Hello,
I’m trying to better understand how to implement/configure alloy on OL9/RH9 servers so that logs are send to a loki server. Specifically, with OL9/RH9 servers, is there any configuration required in the default /etc/rsyslog.conf file surrounding imuxsock and/or the imjournal modules, or do folks generally leave these at their defaults. Some searching online indicates that having the defaults may introduce duplicates and unnecessary entries so just looking for advice on how others are managing this configuration, if at all. It seems OL8/RH8 vs OL9/RH9 operate differently regarding journald, which from my understanding, renders syslog mostly redundant now, so not sure if /var/log/* source files even need to be part of the alloy configuration on OL9/RH9+ going forward, and to just collect journald. For now, we still have a requirement to forward syslog messages to a centralized syslog-ng server, which I do with a /etc/rsyslog.d/forwarding.conf configuration file, but we’re also harvesting via alloy to feed loki as a separate channel. Anyway, any feedback appreciated. Thanks.