Is it expected to not have `rsyslog` installed after a fresh install of ubuntu server?

Question

Is it expected to not have rsyslog installed after a fresh install of ubuntu server? If yes, where do logs that go to /var/log/auth.log actually go then?

Here is what happened: I was looking for /var/log/auth.log file and I could not find it. My search leads me to this thread where people say that rsyslog is the issue.

I realized I did not even have rsyslog installed after my fresh ubuntu server install (I selected the minimized installation).

> sudo service rsyslog status
Unit rsyslog.service could not be found.

After installing rsyslog, the /var/log/auth.log file started to exist.

Why didn't Ubuntu install rsyslog? Seems like a pretty important piece to have.

What am I misunderstanding?

• Ubuntu server 22.04.4 LTS
• Used the "minimized" option during install

Thanks

Answer 1

The minimized image does not contain rsyslog. Your experience is expected.

You are right that journald is still installed as part of systemd. The /dev/log file has pointed to journald for several LTS releases now. The default settings for journald include ForwardToSyslog=yes, which is why rsyslog still processes logs when installed.

A lot of packages you probably would expect in a Linux system are not installed when using the "minimized" image. When the 22.04 installer was released I compared the packages within the images to see what is missing in the "minimized" image.

root@ubuntu-server:/# diff <(dpkg --admindir=/media/minimal/var/lib/dpkg -l | grep ^ii | sort) <(dpkg --admindir=/media/filesystem/var/lib/dpkg -l | grep ^ii | sort) | grep ii | awk '{print $3}'
apt-utils
bash-completion
bc
bind9-dnsutils
bind9-host
bind9-libs:amd64
bolt
bsdextrautils
busybox-static
byobu
cloud-initramfs-copymods
cloud-initramfs-dyn-netconf
command-not-found
cron
debconf-i18n
distro-info
dmidecode
dosfstools
ed
eject
ethtool
file
fonts-ubuntu-console
friendly-recovery
ftp
fwupd
fwupd-signed
git
git-man
hdparm
htop
info
init
install-info
iptables
iputils-ping
iputils-tracepath
irqbalance
landscape-common
less
libarchive13:amd64
libatasmart4:amd64
libblockdev-crypto2:amd64
libblockdev-fs2:amd64
libblockdev-loop2:amd64
libblockdev-part-err2:amd64
libblockdev-part2:amd64
libblockdev-swap2:amd64
libblockdev-utils2:amd64
libblockdev2:amd64
libefiboot1:amd64
libefivar1:amd64
liberror-perl
libestr0:amd64
libevent-core-2.1-7:amd64
libfastjson4:amd64
libflashrom1:amd64
libfribidi0:amd64
libftdi1-2:amd64
libfwupd2:amd64
libfwupdplugin5:amd64
libgcab-1.0-0:amd64
libgpgme11:amd64
libgpm2:amd64
libgudev-1.0-0:amd64
libgusb2:amd64
libip6tc2:amd64
libjansson4:amd64
libjcat1:amd64
libjson-glib-1.0-0:amd64
libjson-glib-1.0-common
liblmdb0:amd64
libmagic-mgc
libmagic1:amd64
libmaxminddb0:amd64
libmbim-glib4:amd64
libmbim-proxy
libmm-glib0:amd64
libmspack0:amd64
libnetfilter-conntrack3:amd64
libnewt0.52:amd64
libnfnetlink0:amd64
libnftables1:amd64
libnftnl11:amd64
libnl-3-200:amd64
libnl-genl-3-200:amd64
libnspr4:amd64
libnss3:amd64
libnuma1:amd64
libparted-fs-resize0:amd64
libparted2:amd64
libpcap0.8:amd64
libpipeline1:amd64
libpython3.10:amd64
libqmi-glib5:amd64
libqmi-proxy
libslang2:amd64
libsmbios-c2
libsodium23:amd64
libtcl8.6:amd64
libtext-charwidth-perl
libtext-iconv-perl
libtext-wrapi18n-perl
libtss2-esys-3.0.2-0:amd64
libtss2-mu0:amd64
libtss2-sys1:amd64
libtss2-tcti-cmd0:amd64
libtss2-tcti-device0:amd64
libtss2-tcti-mssim0:amd64
libtss2-tcti-swtpm0:amd64
libudisks2-0:amd64
libutempter0:amd64
libuv1:amd64
libvolume-key1
libxmlsec1-openssl:amd64
libxmlsec1:amd64
libxslt1.1:amd64
locales
logrotate
lshw
lsof
lxd-installer
lxd-agent-loader
man-db
manpages
modemmanager
motd-news-config
mtr-tiny
nano
netcat-openbsd
nftables
open-vm-tools
overlayroot
parted
pastebinit
patch
powermgmt-base
psmisc
python3-automat
python3-bcrypt
python3-commandnotfound
python3-constantly
python3-debconf
python3-debian
python3-gdbm:amd64
python3-hamcrest
python3-hyperlink
python3-incremental
python3-newt:amd64
python3-openssl
python3-pexpect
python3-ptyprocess
python3-pyasn1
python3-pyasn1-modules
python3-service-identity
python3-twisted
python3-zope.interface
rsync
rsyslog
run-one
sbsigntool
screen
secureboot-db
sosreport
strace
tcl
tcl8.6
tcpdump
telnet
time
tmux
tnftp
tpm-udev
ubuntu-advantage-tools
ubuntu-minimal
ubuntu-server
ubuntu-standard
udisks2
ufw
update-manager-core
update-notifier-common
usb-modeswitch
usb-modeswitch-data
usb.ids
uuid-runtime
vim
vim-common
vim-runtime
vim-tiny
whiptail
zerofree

The manifest files for the cloud-images may provide more recent differences between the images

• https://cloud-images.ubuntu.com/jammy/current/
• https://cloud-images.ubuntu.com/minimal/releases/jammy/release/

I believe the images are created by scripts in the live-cd repository, and the packages installed are defined by the server and server-minimal seeds.

A couple of the comments may provide additional context.

• ubuntu-server-minimal.catalog-in.yaml

  This version has been customized to have a small runtime footprint in environments where humans are not expected to log in.

• server-minimal

  This seed is approximately the smallest set of packages that could be called "an Ubuntu server".