[systemd-devel] Native Journal source vs syslog forwarding

[Lennart Poettering]

On Mon, 01.12.14 00:30, Gergely Nagy (algernon at madhouse-project.org) wrote:

> >>>>> "Lennart" == Lennart Poettering <lennart at poettering.net> writes:
> 
>     >> Forwarding is enabled by default on Debian, as I wrote in my original
>     >> mail. I have no control over the default, and I have no desire to argue
>     >> for changing it. There are other syslogds in Debian (including the
>     >> default one) that do not read from the Journal, but rely on forwarding.
>     >> If forwarding was turned off, they'd stop working. Older versions of
>     >> syslog-ng would, too.
> 
>     Lennart> "other syslogds"? Which ones just out of curiosity? If both syslog-ng
>     Lennart> and rsyslog can now read directly from the journal I wonder what other
>     Lennart> syslog implementation debian wants to support there...
> 
> There's a handful of syslogds, including busybox-syslogd, and the
> ancient sysklogd, among other things. Furthermore, we want to support
> upgrades that continue running sysvinit, so we can't make the journal
> reader default (unless the syslogd can - like syslog-ng - figure out
> which one to use at run time). (iirc the default rsyslog.conf uses
> /dev/log, and rsyslog translates that to /run/systemd/journal/syslog if
> it detects systemd, thus preserving compatibility.)

Note that in very recent systemd /dev/log is actually a symlink to the
real socket in /run/systemd/. This concept allows compatibility with
those ancient syslog implementations by simply making them replace the
symlink and own /dev/log directly. That way the the journal is
bypassed for syslog messages, but I figure this might be a better
compat model for those implementations, after all they'd need patching
anyway to read from the forwarder socket or the journal...

Lennart

-- 
Lennart Poettering, Red Hat