[arch-general] syslog-ng + systemd-journald = no logs for syslog-ng

[Leonid Isaev]

TL:DR: Syslog-ng in [extra] is kind of broken, so you'll need to a few steps to
get it to work in your environment.

On Sun, Feb 15, 2015 at 10:37:22AM +0100, Ephaeton at gmx.net wrote:
> ## vanilla /etc/syslog-ng/syslog-ng.conf
> # grep -v '^#' /etc/systemd/journald.conf
> 
> [Journal]
> ForwardToSyslog=no

1. Set this to "yes".

2. Replace the stock syslog-ng.service with this:
------
$ cat /etc/systemd/system/syslog-ng.service
[Unit]
Description=System Logger Daemon
Documentation=man:syslog-ng(8)
Requires=syslog.socket

[Service]
ExecStart=/usr/bin/syslog-ng -F
ExecReload=/usr/bin/kill -HUP $MAINPID
StandardOutput=null

[Install]
WantedBy=multi-user.target
Alias=syslog.service
------

3. Fix the src{} in syslog-ng.conf:
------
source src {
  #system();
  unix-dgram("/run/systemd/journal/syslog");
  internal();
  file("/proc/kmsg");
};
------

4. Reenable syslog-ng.service and restart syslog.

Explanation:
Syslog indeed imports data from journald, but _only_ if journald stores the
logs (I guess that syslog-ng reads logs from the journald file on-disk). If you
don't want journald storage, you'll have to use the "old" way by making systemd
forward logs to syslog. The stock syslog-ng.service file is broken because it
doesn't pull in syslog.socket.

And, no, I haven't filed any bugreports, so go ahead if you feel like it. But I
personally recommend simply repackaging syslog-ng without systemd support...

HTH,
-- 
Leonid Isaev
GPG fingerprints: DA92 034D B4A8 EC51 7EA6  20DF 9291 EE8A 043C B8C4
                  C0DF 20D0 C075 C3F1 E1BE  775A A7AE F6CB 164B 5A6D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-general/attachments/20150215/52b740b2/attachment.asc>