[systemd-devel] Antw: Re: Antw: [EXT] Re: Q; syslog.socket dependency

[Ulrich Windl]

>>> Michael Chapman <mike at very.puzzling.org> schrieb am 12.03.2021 um 08:59 in
Nachricht <90c9a861-f8cd-88d7-647-c6cc2a8ad081 at very.puzzling.org>:
> On Fri, 12 Mar 2021, Ulrich Windl wrote:
>> >>> Reindl Harald <h.reindl at thelounge.net> schrieb am 11.03.2021 um 16:23
in
>> Nachricht <4422087b-9966-e7fb-66ad-4157d83f2f3b at thelounge.net>:
>> 
>> > 
>> > Am 11.03.21 um 12:17 schrieb Ulrich Windl:
>> >> Hi!
>> >> 
>> >> I have a unit that uses logger, and I want to run it after syslog is 
>> > available. So I added syslog.socket as dependency, but it fails:
>> >> Mar 11 12:11:02 jeos1 systemd[1]: syslog.socket: Socket service 
>> > syslog.service not loaded, refusing.
>> >> Mar 11 12:11:02 jeos1 systemd[1]: Failed to listen on Syslog Socket.
>> >> 
>> >> Doesn't journald also "provide" syslog.socket?
>> >> 
>> >> Manual says:
>> >>         syslog.socket
>> >>             The socket unit syslog implementations should listen on.
All
>> >>             userspace log messages will be made available on this
socket. 
>> > For
>> >>             more information about syslog integration, please consult
the
>> >>             Syslog Interface[2] document
>> > 
>> > you need no dependencies for logging ‑ journald is responsible for that 
>> > and even available in the initrd
>> 
>> So journald is not listening to the syslog socket? So how are messages sent

> to
>> the journal in a compatible way?
>> At least the manual page for syslog.socket is confusing then.
> 
> So you say "the" syslog socket, but when you're running both journald and 
> rsyslog, say, there are *two different syslog sockets*.
> 
> It looks something like this:
> 
>       app
>        |
>        V
>     /dev/log (systemd-journald-dev-log.socket)
>        |
>        V
>     journald
>        |
>        | if ForwardToSyslog=yes
>        |
>        V
>     /run/systemd/journal/syslog
>        |     (syslog.socket)
>        |
>        V
>     rsyslog  (syslog.service, symlinked to rsyslog.service)
> 
> In other words, applications that expect something at /dev/log will work 
> normally. Their messages sent to this socket will be sent to the journal. 
> If the journal is configured to "forward to syslog", the message will sent 
> to /run/systemd/journal/syslog ... and this will socket-activate some 
> syslog implementation, such as rsyslog.
> 
> I documentation for syslog.socket does essentially say this. The "syslog 
> implementations" it's talking about means "rsyslog etc.", and "userspace 
> log messages will be made available on this socket" means that the journal 
> will send those messages to that socket. The linked Syslog Interface 
> document also goes into more detail on it.
> 
> Can you think of a better way of wording the documentation? 

It depends: Do you consider /dev/log to be a "syslog socket"?
(I'm not running rsyslog there)

Regards,
Ulrich