Normalerweise loggt journald ins journal, sobald du /var/log/journal/ anlegst. Danach am besten den rsyslog lahmlegen sonst loggt er doppelt.
man journald.conf:
Code: Alles auswählen
Storage=
Controls where to store journal data. One of "volatile",
"persistent", "auto" and "none". If "volatile", journal
log data will be stored only in memory, i.e. below the
/run/log/journal hierarchy (which is created if needed).
If "persistent", data will be stored preferably on disk,
i.e. below the /var/log/journal hierarchy (which is
created if needed), with a fallback to /run/log/journal
(which is created if needed), during early boot and if the
disk is not writable. "auto" is similar to "persistent"
but the directory /var/log/journal is not created if
needed, so that its existence controls where log data
goes. "none" turns off all storage, all log data received
will be dropped. Forwarding to other targets, such as the
console, the kernel log buffer or a syslog daemon will
still work however. Defaults to "auto".
Unix is user-friendly; it's just picky about who its friends are.