[systemd-devel] Syslog forwarding not working within journal namespace

[Aaron Enberg]

/run/systemd/journal/syslog exists and I am sure that ForwardToSyslog=yes
is set on the default namespace.

I’d like to setup an additional socket at
/run/systemd/journal.my-namespace/syslog to forward logs to syslog from my
own namespace. Can you point me to the documentation for how I should do
this?


On Wed, Dec 28, 2022 at 2:32 AM Mantas Mikulėnas <grawity at gmail.com> wrote:

> The forwarding itself is namespaced. ForwardToSyslog relies on the syslogd
> daemon setting up a receiving socket at /run/systemd/journal/syslog through
> which journald will send the messages – but for namespaced journald, the
> runtime directory is different (the point of it being namespaced) so the
> syslogd needs to set up an additional socket at
> /run/systemd/journal.my-namespace/syslog as well.
>
> (Though are you sure the system was using ForwardToSyslog, and not some
> other method? The default configuration of both rsyslog and syslog-ng no
> longer uses this forwarding style, instead the syslogd directly imports
> messages from .journal files – which again needs the syslogd to be
> configured to read from the namespaced path in addition to the default
> path.)
>
> On Tue, Dec 27, 2022 at 11:01 PM Aaron Enberg <pastaaroni at gmail.com>
> wrote:
>
>> Hi maintainers,
>>
>> I am trying to get syslog forwarding working with a journal namespace I
>> created for my application.
>>
>> My system is on Debian 11, systemd 247 (247.3-7+deb11u1)
>>
>> Originally, my service used the default namespace and forwarding to syslog was working. After creating a journal namespace and assigning my service to it with
>> LogNamespace=my-namespace now the logs from my application do not get
>> forwarded to syslog.
>>
>> I have made sure /etc/systemd/journald at my-namespace.conf exists and contains the
>> setting ForwardToSyslog=yes. I actually just copied the default config at
>> /etc/systemd/journal.conf which has forwarding enabled by default. I can see the
>> logs in the journal with journalctl --namespace my-namespace.
>>
>> I haven't seen any bugs reported on this so I must be missing something.
>>
>> Regards,
>>
>> Aaron
>>
>>
>
> --
> Mantas Mikulėnas
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20221228/26154a88/attachment.htm>