Sorry about missing this PR. This LGTM, although I have a small hesitation at the fact that e.g. sssd appears to log to /var/log/sssd and not the journal...

Another case is libvirtd, which writes to /var/log/libvirt. Now, libvirt isn't in the base, but I definitely layer it on to my host.

We're in a messy situation where most software is on board the journald train but there are some stragglers...

It's certainly tempting to just fix those stragglers.

On the other hand I fear merging this PR as is would cause "space leaks" in /var.

It's certainly tempting to just fix those stragglers.

Indeed, and I would support that initiative. I think this is better off as a proposal for some future release, not just in Silverblue.

Let me know what you think.