I have 2 Arch machines, both of which had been set up to forward messages from journald to syslog, and so eventually to the log files in /var/log. I noticed the other day that on both machines, the /var/log log files are now all empty, which I'm guessing means that journald is no longer forwarding messages to syslog. I'm certain that I had this configuration working in the past. But something seems to have changed at some point that's broken it. I'm not sure what changed, or when it happened. I've tried to fix, but with no luck. I have syslog-ng installed, and the syslog-ng@default service enabled and running. I also have "ForwardToSyslog=yes" set in my /etc/systemd/journald.conf file, and the systemd-journald service is enabled and running. Yet somehow they're (I'm guessing) not talking to each other and forwarding the log messages. According to this forum post there might a socket /run/systemd/journal/syslog that needs to be created in order for this setup to work. This socket file doesn't exist on my system. That socket file seems to get created by the systemd unit script /usr/lib/systemd/system/syslog.socket, which seems to be triggered by /usr/lib/systemd/system/systemd-journald.service. However, that syslog.socket unit either doesn't seem to be getting triggered or is failing. And when I try to start the syslog.socket unit script manually, it fails. (And with very little in the way of explanatory messages.): [darose@titan log]$ sudo systemctl start syslog.socket Job failed. See "journalctl -xe" for details. [darose@titan log]$ systemctl status syslog.socket ○ syslog.socket - Syslog Socket Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static) Active: inactive (dead) Triggers: ● syslog.service Docs: man:systemd.special(7) https://systemd.io/SYSLOG Listen: /run/systemd/journal/syslog (Datagram) Dec 20 19:52:01 titan systemd[1]: syslog.socket: Socket service syslog.service not loaded, refusing. Dec 20 19:52:01 titan systemd[1]: Failed to listen on Syslog Socket. Anyone have any idea what might be broken here / how to fix? Thanks, DR
On Mon, 22 Dec 2025 at 15:16, David Rosenstrauch <darose@darose.net> wrote:
I have 2 Arch machines, both of which had been set up to forward messages from journald to syslog, and so eventually to the log files in /var/log. I noticed the other day that on both machines, the /var/log log files are now all empty, which I'm guessing means that journald is no longer forwarding messages to syslog. I'm certain that I had this configuration working in the past. But something seems to have changed at some point that's broken it. I'm not sure what changed, or when it happened. I've tried to fix, but with no luck.
I have syslog-ng installed, and the syslog-ng@default service enabled and running. I also have "ForwardToSyslog=yes" set in my /etc/systemd/journald.conf file, and the systemd-journald service is enabled and running. Yet somehow they're (I'm guessing) not talking to each other and forwarding the log messages.
According to this forum post there might a socket /run/systemd/journal/syslog that needs to be created in order for this setup to work. This socket file doesn't exist on my system. That socket file seems to get created by the systemd unit script /usr/lib/systemd/system/syslog.socket, which seems to be triggered by /usr/lib/systemd/system/systemd-journald.service. However, that syslog.socket unit either doesn't seem to be getting triggered or is failing. And when I try to start the syslog.socket unit script manually, it fails. (And with very little in the way of explanatory messages.):
[darose@titan log]$ sudo systemctl start syslog.socket Job failed. See "journalctl -xe" for details.
[darose@titan log]$ systemctl status syslog.socket ○ syslog.socket - Syslog Socket Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static) Active: inactive (dead) Triggers: ● syslog.service Docs: man:systemd.special(7) https://systemd.io/SYSLOG Listen: /run/systemd/journal/syslog (Datagram)
Dec 20 19:52:01 titan systemd[1]: syslog.socket: Socket service syslog.service not loaded, refusing. Dec 20 19:52:01 titan systemd[1]: Failed to listen on Syslog Socket.
Anyone have any idea what might be broken here / how to fix?
Thanks,
DR
The syslog.socket is for communication between journald and the classic syslog implementation [1]. Syslog-ng has an automatic integration with systemd and pulls logs from the journal by itself [2]. The Wiki says you don't even need "ForwardToSyslog=yes", although I do that too, mostly to avoid missing any logs in syslog-ng. For my setup, I have something like this: ```/etc/systemd/journald.conf.d/forward.conf [Journal] Storage=auto SystemMaxUse=1G RuntimeMaxUse=100M MaxFileSec=1month ForwardToSyslog=yes ``` And then my long-lived logs are managed by syslog-ng and logrotate. [1]: https://wiki.archlinux.org/title/Systemd/Journal#Journald_in_conjunction_wit... [2]: https://wiki.archlinux.org/title/Syslog-ng#systemd/journald_integration
On 12/23/25 8:57 AM, Tiago de Paula wrote:
The syslog.socket is for communication between journald and the classic syslog implementation [1]. Syslog-ng has an automatic integration with systemd and pulls logs from the journal by itself [2].
The Wiki says you don't even need "ForwardToSyslog=yes", although I do that too, mostly to avoid missing any logs in syslog-ng. For my setup, I have something like this:
```/etc/systemd/journald.conf.d/forward.conf [Journal] Storage=auto SystemMaxUse=1G RuntimeMaxUse=100M MaxFileSec=1month ForwardToSyslog=yes ```
And then my long-lived logs are managed by syslog-ng and logrotate.
[1]: https://wiki.archlinux.org/title/Systemd/Journal#Journald_in_conjunction_wit... [2]: https://wiki.archlinux.org/title/Syslog-ng#systemd/journald_integration
Thanks much for that info. Still, I wish I knew why my syslog-ng setup stopped working. (And how to revive it.) DR
On Tue, 23 Dec 2025 at 11:28, David Rosenstrauch <darose@darose.net> wrote:
On 12/23/25 8:57 AM, Tiago de Paula wrote:
The syslog.socket is for communication between journald and the classic syslog implementation [1]. Syslog-ng has an automatic integration with systemd and pulls logs from the journal by itself [2].
The Wiki says you don't even need "ForwardToSyslog=yes", although I do that too, mostly to avoid missing any logs in syslog-ng. For my setup, I have something like this:
```/etc/systemd/journald.conf.d/forward.conf [Journal] Storage=auto SystemMaxUse=1G RuntimeMaxUse=100M MaxFileSec=1month ForwardToSyslog=yes ```
And then my long-lived logs are managed by syslog-ng and logrotate.
[1]: https://wiki.archlinux.org/title/Systemd/Journal#Journald_in_conjunction_wit... [2]: https://wiki.archlinux.org/title/Syslog-ng#systemd/journald_integration
Thanks much for that info.
Still, I wish I knew why my syslog-ng setup stopped working. (And how to revive it.)
DR
Oh, well, maybe some update on syslog-ng or, more likely, on systemd changed something and broke your setup. You can try to checking the logs from "journalctl -u syslog-ng@default.service".
On 12/23/25 9:36 AM, Tiago de Paula wrote:
Oh, well, maybe some update on syslog-ng or, more likely, on systemd changed something and broke your setup. You can try to checking the logs from "journalctl -u syslog-ng@default.service".
Dec 23 08:40:30 titan systemd[1]: Started System Logger Daemon "default" instance. :-( DR
participants (2)
-
David Rosenstrauch
-
Tiago de Paula