Package: syslog-ng-core Version: 3.19.1-5 Severity: important Dear Maintainer,
The Debian syslog-ng package is not collecting all systemd-journal messages. The use case that caused me to track this down is an inconsistency between the Debian syslog-ng and rsyslog packages when logging Knot DNS activity (using the 'knot' package from upstream https://deb.knot-dns.cz/knot-latest/). A default install of rsyslog captures Knot's logging activity to /var/log/user.log, while a default install of syslog-ng does not capture its activity at all. The default syslog-ng configuration should log the same messages to /var/log/user.log, but it seems syslog-ng doesn't even see the log messages. Digging a bit deeper .. journald.conf(5) indicates that syslog messages are written to /run/systemd/journal/syslog. I noted that syslog-ng does not create this socket, while rsyslog does. There is a comment in syslog.socket which indicates a syslog daemon is expected to include "Alias=syslog.service" in its [install] section in order to pull in this dependency. The rsyslog package does this, but the syslog-ng package does not. It seems likely this is related to the issues with capturing syslog messages. -- System Information: Debian Release: 10.8 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-14-amd64 (SMP w/16 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages syslog-ng-core depends on: ii libc6 2.28-10 ii libcap2 1:2.25-2 ii libcurl4 7.64.0-4+deb10u1 ii libglib2.0-0 2.58.3-2+deb10u2 ii libivykis0 0.42.3-1 ii libjson-c3 0.12.1+ds-2+deb10u1 ii libnet1 1.1.6+dfsg-3.1 ii libpcre3 2:8.39-12 ii libssl1.1 1.1.1d-0+deb10u5 ii libsystemd0 241-7~deb10u6 ii libuuid1 2.33.1-0.1 ii libwrap0 7.6.q-28 ii lsb-base 10.2019051400 ii syslog-ng-mod-journal 3.19.1-5 ii util-linux 2.33.1-0.1 Versions of packages syslog-ng-core recommends: ii logrotate 3.14.0-4 Versions of packages syslog-ng-core suggests: ii syslog-ng-mod-add-contextual-data 3.19.1-5 ii syslog-ng-mod-amqp 3.19.1-5 ii syslog-ng-mod-examples 3.19.1-5 ii syslog-ng-mod-extra 3.19.1-5 ii syslog-ng-mod-geoip 3.19.1-5 ii syslog-ng-mod-geoip2 3.19.1-5 ii syslog-ng-mod-getent 3.19.1-5 ii syslog-ng-mod-graphite 3.19.1-5 ii syslog-ng-mod-map-value-pairs 3.19.1-5 ii syslog-ng-mod-mongodb 3.19.1-5 ii syslog-ng-mod-pacctformat 3.19.1-5 ii syslog-ng-mod-python 3.19.1-5 ii syslog-ng-mod-redis 3.19.1-5 ii syslog-ng-mod-riemann 3.19.1-5 ii syslog-ng-mod-smtp 3.19.1-5 ii syslog-ng-mod-snmptrapd-parser 3.19.1-5 ii syslog-ng-mod-sql 3.19.1-5 ii syslog-ng-mod-stardate 3.19.1-5 ii syslog-ng-mod-stomp 3.19.1-5 ii syslog-ng-mod-tag-parser 3.19.1-5 ii syslog-ng-mod-xml-parser 3.19.1-5 -- no debconf information