1

I would like systemd-journald in systemd 219 (on el7, so the package is systemd-219-30.el7_3.9.x86_64) to listen for syslog messages on /run/systemd/journal/dev-log, and have /dev/log be a symlink to that file. This is the default behavior of more recent versions of systemd-journald.

The stock /lib/systemd/system/sytemd-journald.socket looks like this:

[Unit]
Description=Journal Socket
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target

[Socket]
ListenStream=/run/systemd/journal/stdout
ListenDatagram=/run/systemd/journal/socket
ListenDatagram=/dev/log
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
ReceiveBuffer=8M

I modify that file to remove the ListenDatagram=/dev/log line.

I created a new unit, /etc/systemd/system/systemd-journal-dev-log.socket that looks like:

[Unit]
Description=Journal Socket (/dev/log)
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target
IgnoreOnIsolate=yes

[Socket]
Service=systemd-journald.service
ListenDatagram=/run/systemd/journal/dev-log
Symlinks=/dev/log
SocketMode=0666
PassCredentials=yes
PassSecurity=yes

ReceiveBuffer=8M
SendBuffer=8M

[Install]
WantedBy=systemd-journald.service

I modified /lib/systemd/system/systemd-journald.service so that it includes:

Sockets=systemd-journald.socket systemd-journald-dev-log.socket

I reload systemd (systemctl daemon-reload), enable the new socket systemctl enable systemd-journald-dev-log.socket) and restart all journald related units (systemctl restart systemd-journald\*), after which systemctl cat systemd-journald.socket shows that the changes are active:

# systemctl list-units | grep journald
systemd-journald.service               loaded active running   Journal Service
systemd-journald-dev-log.socket        loaded active running   Journal Socket (/dev/log)
systemd-journald.socket                loaded active running   Journal Socket

# systemctl cat systemd-journald.service | grep Socket
Sockets=systemd-journald.socket systemd-journald-dev-log.socket

# systemctl cat systemd-journald.socket | grep Listen
ListenStream=/run/systemd/journal/stdout
ListenDatagram=/run/systemd/journal/socket

# systemctl cat systemd-journald-dev-log.socket | grep Listen
ListenDatagram=/run/systemd/journal/dev-log

But despite the above configuration, I find that /dev/log is not a symlink:

# ls -l /dev/log
srw-rw-rw-. 1 root root 0 Sep 12 17:33 /dev/log

And in fact it has been opened by systemd-journald directly, rather than by systemd itself:

# lsof | grep /dev/log
systemd-j 186     root    5u     unix 0xffff8b5076bc8000      0t0    157285 /dev/log

What's going on here? Why doesn't my socket unit work as expected? Is there any way to work around this problem that doesn't involve an upgrade to systemd?

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.