Where does `logger` log its messages to in Arch Linux?

Question

The logger command logs an entry via syslog, which usually puts that line to some file like /var/log/messages.

If I understand the documentation correctly in Arch Linux all the logging is done through systemd, but I cannot find the logger entries using journalctl.

• What exactly happens with a message given to logger in Arch Linux?
• Where is the log entry stored? (A quick grep suggests /var/log/journal/*/system.journal.)
• How can I access this log? (Do I need any special option for journalctl?)

Answer 1

Because the log messages don't appear in the journal anywhere, I suspect that you don't have syslog to journald forwarding set up correctly, and the messages are simply getting dropped. Since you're on Arch, this is easy to fix. Ensure that the syslog-ng package is installed:

pacman -S syslog-ng

Then ensure that it's enabled on boot:

systemctl enable syslog-ng

Finally, since enabling services doesn't automatically start them, start the service:

systemctl start syslog-ng

See this Arch Wiki page for details.

Here's some background on why this problem occurs:

There is a certain way to log to classical syslog, and there is a certain way to log to the new systemd journal. These are incompatible; applications that support syslog cannot be magically made to support the journal - the author must explicitly implement this feature. Applications that support the systemd journal are generally referred to as supporting the "native API" when running on a systemd system.

Since the syslog API and the journald API are different, applications that don't support the journald API will just have their log messages dropped. This is what was happening in your case.

The syslog-ng package's job is to translate syslog API calls into journald API calls. In this way, syslog messages eventually make it into the journal.

Answer 2

Some daemons were not writing logs to /var/log/ in Arch Linux and the configuration for syslog-ng is different than the other answers I've seen.

The normal syslog-ng.service service isn't there, it's actually named syslog-ng@default.service instead.

This won't work:

# systemctl enable syslog-ng
Failed to enable unit: Unit file syslog-ng.service does not exist.

I have to do it slightly different per the Arch Wiki:

# systemctl start syslog-ng@default.service
# systemctl enable syslog-ng@default.service
Created symlink /etc/systemd/system/multi-user.target.wants/syslog-ng@default.service → /usr/lib/systemd/system/syslog-ng@.service.
#

Answer 3

Without any syslog installed it will log to the journal, to pull out logger logs:

$ some-command | logger -t foobar
$ journalctl SYSLOG_IDENTIFIER=foobar

-t = tag