Holger Levsen <hol...@layer-acht.org> writes: > On Wed, Nov 17, 2021 at 10:57:11AM +0800, Paul Wise wrote: >> > Do you know of a tool that does what logcheck does, but operating >> > directly on the journal? Logcheck is the only reason I still have >> > rsyslog installed on the servers I maintain. > > same here, I use (and tune) logcheck on all systems I maintain and absolutly > don't wanna miss what I regulary learn from it. >
logcheck tries to check things in the journal using journalctl, so should continue to work without rsyslog. logcheck also needs some help - actually there seem to be many volunteers to help, but no-one who could merge any contributions. Please see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981446
