is present in the journal, including things like the systemd unit that originated the log. If that data is important to you, then the journald source is the only way to get at it.

Further, the syslog datagram protocol is unacknowledged. If the data is to be transmitted over a network that may become congested, you could experience loss of events. Over a local network this is unlikely to become a concern, but it is another consideration.