What is the name of the systemd component that handles logging?

The systemd component that handles logging is journald, formally provided by the systemd-journald service.

journald collects messages from several sources, including the Linux kernel, services’ standard output and error streams, traditional syslog calls, and the system audit subsystem. It stores records in a structured journal, adding metadata such as the service unit, process ID, user ID, and boot session. This makes filtering more precise than searching ordinary text logs.

The journal is normally viewed with journalctl, but journalctl is a client command, not the logging daemon itself. A common mix-up is rsyslog, which is a separate syslog implementation that many systems run alongside journald for text-file storage, forwarding, or compatibility with older applications. journald can store logs persistently under /var/log/journal or temporarily under /run/log/journal, depending on configuration and directory availability.