3 ms·
/dev/log is probably a symlink to /run/systemd/journal/dev-log on your system. 'systemctl list-sockets' will show you that the socket is part of the systemd-jou
by yrro 7y ago
/dev/log is probably a symlink to /run/systemd/journal/dev-log on your system. 'systemctl list-sockets' will show you that the socket is part of the systemd-journald-dev-log.socket unit. So when a program calls the syslog(3) function, it ends up sending the message to journald.
If configured to forward messages to syslog, I think systemd does so via the /run/systemd/journal/syslog socket, which is part of syslog.socket. But I believe rsyslog will these days read messages directly out of the journal rather than relying on journald to forward them.
- chupasaurus 7y agoYou've got it right besides the last sentence. Copying from systemd-journald-dev-log.socket comment: Note that journald internally uses the this socket both for receiving syslog messages, and for forwarding them to any other syslog edit: formatting
- yrro 7y agoThat's a but confusing and I don't know how it would work. But last time I looked into how ForwardToSyslog= worked I discovered it was disabled in the default build configuration these days because rsyslog prefers to ingest from the journal rather than being fed messages via a socket...
- JdeBP 7y agoSee https://unix.stackexchange.com/a/294206/5132 https://unix.stackexchange.com/a/294206/5132 .