[systemd-devel] Antw: [EXT] Re: Q; syslog.socket dependency

[Michael Chapman]

On Fri, 12 Mar 2021, Ulrich Windl wrote:
> >>> Reindl Harald <h.reindl at thelounge.net> schrieb am 11.03.2021 um 16:23 in
> Nachricht <4422087b-9966-e7fb-66ad-4157d83f2f3b at thelounge.net>:
> 
> > 
> > Am 11.03.21 um 12:17 schrieb Ulrich Windl:
> >> Hi!
> >> 
> >> I have a unit that uses logger, and I want to run it after syslog is 
> > available. So I added syslog.socket as dependency, but it fails:
> >> Mar 11 12:11:02 jeos1 systemd[1]: syslog.socket: Socket service 
> > syslog.service not loaded, refusing.
> >> Mar 11 12:11:02 jeos1 systemd[1]: Failed to listen on Syslog Socket.
> >> 
> >> Doesn't journald also "provide" syslog.socket?
> >> 
> >> Manual says:
> >>         syslog.socket
> >>             The socket unit syslog implementations should listen on. All
> >>             userspace log messages will be made available on this socket. 
> > For
> >>             more information about syslog integration, please consult the
> >>             Syslog Interface[2] document
> > 
> > you need no dependencies for logging ‑ journald is responsible for that 
> > and even available in the initrd
> 
> So journald is not listening to the syslog socket? So how are messages sent to
> the journal in a compatible way?
> At least the manual page for syslog.socket is confusing then.

So you say "the" syslog socket, but when you're running both journald and 
rsyslog, say, there are *two different syslog sockets*.

It looks something like this:

      app
       |
       V
    /dev/log (systemd-journald-dev-log.socket)
       |
       V
    journald
       |
       | if ForwardToSyslog=yes
       |
       V
    /run/systemd/journal/syslog
       |     (syslog.socket)
       |
       V
    rsyslog  (syslog.service, symlinked to rsyslog.service)

In other words, applications that expect something at /dev/log will work 
normally. Their messages sent to this socket will be sent to the journal. 
If the journal is configured to "forward to syslog", the message will sent 
to /run/systemd/journal/syslog ... and this will socket-activate some 
syslog implementation, such as rsyslog.

I documentation for syslog.socket does essentially say this. The "syslog 
implementations" it's talking about means "rsyslog etc.", and "userspace 
log messages will be made available on this socket" means that the journal 
will send those messages to that socket. The linked Syslog Interface 
document also goes into more detail on it.

Can you think of a better way of wording the documentation?