On Mon, 22 Dec 2025 at 15:16, David Rosenstrauch <[email protected]> wrote: > > I have 2 Arch machines, both of which had been set up to forward > messages from journald to syslog, and so eventually to the log files in > /var/log. I noticed the other day that on both machines, the /var/log > log files are now all empty, which I'm guessing means that journald is > no longer forwarding messages to syslog. I'm certain that I had this > configuration working in the past. But something seems to have changed > at some point that's broken it. I'm not sure what changed, or when it > happened. I've tried to fix, but with no luck. > > I have syslog-ng installed, and the syslog-ng@default service enabled > and running. I also have "ForwardToSyslog=yes" set in my > /etc/systemd/journald.conf file, and the systemd-journald service is > enabled and running. Yet somehow they're (I'm guessing) not talking to > each other and forwarding the log messages. > > According to this forum post there might a socket > /run/systemd/journal/syslog that needs to be created in order for this > setup to work. This socket file doesn't exist on my system. That socket > file seems to get created by the systemd unit script > /usr/lib/systemd/system/syslog.socket, which seems to be triggered by > /usr/lib/systemd/system/systemd-journald.service. However, that > syslog.socket unit either doesn't seem to be getting triggered or is > failing. And when I try to start the syslog.socket unit script > manually, it fails. (And with very little in the way of explanatory > messages.): > > [darose@titan log]$ sudo systemctl start syslog.socket > Job failed. See "journalctl -xe" for details. > > [darose@titan log]$ systemctl status syslog.socket > ○ syslog.socket - Syslog Socket > Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static) > Active: inactive (dead) > Triggers: ● syslog.service > Docs: man:systemd.special(7) > https://systemd.io/SYSLOG > Listen: /run/systemd/journal/syslog (Datagram) > > Dec 20 19:52:01 titan systemd[1]: syslog.socket: Socket service > syslog.service not loaded, refusing. > Dec 20 19:52:01 titan systemd[1]: Failed to listen on Syslog Socket. > > Anyone have any idea what might be broken here / how to fix? > > Thanks, > > DR
The syslog.socket is for communication between journald and the classic syslog implementation [1]. Syslog-ng has an automatic integration with systemd and pulls logs from the journal by itself [2]. The Wiki says you don't even need "ForwardToSyslog=yes", although I do that too, mostly to avoid missing any logs in syslog-ng. For my setup, I have something like this: ```/etc/systemd/journald.conf.d/forward.conf [Journal] Storage=auto SystemMaxUse=1G RuntimeMaxUse=100M MaxFileSec=1month ForwardToSyslog=yes ``` And then my long-lived logs are managed by syslog-ng and logrotate. [1]: https://wiki.archlinux.org/title/Systemd/Journal#Journald_in_conjunction_with_syslog [2]: https://wiki.archlinux.org/title/Syslog-ng#systemd/journald_integration
