On RHEL7, systemd-journald takes over many of the responsibilites of what was once done by rsyslogd. Whether by bug or conflict between these two daemons, sometimes /dev/log will go missing. As a result, programs relying on the syslog(3) call will not function properly, including, for instance, logger. How can I restore the /dev/log socket?


Asking and answering my own question because Google was not very helpful on this one.

Normally, with rsyslogd, the imuxsock module will create the /dev/log socket on its own, unlinking the previous entry before creating it. When rsyslogd is stopped (possibly because restart which fails because of faulty configuration), rsyslogd removes /dev/log.

However, the rsyslog supplied with RHEL7 is expected to be used in conjunction with systemd, and the imuxsock module will actually open and remove /run/systemd/journal/syslog socket. Meanwhile, the /dev/log device is created by the system service-file systemd-journald.socket which triggers journald.

Apparently, whether or not $imjournal module is used, the following works.

In sum, if /dev/log disappears:

  1. restart systemd-journald.socket:

    systemctl restart systemd-journald.socket
  2. then restart rsyslogd

    systemctl start rsyslogd

UPDATE: I believe restart rsyslogd might re-delete the socket if rsyslogd is already running.

  • 2
    Thanks so much for this! I just lost several hours tracking down why logging wasn't working for a service. I finally tracked it down to the missing /dev/log, which lead me to your solution. – Chad Huneycutt Dec 9 '16 at 3:23

The systemctl restart systemd-journald.socket && systemctl restart rsyslog solution did not work for me on Ubuntu 16.04.

Instead, I had to recreate /dev/log as a symlink to /run/systemd/journal/dev-log:

ln -s /run/systemd/journal/dev-log /dev/log
  • Yes, manually linking should work as well. But it's a bit unwieldy to remember. Question: On Ubuntu does systemd-journald.socket exist as a service? Q2: maybe the restart rsyslogd was the problem? Maybe it should simply be start rsyslogd? – Otheus Mar 9 '17 at 14:13
  • Q1: yes, it exists. Q2: there's no restart command anymore, there's service and /etc/init.d/rsyslog. – 11181 Mar 9 '17 at 21:46
  • By restart rsyslogd I thought it was clear I meant systemctl restart rsyslogd. Does Ubuntu still use init scripts for rsyslog? – Otheus Mar 10 '17 at 8:52
  • @Otheus /etc/init.d/rsyslog stop followed by /etc/init.d/rsyslog start did not help. Neither did systemctl stop syslog.socket rsyslog.service && systemctl start syslog.socket rsyslog.service On my system there's both /lib/systemd/system/rsyslog.service and /etc/init.d/rsyslog. Anyway, I'd rather not spend more time on this problem. – 11181 Mar 11 '17 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.