Hacker News Reader

Comment by nailer | Hacker News Reader

Note that most current Linux distributions use journald, rather than syslog. Journald has plugins for the syslog wire protocol though. Personally I prefer app names vs LOCAL4 or the other syslog facilities (UUCP is still in there) but YMMV.

View on HN

I was actually going to ask a question around this. On Ubuntu systems, I see both journald and rsyslog. How are they related? Is journald forwarding to rsyslog?

There are two options. One which works with any syslog daemon: you enable ForwardToSyslog, which creates a socket that can be used instead of /dev/log. Or another for specific daemons: rsyslog and some others can read messages directly from the journal themselves. Option 2 is the default on new systems.

/dev/log is probably a symlink to /run/systemd/journal/dev-log on your system. 'systemctl list-sockets' will show you that the socket is part of the systemd-journald-dev-log.socket unit. So when a program calls the syslog(3) function, it ends up sending the message to journald.

If configured to forward messages to syslog, I think systemd does so via the /run/systemd/journal/syslog socket, which is part of syslog.socket. But I believe rsyslog will these days read messages directly out of the journal rather than relying on journald to forward them.

You've got it right besides the last sentence. Copying from systemd-journald-dev-log.socket comment:

Note that journald internally uses the this socket both for receiving syslog messages, and for forwarding them to any other syslog

edit: formatting

That's a but confusing and I don't know how it would work. But last time I looked into how ForwardToSyslog= worked I discovered it was disabled in the default build configuration these days because rsyslog prefers to ingest from the journal rather than being fed messages via a socket...

See https://unix.stackexchange.com/a/294206/5132 .

Yes. journald uses HTTP for remoting, but I think Ubuntu is set up for syslog compatibility. To set up journald remoting: https://serverfault.com/questions/758244/how-to-configure-sy...

Correcting self: I misread your comment as saying "Is journald forwarding to syslog?" which is accurate. "Is journald forwarding to rsyslog?" (note the 'r') is not accurate.

Unfortunately journald leaves out things like MDC information as well, which usually means JSON logging and trying to avoid broken JSON objects due to log message truncation in some part of the chain.

Sorry, what does MDC mean in this context? Thanks.

"Message digest code" (a hash) I suppose.

Reply on news.ycombinator.com