TL:DR: Syslog-ng in [extra] is kind of broken, so you'll need to a few steps to get it to work in your environment. On Sun, Feb 15, 2015 at 10:37:22AM +0100, Ephaeton@gmx.net wrote:
## vanilla /etc/syslog-ng/syslog-ng.conf # grep -v '^#' /etc/systemd/journald.conf
[Journal] ForwardToSyslog=no
1. Set this to "yes". 2. Replace the stock syslog-ng.service with this: ------ $ cat /etc/systemd/system/syslog-ng.service [Unit] Description=System Logger Daemon Documentation=man:syslog-ng(8) Requires=syslog.socket [Service] ExecStart=/usr/bin/syslog-ng -F ExecReload=/usr/bin/kill -HUP $MAINPID StandardOutput=null [Install] WantedBy=multi-user.target Alias=syslog.service ------ 3. Fix the src{} in syslog-ng.conf: ------ source src { #system(); unix-dgram("/run/systemd/journal/syslog"); internal(); file("/proc/kmsg"); }; ------ 4. Reenable syslog-ng.service and restart syslog. Explanation: Syslog indeed imports data from journald, but _only_ if journald stores the logs (I guess that syslog-ng reads logs from the journald file on-disk). If you don't want journald storage, you'll have to use the "old" way by making systemd forward logs to syslog. The stock syslog-ng.service file is broken because it doesn't pull in syslog.socket. And, no, I haven't filed any bugreports, so go ahead if you feel like it. But I personally recommend simply repackaging syslog-ng without systemd support... HTH, -- Leonid Isaev GPG fingerprints: DA92 034D B4A8 EC51 7EA6 20DF 9291 EE8A 043C B8C4 C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D