On Tue, 3 Feb 2015, Michael Biebl wrote:
2015-02-03 20:12 GMT+01:00 David Lang <[email protected]>:
the module load for imjournal line polls the journal, asking for all logs
since the last time it asked for logs. This is rather inefficient, but if
you need the extra journald metadata, you need to do this since the journal
won't send it otherwise.
The alturnative to this is to have journald send the logs to rsyslog (for
this, lookup the journald documentation where they say that they don't break
syslog because they support delivering logs to syslog)
It's only an alternative, if you don't need the additional metadata.
In this mode, journald will forward the messages to
/run/systemd/journal/syslog, and syslog will read from this socket
instead of /dev/log.
Those forwarded messages do not have any additional metadata.
ok, then to read this (assuming that your version of journald is outputting it)
should be:
input(type="imuxsock" socket="/run/systemd/journal/syslog")
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
