I am running what is a vanilla Ubuntu 16.04 server, and I'm trying to wrap my head around how logging is set up by default. I can see that both journald
and rsyslog
are installed and running, but it's not at all clear to me how log messages are being processed.
Most messages seem to show up both in /var/log/syslog
and via journalctl
, but I can't see any explicit configuration for forwarding between the two in either /etc/systemd/journald.conf
(which is basically all commented out by default), /etc/rsyslog.conf
or /etc/rsyslog.d/50-default.conf
.
I tried to look for official documentation, or even a blog post explaining how hese two are set up in Ubuntu, but haven't managed to find anything.
To further add to my confusion, I have executed logger -p local1.info Test
on the host, and found that nothing was written to /var/log/syslog
, while the message did show up under journalctl
.
My questions are:
- How exactly do journald and rsyslog work together on Ubuntu 16.04 (by default)?
How come messages sent fromlogger
seemingly end up in the journal, but not in syslog?
Update: Turns out logger
not working as expected was a mistake on my end, so it's not relevant to the main question.
logger -p .info hello
is not valid. You have not given any facility name. – luv.preet Jun 14 '17 at 20:28logger
not working was my fault, so that's fixed now (thanks for the tips anyway). As for logs showing up in two places, your note onimuxsock
seems to be the key: it seems both rsyslog and journald are listening for local syslog messages, hence why those entries go into two separate logs. – motns Jun 16 '17 at 17:20any ideas?
– Hackeron Nov 18 '18 at 17:16imuxsock
is hard-coded to look at/run/systemd/journal/syslog
(SYSTEMD_PATH_LOG
) and/lib/systemd/system/syslog.socket
hasListenDatagram=/run/systemd/journal/syslog
and that triggers/etc/systemd/system/syslog.service -> /lib/systemd/system/rsyslog.service
anddebian/patches/Re-enable-journal-forwarding-to-syslog.patch
makesForwardToSyslog
the default, with only the barest documentation update. – eichin Sep 27 '20 at 23:51