[Bug 1618188] Re: systemd journal should be persistent by default: /var/log/journal should be created; remove rsyslog from default installs

[Mark Stosberg]

@dino99. Because good defaults matter. Being safe by default is
important. Being secure by default is important.

The "Principle of least surprise" applies here:

"In general engineering design contexts, the principle can be taken to
mean that a component of a system should behave in a manner consistent
with how users of that component are likely to expect it to behave".

One reasonable expects their logs to saved through reboot, as system
logs have worked that way for the last couple of decades.

I didn't think to go create "/var/log/journal" because I trusted Ubuntu
to continue to be "safe by default" has it generally has been for years.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1618188

Title:
  systemd journal should be persistent by default: /var/log/journal
  should be created; remove rsyslog from default installs

Status in systemd package in Ubuntu:
  Triaged
Status in ubuntu-meta package in Ubuntu:
  Triaged

Bug description:
  After upgrading 14.04 -> 16.04, key services are now running on
  systemd and using the systemd journal for logging. In 14.04, key
  system logs like /var/log/messages and /var/log/syslog were
  persistent, but after the upgrade to 16.04 there has a been a
  regression of sorts: Logs sent to systemd's journald are now being
  thrown away during reboots.

  This behavior is controlled by the `Storage=` option in
  `/etc/systemd/journald.conf`. The default setting is `Storage=auto`
  which will persist logs in `/var/log/journal/`, *only if the directory
  already exists*. But the directory was not created as part of the
  14.04 -> 16.04 upgrade, so logging was being lost for a while before I
  realized what was happening.

  This issue could be solved by either creating /var/log/journal or
  changing the default Storage behavior to `Storage=persistent`, which
  would create the directory if need be.

  ## Related reference

   * `systemd` currently compounds the issue by having ["journal --disk-usage" report memory usage as disk usage](https://github.com/systemd/systemd/issues/4059), giving the impression that the disk is being used for logging when it isn't. 
   * [User wonders where to find logs from previous boots, unaware that the logs were thrown away](http://askubuntu.com/questions/765315/how-to-find-previous-boot-log-after-ubuntu-16-04-restarts)

  ## Recommended fix

  Restoring persistent logging as the default is recommended.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1618188/+subscriptions