systemd-journald (binary, structured) and rsyslog (plain-text files in /var/log) — usually running side by side.

* journald collects into a binary indexed journal (queried with journalctl); rsyslog reads it and writes portable plain-text /var/log files — most systems run both. *

Linux has two parallel approaches to collecting log messages, and on a modern distro both are typically active at once:

Why two systems? journald is the newer, central piece of systemd. Every message it receives is stored with rich metadata attached — timestamp, PID, the originating unit, the syslog priority — so you can filter precisely (journalctl -u sshd -p err) instead of grepping text. The trade-off: the journal is a binary database, so you can't cat it; you need journalctl.

How they cooperate: journald collects first. rsyslog then reads from the journal (or its own socket) and writes plain-text files like /var/log/messages. Those text files are easy to grep, tail, ship to a central log server, or feed to old tooling that predates systemd. So journald gives you structured querying; rsyslog gives you portable, greppable, forwardable text — and most systems keep both.

Tip: If cat-ing a log file gives binary garbage, you're looking at the journal — use journalctl instead.

Go deeper:

• systemd (Wikipedia) — journald as the append-only binary logging daemon, beside traditional syslog.