Ubuntu Core 18: Error message after disabling ssh

no, logging still happens … in Ubuntu Core 16 rsyslog and journald were installed in parallel by default but since this means duplication rsyslog was removed from the image for Ubuntu Core 18.

journald is still there but logs to a ringbuffer in ram by default unless you explicitly create the /var/log/journal directory, then it will start logging inside this dir.

if you want to collect logs over the net on a central logging server you can also follow: