On Mon, 27 May 2024 at 15:09, Simon McVittie <s...@debian.org> wrote: > > On Mon, 27 May 2024 at 14:38:44 +0100, Luca Boccassi wrote: > > Yes this sounds reasonable - do you already have an idea about which > > is which, from the list above? > > Nothing reliable, so please check before opening bugs. > > I know fail2ban and logcheck do read plain-text logs (although as > mentioned, fail2ban already has native Journal-reading support too), and I > would guess that fwlogwatch, snort and xwatch probably also read the logs. > > >From my limited knowledge of what they do, I would guess that approx, > hippotat, inetutils-*d, request-tracker*, *inetd and spamd are just log > sources that need a syslog-compatible logging sink, for which either > journald or a traditional syslogd should be equally valid. > > The others, no idea.
Filed bugs, it's just 16 after a cursory look to exclude a few. I've included a note saying explicitly it's fine to keep a dependency for the case you pointed out, that should be enough. https://bugs.debian.org/cgi-bin/pkgreport.cgi?users=bl...@debian.org;tag=system-log-daemon
