21

The logger command logs an entry via syslog, which usually puts that line to some file like /var/log/messages.

If I understand the documentation correctly in Arch Linux all the logging is done through systemd, but I cannot find the logger entries using journalctl.

  • What exactly happens with a message given to logger in Arch Linux?
  • Where is the log entry stored? (A quick grep suggests /var/log/journal/*/system.journal.)
  • How can I access this log? (Do I need any special option for journalctl?)

3 Answers 3

18

Because the log messages don't appear in the journal anywhere, I suspect that you don't have syslog to journald forwarding set up correctly, and the messages are simply getting dropped. Since you're on Arch, this is easy to fix. Ensure that the syslog-ng package is installed:

pacman -S syslog-ng

Then ensure that it's enabled on boot:

systemctl enable syslog-ng

Finally, since enabling services doesn't automatically start them, start the service:

systemctl start syslog-ng

See this Arch Wiki page for details.

Here's some background on why this problem occurs:

There is a certain way to log to classical syslog, and there is a certain way to log to the new systemd journal. These are incompatible; applications that support syslog cannot be magically made to support the journal - the author must explicitly implement this feature. Applications that support the systemd journal are generally referred to as supporting the "native API" when running on a systemd system.

Since the syslog API and the journald API are different, applications that don't support the journald API will just have their log messages dropped. This is what was happening in your case.

The syslog-ng package's job is to translate syslog API calls into journald API calls. In this way, syslog messages eventually make it into the journal.

6
  • "[..] to translate syslog API calls into journald API calls" - As far as I see, the translation only works the other way around: I find all messages in /var/log/ but only the journald ones in journalctl.
    – michas
    Commented Jan 2, 2014 at 1:28
  • @michas that may be something that journald does, I'm not sure. syslog-ng forwards messages addressed to syslog to journald.
    – strugee
    Commented Jan 2, 2014 at 1:33
  • 1
    Does logger foobar;journalctl|grep foobar on your system list an entry?
    – michas
    Commented Jan 2, 2014 at 2:00
  • @michas I don't currently have a systemd system handy, but I'll check later. we should probably move this to chat...
    – strugee
    Commented Jan 2, 2014 at 2:05
  • "Since the syslog API and the journald API are different, applications that don't support the journald API will just have their log messages dropped." This is no longer true, right? Commented Apr 20, 2016 at 21:44
2

Some daemons were not writing logs to /var/log/ in Arch Linux and the configuration for syslog-ng is different than the other answers I've seen.

The normal syslog-ng.service service isn't there, it's actually named [email protected] instead.

This won't work:

# systemctl enable syslog-ng
Failed to enable unit: Unit file syslog-ng.service does not exist.

I have to do it slightly different per the Arch Wiki:

# systemctl start [email protected]
# systemctl enable [email protected]
Created symlink /etc/systemd/system/multi-user.target.wants/[email protected] → /usr/lib/systemd/system/[email protected].
#
0

Without any syslog installed it will log to the journal, to pull out logger logs:

$ some-command | logger -t foobar
$ journalctl SYSLOG_IDENTIFIER=foobar

-t = tag

2
  • 1
    This doesn’t answer the question; what do tags have to do with “where does logger log its messages?” Commented Dec 22, 2021 at 8:51
  • If syslog is not installed it ends up in the journal, and part of the question was How can I access this log? (Do I need any special option for journalctl?)
    – bk201
    Commented Dec 23, 2021 at 6:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .