▲
12
rsyslog vs syslog-ng vs journald forwarding for shipping off-host
Is there a real reason to pick one, or is it whatever ships with the distro?
Is there a real reason to pick one, or is it whatever ships with the distro?
syslog-ng if you are doing real parsing at the edge, the config language is much nicer for it. rsyslog if you are just shipping.
journald forwarding works but you are taking structured data, flattening it to a text line, and re-parsing it at the other end. Feels wrong every time I set it up.
whatever ships with the distro. the only thing that actually matters is whether you turned on disk queuing, and nobody does until the first time the network goes away for an hour