Read System Logs Without rsyslog on Debian 12

Updated 5 November 2026 · Standard formula, shown below

Yes, you can read system logs on Debian 12 without rsyslog because the default logging service is systemd-journald, which captures logs from the kernel, services, and applications. You can view these logs using the journalctl command, and rsyslog is not required for basic log access. This article explains how to use journalctl effectively, how to manage persistent logs, and what to do if you still need traditional text logs.

Background: How Debian 12 Logging Works

Debian 12 (Bookworm) uses systemd as its init system, and systemd-journald is the central logging daemon. It collects log messages from the kernel, systemd services, and applications that write to standard output or the syslog interface. The journal is stored in binary format under /var/log/journal (if persistent) or /run/log/journal (volatile, cleared on reboot). Unlike rsyslog, which writes plain-text files like /var/log/syslog, journald stores structured data with timestamps, priorities, and metadata. You can read the journal with journalctl, which is installed by default. The syslog package (rsyslog) is often installed as a separate service, but it is not required for reading logs.

How to Read Logs with journalctl

The journalctl command is your primary tool. Here are the most common ways to use it:

Show all logs: journalctl
Follow new logs as they appear (like tail -f): journalctl -f
Show logs since the last boot: journalctl -b
Show logs for a specific service: journalctl -u ssh.service
Show logs from the kernel: journalctl -k
Show logs with a specific priority (0=emerg, 1=alert, 2=crit, 3=err, 4=warning, 5=notice, 6=info, 7=debug): journalctl -p err
Show logs since a specific time: journalctl --since "2025-01-01 00:00:00" or journalctl --since "1 hour ago"

You can combine options, e.g., journalctl -u nginx.service -p err --since "2 days ago" to see errors from nginx for the last two days. The output is colorized when you are on a terminal, but you can disable that with --no-pager or --no-color if needed.

Persistent Logs: Making Journal Survive Reboots

By default, Debian 12 may store the journal in /run/log/journal, which is cleared on every reboot. To make logs persistent, create the directory /var/log/journal and set the correct permissions:

Create the directory: sudo mkdir -p /var/log/journal
Set the group to systemd-journal: sudo chown root:systemd-journal /var/log/journal
Set permissions: sudo chmod 2755 /var/log/journal
Restart journald: sudo systemctl restart systemd-journald

After that, logs will survive reboots and you can use journalctl --list-boots to see previous boots. If you want to limit the size of the journal, edit /etc/systemd/journald.conf and set SystemMaxUse=500M (or any size) and restart journald. This is useful for systems with limited disk space.

Comparing journalctl and rsyslog

rsyslog writes plain-text files that are easy to parse with standard tools like grep, awk, and sed. Many administrators are used to /var/log/syslog or /var/log/auth.log. journald, on the other hand, stores data in binary format, but it offers richer metadata (e.g., service name, PID, priority) and is faster for querying large amounts of logs. You can still get traditional text logs by using journalctl to export or forward entries. For example, to write all logs to /var/log/syslog in a text format, you can configure a forwarding rule in journald (see ForwardToSyslog=yes in journald.conf) and run rsyslog, but that requires rsyslog. Without rsyslog, you can simply use journalctl to view logs, or you can create your own text logs by running journalctl > /var/log/my.log periodically via a cron job.

Common Problems and Solutions

Here are some issues you might face when reading logs without rsyslog:

Logs are empty after reboot: This means the journal is volatile. Enable persistent logging as described above.
You get permission denied when running journalctl: Users in the systemd-journal group can read logs. Add your user to that group: sudo usermod -aG systemd-journal $USER, then log out and back in.
You want to see logs from a service that writes to a file, not to journald: Some applications (e.g., Apache) can be configured to log to stdout, but if they write directly to a file, you need to read that file. journalctl will not capture it.
The journal grows too large: Set a size limit in journald.conf and consider using journalctl --vacuum-size=200M to reduce the journal size immediately.
You need to send logs to a central server: Without rsyslog, you can use systemd-journal-remote to receive logs over the network, but that is more complex. For most local use, journalctl is sufficient.

Alternatives and Advanced Tools

If you need more advanced log analysis, you can use lnav (a terminal log viewer) or journalctl --output=json to parse logs programmatically. For real-time monitoring, journalctl -f is the simplest. If you prefer a GUI, you can use gnome-logs on GNOME desktops. For forwarding logs to a remote server, you could use systemd-journal-remote or install rsyslog, but that is optional. The key point is that Debian 12 is fully functional without rsyslog, and journalctl provides all the essential log-reading capabilities.

Frequently Asked Questions

Can I use journalctl to see logs from previous boots?

Yes, if persistent logging is enabled. Use journalctl --list-boots to see boot numbers, then journalctl -b -1 to view logs from the previous boot.

How do I filter logs by a specific user or process?

Use journalctl _UID=1000 to see logs from user ID 1000, or journalctl _PID=1234 for a specific process ID. You can find these values with journalctl -o verbose.

Why do I see no logs for a service that I know is running?

Check if the service writes to the journal by running journalctl -u myservice.service. If it still shows nothing, the service may be writing to its own file (e.g., /var/log/myservice.log). Also ensure the service is not set to StandardOutput=null in its unit file, which discards output.

Is it safe to remove rsyslog from Debian 12?

Yes, it is safe to uninstall rsyslog if you do not need its features. The system will still log to the journal. However, some tools or scripts that expect /var/log/syslog may break. You can create a symlink to the journal output, but it is easier to keep rsyslog if you rely on those files.

Can I export journal logs to a text file for backup?

Yes, use journalctl > backup.log or journalctl -b > boot.log. For a more structured export, use journalctl --output=export > logs.bin, which can be re-imported with systemd-journal-remote.

What is the difference between /var/log and /run/log?

/var/log/journal is persistent storage, while /run/log/journal is in-memory (tmpfs) and cleared on reboot. If you see logs under /run/log/journal, they are volatile. Creating /var/log/journal switches to persistent storage.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.