- based on logging information that is received from the
- kernel, from user processes via the libc
- <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
- call, from standard input and standard error of system
- services or via its native API. It will implicitly
- collect numerous metadata fields for each log
- messages in a secure and unfakeable way. See
+ based on logging information that is received from a
+ variety of sources:</para>
+
+ <itemizedlist>
+ <listitem><para>Kernel log messages, via kmsg</para></listitem>
+
+ <listitem><para>Simple system log messages, via the
+ libc <citerefentry
+ project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+ call</para></listitem>
+
+ <listitem><para>Structured system log messages via the
+ native Journal API, see
+ <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>4</manvolnum></citerefentry></para></listitem>
+
+ <listitem><para>Standard output and
+ standard error of system
+ services</para></listitem>
+
+ <listitem><para>Audit records, via the audit subsystem</para></listitem>
+ </itemizedlist>
+
+ <para>The daemon will implicitly collect numerous
+ metadata fields for each log messages in a secure and
+ unfakeable way. See