Enabling debug fills disk space with logging to kern.log + syslog

[Loïc Gomez]

Enabling debug on a 2.9.42 controller fills syslog AND kern.log files with juju.daemon logs twice.
I wonder what log level juju is using but it should probably set the proper facility to avoid logs getting into kern.log, and instead of going to syslog go to daemon.log.

Mar 22 05:39:20 juju-3128a8-controller-0 juju.daemon[3397876]: 2023-03-22 05:39:19 unit-autocert-ubuntu-0 juju.worker.uniter.operation.e5bd76 ran "update-status" hook (via explicit, bespoke hook script)
Mar 22 05:39:20 juju-3128a8-controller-0 juju.daemon[3397876]: 2023-03-22 05:39:19 unit-ntp-5 unit.ntp/5.update-status.e5bd76 active
Mar 22 05:39:20 juju-3128a8-controller-0 juju.daemon[3397876]: 2023-03-22 05:39:19 unit-ntp-5 unit.ntp/5.juju-log.e5bd76 tracer>#012tracer: main dispatch loop, 1 handlers queued#012tracer: ++ queue handler hooks/relations/juju-info/requires.py:19:changed:juju-info

This is the relevant rsyslog (default) config on the controller:

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
#daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
#lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
#user.* -/var/log/user.log

I guess juju daemon should log to the daemon facility and enable some specific rsyslog setup like this:
/etc/rsyslog.d/10-juju.conf:
if $syslogfacility-text == 'daemon' and $programname startswith 'juju' {
   /var/log/juju/daemon.log
   end
}