How to manage Linux logs?

Introduction

Log management is critical for troubleshooting, security audit, and compliance. Modern Linux has two main systems: systemd journal (journald) and traditional syslog (rsyslog).

journald stores binary structured logs; rsyslog is text-based with remote forwarding. Both usually run together on most distributions.

This guide covers configuration, filtering, rotation, and central aggregation for both.

journalctl Basics

journalctl reads all journal records. -u nginx.service filters by unit. -p err only error and above. -b this boot, -b -1 previous boot.

--since and --until time range. -o json-pretty structured output.

journalctl -u myapp.service -f
journalctl -p warning --since '2026-01-01'
journalctl -b -1 -u ssh.service

journald Configuration

/etc/systemd/journald.conf Storage=persistent keeps logs after reboot. SystemMaxUse disk limit. ForwardToSyslog=yes forwards to rsyslog.

Compress=yes compression. RateLimitIntervalSec burst flood protection.

# /etc/systemd/journald.conf
[Journal]
Storage=persistent
SystemMaxUse=500M
ForwardToSyslog=yes
Compress=yes

rsyslog Configuration

/etc/rsyslog.conf and /etc/rsyslog.d/*.conf rule files. facility.severity /path format. local0.* /var/log/myapp.log for app logs.

Remote forwarding: *.* @@logserver:514 (secure with TCP TLS).

# /etc/rsyslog.d/myapp.conf
local0.*    /var/log/myapp/app.log
& stop

# Merkezi toplama
*.* @@logs.example.com:6514

logrotate

logrotate rotates log files via rules in /etc/logrotate.d/. daily/weekly, rotate N, compress, postrotate script.

copytruncate copies and truncates open file; no app reload needed.

/var/log/myapp/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl reload myapp
    endscript
}

Central Log Aggregation

ELK, Loki + Grafana, or Splunk provide central analysis. Filebeat/Fluent Bit ships logs from servers.

JSON formatted logs ease parsing. Structured logging should be standard in production.

Logları yalnızca diskte tutmayın; disk dolması üretim kesintisine yol açar.

Security and Compliance

Do not log sensitive data (passwords, tokens). Protect log files with proper permissions (640, root:adm).

Retention policy must meet legal requirements. Audit personal data logs under GDPR/privacy laws.

1. Persistent journal
2. logrotate aktif
3. Merkezi toplama
4. Hassas veri maskeleme
5. Retention politikası

Conclusion

journalctl and rsyslog together form a strong log infrastructure. journald for fast local diagnosis, rsyslog for remote aggregation.

Make structured logging, rotation, and central aggregation mandatory in production.