How do systemd-journald and rsyslog complement each other on RHEL?
systemd-journald
rsyslog
Rsyslog collects only kernel events, while journald handles only mail.
They independently overwrite the same plain-text log file.
Journald only rotates /var/log/messages and never stores events itself.
/var/log/messages
Journald collects structured events; rsyslog processes syslog messages and writes or forwards them according to configuration.