Syslog basics
Compared to the systemd/journald logging we’ve shown you, syslog may seem a bit archaic. We prefer to think of it as having a storied history – although it’s been around since the 1980s, it’s still a useful, flexible, and widely-used logging tool. More importantly, you’re almost guaranteed to come across it on real production systems, so it’s worth knowing the basics to avoid being caught off guard during an outage where time is critical.
On a Unix-like system, logging to syslog is often equivalent to logging to a file in /var/log, with the majority of messages typically going to /var/log/messages. Keep in mind, however, that not everything you find in /var/log necessarily went through syslog. Various pieces of software also implement their own way of writing log files, skipping the syslog daemon entirely.
This works by syslog ingesting all the logs sent to it and depending on various parameters, like the facilities mentioned...
