freeloadermatt Question: Is there a reason/logic for splitting the destinations like this?
HTTP servers and file server programs have traditionally bypassed syslog altogether for request logs (presumably because of volume) even before systemd was a thing, so that is nothing unusual really. Operational messages ended up in either files or syslog, depending on how the implementor valued their time and whether they implemented one or the other or both.
What makes the use of systemd/journald sort of attractive these days are two things: automatic capture of stderr (which did not exist in sysvinit at all), and the time-based and service-based filters in journalctl -u xx.service --since=yesterday (which are somewhat awkward to do with unstructured plaintext syslog files).
