[arch-general] systemd's journal and syslog-ng

[Christian Hesse]

Tobias Frilling <tobias at frilling-online.de> on Wed, 15 Feb 2012 12:35:56
+0100:
> On 02/09/2012 03:29 PM, Dave Reisner wrote:
> > - With the journal enabled (and it is enabled by default), you no longer
> >   need to run a syslog daemon (i.e. syslog-ng or rsyslog). The journal,
> >   by default, writes to /run/systemd/journal (meaning logs will poof on
> >   reboot). If you want to keep your logs, simply create
> >   /var/log/journal. If you really want to keep using a syslog daemon,
> >   you must tell it to read from /run/systemd/journal/socket, NOT
> >   /dev/log.
> 
> I know I do not longer need to run a syslog daemon, but I like my logs in
> human readable form. So, being a obedient ml reader, I configured my
> syslog-ng to read from said new socket
> 	unix-dgram("/run/systemd/journal/socket");
> instead of the old /dev/log. But since then my logs are incomplete at best.
> So here are my questions:
> 
>  - Why are the logs read from /run/systemd/journal/socket incomplete and
> how do I fix this?
>  - Why do I even have to change the socket? /dev/log is still there and
> still works like a charm.

/dev/log gives the messages only once. If two processes read from there it's
just random which gets which messages. Probably that is why your logs are
incomplete. Changing syslog to read from systemd journal's  socket should fix
this.
-- 
Best regards,
Chris
                         O< ascii ribbon campaign
                   stop html mail - www.asciiribbon.org