systemd-journald takes over many of the responsibilites of what was once done by
rsyslogd. Whether by bug or conflict between these two daemons, sometimes
/dev/log will go missing. As a result, programs relying on the
syslog(3) call will not function properly, including, for instance,
logger. How can I restore the
Asking and answering my own question because Google was not very helpful on this one.
imuxsock module will create the
/dev/log socket on its own, unlinking the previous entry before creating it. When
rsyslogd is stopped (possibly because restart which fails because of faulty configuration), rsyslogd removes
However, the rsyslog supplied with
RHEL7 is expected to be used in conjunction with
systemd, and the
imuxsock module will actually open and remove
/run/systemd/journal/syslog socket. Meanwhile, the
/dev/log device is created by the system service-file
systemd-journald.socket which triggers
Apparently, whether or not
$imjournal module is used, the following works.
In sum, if
systemctl restart systemd-journald.socket
then restart rsyslogd
systemctl start rsyslogd
UPDATE: I believe
restart rsyslogd might re-delete the socket if
rsyslogd is already running.
systemctl restart systemd-journald.socket && systemctl restart rsyslog solution did not work for me on Ubuntu 16.04.
Instead, I had to recreate
/dev/log as a symlink to
ln -s /run/systemd/journal/dev-log /dev/log