Before you begin

Before configuring log forwarding for Linux JournalId, you must set up log ingestion for the Linux Operating System. See Integrating with Linux Servers.

Configuring Log Forwarding for Linux Journald

Open /etc/systemd/journald.conf with sudo and your preferred editor, and change the option ForwardToSyslog to yes. It should look like ForwardToSyslog=yes.

sudo vim /etc/systemd/journald.conf

No other options need to be changed in the journald configuration for log forwarding. The journald events will now flow into the rsyslogd syslog socket.

Save the file and restart the systemd-journald service on the machine.

Note: Reload can be used in place of restart if there is a particular need to avoid restarting the journald service entirely.

systemctl restart systemd-journald

At this point the configuration is complete. The logs can be also be found in /var/log/messages (or similar catchall log file on your OS) with the journal namespace. The Blumira configuration in /etc/rsyslog.d/ that is handling linux log forwarding will automatically forward the logs.