I'd be unsurprised if rsyslog has done datagrams for a while. omuxsock, the rsyslog log sender module, only does datagrams so I'd be surprised if imuxsock didn't handle them natively. Hell, they might have been always sending datagrams but not removing the stream markers until recently.
Yup, that's it. Oh, it's a mess. A huge mess; there doesn't seem to be any authority on the details of the syslog protocol. No normative body, the client is in the libc, the server is an application: a definite recipe for success! I've asked on the musl-libc list what they know about it. musl syslog() only uses datagrams, and actually fails to send anything to syslogd when a stream server is listening. It worked with glibc and uClibc - did those attempt connecting to a stream if the datagram failed ? >.> Waiting for an answer from the musl people. Oh, how I hate those situations. The right thing is obviously never to use syslog(), but it's so hard to get that through thick skulls used to decades of poor Unix history. -- Laurent
