18

The logger command logs an entry via syslog, which usually puts that line to some file like /var/log/messages.

If I understand the documentation correctly in Arch Linux all the logging is done through systemd, but I cannot find the logger entries using journalctl.

  • What exactly happens with a message given to logger in Arch Linux?
  • Where is the log entry stored? (A quick grep suggests /var/log/journal/*/system.journal.)
  • How can I access this log? (Do I need any special option for journalctl?)
15

Because the log messages don't appear in the journal anywhere, I suspect that you don't have syslog to journald forwarding set up correctly, and the messages are simply getting dropped. Since you're on Arch, this is easy to fix. Ensure that the syslog-ng package is installed:

pacman -S syslog-ng

Then ensure that it's enabled on boot:

systemctl enable syslog-ng

Finally, since enabling services doesn't automatically start them, start the service:

systemctl start syslog-ng

See this Arch Wiki page for details.

Here's some background on why this problem occurs:

There is a certain way to log to classical syslog, and there is a certain way to log to the new systemd journal. These are incompatible; applications that support syslog cannot be magically made to support the journal - the author must explicitly implement this feature. Applications that support the systemd journal are generally referred to as supporting the "native API" when running on a systemd system.

Since the syslog API and the journald API are different, applications that don't support the journald API will just have their log messages dropped. This is what was happening in your case.

The syslog-ng package's job is to translate syslog API calls into journald API calls. In this way, syslog messages eventually make it into the journal.

  • syslog-ng was installed but not enabled, I assumed journald had replaced it completely. Is logger only able to talk to syslog? What is the correct way to log to journald then? – michas Jan 2 '14 at 1:08
  • @michas I've added a section that will hopefully clarify that – strugee Jan 2 '14 at 1:16
  • "[..] to translate syslog API calls into journald API calls" - As far as I see, the translation only works the other way around: I find all messages in /var/log/ but only the journald ones in journalctl. – michas Jan 2 '14 at 1:28
  • @michas that may be something that journald does, I'm not sure. syslog-ng forwards messages addressed to syslog to journald. – strugee Jan 2 '14 at 1:33
  • 1
    Does logger foobar;journalctl|grep foobar on your system list an entry? – michas Jan 2 '14 at 2:00
0

Some daemons were not writing logs to /var/log/ in Arch Linux and the configuration for syslog-ng is different than the other answers I've seen.

The normal syslog-ng.service service isn't there, it's actually named syslog-ng@default.service instead.

This won't work:

# systemctl enable syslog-ng
Failed to enable unit: Unit file syslog-ng.service does not exist.

I have to do it slightly different per the Arch Wiki:

# systemctl start syslog-ng@default.service
# systemctl enable syslog-ng@default.service
Created symlink /etc/systemd/system/multi-user.target.wants/syslog-ng@default.service → /usr/lib/systemd/system/syslog-ng@.service.
#

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.