systemd journal replaces rsyslog

In AL2023 the logging system package has changed from AL2. AL2023 doesn't install rsyslog by default, so the text based log files such as /var/log/messages that were available in AL2 aren't available by default. The default configuration for AL2023 is systemd-journal, which can be examined using journalctl. Although rsyslog is an optional package in AL2023, we recommend the new systemd based journalctl interface and related packages. For more information, see the journalctl manual page.

The systmed journal equivalent to some commonly used syslog commands are covered in the following table.

[ec2-user ~]$ cat /var/log/messages

[ec2-user ~]$ journalctl

[ec2-user ~]$ tail -f /var/log/messages

[ec2-user ~]$ journalctl -f

[ec2-user ~]$ grep foo /var/log/messages

[ec2-user ~]$ journalctl | grep foo