Hello,
From what I remember the most feasible way of doing this is taking journald out of the equation entirely, although this will means /dev/log stuff won't go into journald at all.
I don't have the exact instructions ready to go, but the basic idea would be to tell systemd/journald to stop being the owner of /dev/log, and telling rsyslog to start being so.
For the journald part it probably involves disabling/stopping/masking the 'systemd-journald-dev-log.socket' unit, although disclaimer: there might be horrible side-effects.
For the rsyslog part I don't remember the method by which rsyslog determines it's in a systemd/journald system and decides not to open /dev/log itself.
Last disclaimer/warning: if you do get it to a state that seems working, keep in mind there's logging that exists *only* within journald as it is never written to /dev/log but delivered through other mechanisms.
Hope this helps as a starting point!
Regards,
Lennard Klein
?On 20/09/2020, 18:14, "rsyslog on behalf of Vitaly Repin via rsyslog" <rsyslog-bounces@lists.adiscon.com on behalf of rsyslog@lists.adiscon.com> wrote:
Hello,
I have a system with systemd which forwards log messages from /dev/log
to /run/systemd/journal/syslog . Unfortunately journald drops log
messages quite often and they do not reach rsyslogd.
I want to log to rsyslog directly from my application but glibc does
not allow to select the unix socket to send messages to. Path /dev/log
is hardcoded in bits/syslog-path.h and later used in misc/syslog.c
What options do I have to log to rsyslog directly without having
journald in between?
I consider cherry picking syslog logging implementation from glibc to
a separate library which will have a function to set a path to the
unix socket where syslog daemon listens.
May be such library already exists?
Thanks in advance for all the advices.
--
WBR & WBW, Vitaly
______________________________________________
This email is from Equinix (EMEA) B.V. or one of its associated companies in the territory from where this email has been sent. This email, and any files transmitted with it, contains information which is confidential, is solely for the use of the intended recipient and may be legally privileged. If you have received this email in error, please notify the sender and delete this email immediately. Equinix (EMEA) B.V.. Registered Office: Amstelplein 1, 1096 HA Amsterdam, The Netherlands. Registered in The Netherlands No. 57577889.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
From what I remember the most feasible way of doing this is taking journald out of the equation entirely, although this will means /dev/log stuff won't go into journald at all.
I don't have the exact instructions ready to go, but the basic idea would be to tell systemd/journald to stop being the owner of /dev/log, and telling rsyslog to start being so.
For the journald part it probably involves disabling/stopping/masking the 'systemd-journald-dev-log.socket' unit, although disclaimer: there might be horrible side-effects.
For the rsyslog part I don't remember the method by which rsyslog determines it's in a systemd/journald system and decides not to open /dev/log itself.
Last disclaimer/warning: if you do get it to a state that seems working, keep in mind there's logging that exists *only* within journald as it is never written to /dev/log but delivered through other mechanisms.
Hope this helps as a starting point!
Regards,
Lennard Klein
?On 20/09/2020, 18:14, "rsyslog on behalf of Vitaly Repin via rsyslog" <rsyslog-bounces@lists.adiscon.com on behalf of rsyslog@lists.adiscon.com> wrote:
Hello,
I have a system with systemd which forwards log messages from /dev/log
to /run/systemd/journal/syslog . Unfortunately journald drops log
messages quite often and they do not reach rsyslogd.
I want to log to rsyslog directly from my application but glibc does
not allow to select the unix socket to send messages to. Path /dev/log
is hardcoded in bits/syslog-path.h and later used in misc/syslog.c
What options do I have to log to rsyslog directly without having
journald in between?
I consider cherry picking syslog logging implementation from glibc to
a separate library which will have a function to set a path to the
unix socket where syslog daemon listens.
May be such library already exists?
Thanks in advance for all the advices.
--
WBR & WBW, Vitaly
______________________________________________
This email is from Equinix (EMEA) B.V. or one of its associated companies in the territory from where this email has been sent. This email, and any files transmitted with it, contains information which is confidential, is solely for the use of the intended recipient and may be legally privileged. If you have received this email in error, please notify the sender and delete this email immediately. Equinix (EMEA) B.V.. Registered Office: Amstelplein 1, 1096 HA Amsterdam, The Netherlands. Registered in The Netherlands No. 57577889.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.