[systemd-devel] right way to log to rsyslog/syslog only?

[Lennart Poettering]

On Thu, 07.08.14 14:06, Frantisek Hanzlik (franta at hanzlici.cz) wrote:

> Hi, I just install Fedora 20 (with systemd 208) and want log,
> if possible, without journald, only to rsyslog.

Why if I may ask?

Trying to do that is usually more a sign of misconceptions about systemd
or the journal than really technically valid.

journald is not an optional component of systemd, among other things it
is responsible for collecting logs during early boot/initrd and from
stdout/stderr from all running services, regardless when they
run. It then forwards those logs to disk (optional, but on by default),
to another syslog daemon (optional, but on by default), kmsg, the
console (both off by default) or wall (on for high-importance messages).

syslog OTOH only runs in late boot, and thus traditionally got a much
more limited view on what is happening on the systemd. By running syslog
and journald in tandem you will actually get substantially more data
into syslog than you got before: all the stuff from stdout/stderr plus
all the early-boot stuff. The journal is hence a good thing, even if you
do not intend to ever query it directly.

What you can do is turn off journald's local storage. Use the Storage=
setting in journald.conf for that.

> I have this configuration:
> 
> 'systemd.log_target=syslog-or-kmsg' at kernel command line

This doesn't do what you think it does. Regardless if you use
"syslog-or-kmsg" or "journal-or-kmsg", in both cases PID 1 sends it data
to journald, just the transport is different, and if you use syslog you
simply lose a lot of context such as line numebrs and sources files log
messages are generated from. 

I have now removed "syslog-or-kmsg" from the documentation, to make this
less confusing. Also, internally PID 1 will now change "syslog-or-kmsg"
to journal-or-kmsg, thus making them entirely identical.

Also note that this setting only influences PID 1, but systemd has a lot
more processes.

> 
> '/etc/systemd/system.conf':
> [Manager]
> LogTarget=syslog-or-kmsg

This is exactly the same setting as the kernel cmdline option above, and
hence redundant.

> DefaultStandardOutput=syslog

This has not the effect you might assume. It just tells journald to
forward data it receives from the daemons to syslog, but it does that
anyway by default. It's hence fully equivalent to the default of
"journal", unless you globally turned off forwarding to syslog in
journald.

I have extended the man page now to explain this in more detail

> '/etc/systemd/user.conf':
> [Manager]
> LogTarget=syslog-or-kmsg

This makes little sense, as unpriviliged processes cannot lot to "kmsg".

> '/etc/systemd/journald.conf':
> [Journal]
> Storage=none

This is the only relevant setting really.

> It's good that I have no /var/log/journal/* files, but
> - journald is still runnig (this isn't too imporatant, but when it
>    is possible work without it, it will be better)

it think you have weird definitions of "good"and "better"

> - fundamental problem seems be, that some daemons logs not appear
>    in rsyslog files, for unknown reason.

Note that nowadays rsyslog doesn't even care about systemd forwarding
things to syslog, but instead pulls everything out of the journal on its
own. 

If you turn off local storage of the journal entirely, then rsyslog
cannot pull anything out of the journal anymore, since that's empty.

You can set Storage=volatile in which case journald will use a limited
ring buffer in /run, which rsyslog then can pull the data out of.

> systemd/journald man pages are not clear how solve this, please can
> someone touch me to right direction?

Yeah, we usually document how to use software, not to how to not use
it...

Lennart

-- 
Lennart Poettering, Red Hat