On 02/09/2012 03:29 PM, Dave Reisner wrote:
- With the journal enabled (and it is enabled by default), you no longer need to run a syslog daemon (i.e. syslog-ng or rsyslog). The journal, by default, writes to /run/systemd/journal (meaning logs will poof on reboot). If you want to keep your logs, simply create /var/log/journal. If you really want to keep using a syslog daemon, you must tell it to read from /run/systemd/journal/socket, NOT /dev/log.
I know I do not longer need to run a syslog daemon, but I like my logs in human readable form. So, being a obedient ml reader, I configured my syslog-ng to read from said new socket unix-dgram("/run/systemd/journal/socket"); instead of the old /dev/log. But since then my logs are incomplete at best. So here are my questions: - Why are the logs read from /run/systemd/journal/socket incomplete and how do I fix this? - Why do I even have to change the socket? /dev/log is still there and still works like a charm.